A hash function converts input data such as a password into a fixed-length digest that cannot be reverted to the original input. Hashing is one-way, unlike reversible encryption. section 11.3.1
For Cisco IOS password protection, store enable secrets as hashes rather than cleartext or weak reversible encryption. Type 0 enable passwords expose cleartext, while type 7 passwords remain easily decryptable. section 11.3.1
Use enable secret instead of enable password. IOS supports multiple hashing algorithms; the available algorithms depend on the device model and IOS version, and an unspecified algorithm uses the device default. section 11.3.1
Hash an enable secret with scrypt
SW1(config)# enable algorithm-type scrypt secret CiscoCCNA SW1(config)# do show running-config | include enable enable secret 9 $9$h.p1X8KVxbaILq$pNEykQjoAJbKCYfmBL9Hq8yPU/EqDGpoBkCIZ.s9GJA The saved value is a hash, and the leading algorithm indicator identifies scrypt.















