• In the previous lesson, MD5 kept your secret key off the wire by sending a hash instead of cleartext. While this stops simple packet sniffing, it leaves a major security gap. MD5 is computationally fast, making captured hashes vulnerable to offline cracking.

    The Risk: Offline Brute-Force Attacks

    Once an attacker captures an MD5 hash from an OSPF Hello packet, they no longer need access to your network devices.

    A hacker on the shared switch captures an OSPF Hello and reads the MD5 Auth Crypt Data hash to launch an offline brute-force attack

    Figure 1 - The attacker captures the MD5 hash off the wire

    They can extract the hash, take it offline, and test billions of key combinations per second using GPU-accelerated cracking tools like Hashcat.

    Launch the scenario above to step into the shoes of a hacker trying to crack a password using MD5 versus HMAC-SHA.

    Answer the question below

    Enter the flag

    The Solution: HMAC-SHA Cryptography

    To eliminate this vulnerability, modern enterprise networks use HMAC-SHA.

    It operates on the same core principle as MD5, your key never leaves the router but uses the far more resilient SHA-2 algorithm family.

    The OSPF key PMN_KEY passing through an HMAC-SHA-512 hash function and coming out as an unreadable 128-character digest

    Figure 2 - The key goes in, a 128-character digest comes out

    HMAC-SHA provides three upgrades over MD5:

    • Slower to crack: SHA-512 is computationally heavy, making each attempt far more expensive for an attacker and rendering brute-force attacks impractical.

    • Longer passwords: Supports key strings up to 80 characters (compared to a 16-character cap for MD5).

    • Collision-resistant: MD5 suffers from known mathematical collision flaws. The SHA-2 family has no known collision vulnerabilities.

    Now, let's jump into the CLI and see how to configure it on your routers.

    Answer the question below

    HMAC-SHA still uses which OSPF Auth Type value?