{"id":52574,"date":"2023-06-30T16:39:00","date_gmt":"2023-06-30T16:39:00","guid":{"rendered":"https:\/\/www.networkworld.com\/article\/3701290\/cisco-urges-stop-using-weak-crypto-algorithms-with-ospf.html#tk.rss_security"},"modified":"2023-06-30T16:39:00","modified_gmt":"2023-06-30T16:39:00","slug":"cisco-urges-stop-using-weak-crypto-algorithms-with-ospf","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cisco-urges-stop-using-weak-crypto-algorithms-with-ospf\/","title":{"rendered":"Cisco urges stop using weak crypto algorithms with OSPF"},"content":{"rendered":"
<\/div>\n

To reduce the risk of service problems, Cisco is making it harder for organizations to use weak cryptographic algorithms when setting up authentication for OSPF packets on certain Catalyst Edge Platforms and Integrated Services Routers (ISR).<\/p>\n

Newer versions of Cisco\u2019s IOS XE software (Release 17.11.1 and later) no longer support those algorithms\u2014DES, 3DES, and MD5\u2014by default, Cisco stated in a field Notice<\/a>.<\/p>\n

Specifically, the algorithms are no longer default options for the open shortest path first v 3 (OSPFv3) protocol<\/a>, which uses the IPsec secure socket API to add authentication to OSPFv3 packets that distribute routing information.<\/p>\n

\u201cIn order to continue to use such weak cryptographic encryption algorithms, explicit configuration is required,\u201d Cisco stated in a field Notice<\/a>. \u201cOtherwise, OSPF neighborship will fail to establish and cause service disruption as a result.\u201d<\/p>\n

These algorithms should be replaced with stronger algorithms, specifically Advanced Encryption Standard\u2014Cipher Block Chaining (AES-CBC) for encryption and Service Hash Algorithm (SHA1 or SHA2) for authentication, Cisco stated. <\/a><\/p>\n

Cisco says there is a workaround to the issue, but recommends against it.<\/p>\n