Detections
Analytics

1.2 Enable AES-GCM Encryption of EOS Secrets

Information

AES-GCM has been added as a method for storing symmetric secrets in EOS. This applies to secrets that must be used to remote systems, as found in NTP, TACACS+, and other places.

A new secret type "8a", which stands for AES-256-GCM encryption type, has been introduced. Secrets can either be entered in type 0, plaintext, and automatically converted or entered directly as type 8a. Upon accepting a value which is encrypted using the new type "8a", the CLI will validate the encrypted value to ensure that it is correctly encoded.

The default method of storing shared secrets is to obfuscate them in the running configuration. This obfuscation mean secrets can be easily reversed by copying the configuration out of the box. With AES-GCM, the configuration can be secured since the secrets cannot be easily reversed or decrypted by copying the configuration out of the box.

Solution

switch#conf
switch(config)#management security
switch(config-mgmt-security)#password encryption reversible aes-256-gcm

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-28(1)

Plugin: Arista

Control ID: cb9ea0a307132f06c2df48de2f1ed311ba4c6c69d08f1b525b9bb910fd538586