Scrypt

Q: How deeply does Acing the CCNA Exam: Volume 2 Advanced Networking and Security cover scrypt?

Explains algorithm types, configuration forms, stored output, and the distinction between cleartext and pre-hashed secrets.

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

scrypt is a memory-hard password-based key derivation and hashing algorithm designed to resist hardware-accelerated password guessing.

scrypt is a password-based hashing and key-derivation algorithm designed to make hardware-accelerated password guessing difficult. Cisco identifies it as type 9 and uses it for strongly hashed enable secrets on modern devices. section 11.3.1

Use scrypt correctly by distinguishing these Cisco IOS operations:

Configure and hash a cleartext enable secret with enable algorithm-type scrypt secret password. section 11.3.1
Configure an already-hashed scrypt secret with enable secret 9 hash; type 9 identifies scrypt. section 11.5.2
Avoid confusing scrypt type 9 with MD5 type 5 or SHA-256 type 8. section 11.3.1 section 11.5.2

Configure and verify a scrypt enable secret

SW1(config)# enable algorithm-type scrypt secret CiscoCCNA SW1(config)# do show running-config | include enable enable secret 9 $9$h.p1X8KVxbaILq$pNEykQjoAJbKCYfmBL9Hq8yPU/EqDGpoBkCIZ.s9GJA The running configuration stores the credential as type 9 followed by the hash, allowing the hashed command to be copied to another device. section 11.3.1

SW1(config)# enable algorithm-type scrypt secret CiscoCCNA                    #1
SW1(config)# do show running-config | include enable
enable secret 9 $9$h.p1X8KVxbaILq$pNEykQjoAJbKCYfmBL9Hq8yPU/EqDGpoBkCIZ.s9GJA #2
#1 Configures an enable secret and hashes it with the scrypt algorithm
#2 The enable secret is saved as a hash, with the algorithm type indicated before the hash.

Inspect the annotated Cisco IOS command and running-configuration output. section 11.3.1

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

Cover of Acing the CCNA Exam: Volume 2 Advanced Networking and Security

liveBook manning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

SCryptPasswordEncoderused by · SCryptPasswordEncoder is a Spring Security PasswordEncoder implementation that encodes passwords with the scrypt password-hashing function.
type 9equivalent to · Type 9 is the Cisco IOS configuration identifier for a password stored using an scrypt-derived hash representation.
hash functionkind of · A hash function deterministically maps input data to a value in a bounded output range, commonly for indexing, lookup, comparison, or integrity checking.
md5alternative to · MD5 is a cryptographic hash algorithm that produces a 128-bit message digest and is considered insecure because practical collision attacks exist.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.