How to tell what SHA-X version the IOS is using?

[leam_hall]

Morning all! I need to verify that the IOS image we are running is using SHA-256 or higher. How do I do that?

Thanks!

Leam

[Panos Kampanakis]

All "older" IOS versions only support SHA1. Only newer IOS versions will support SHA2. It depends on the IOS.

I hope it helps.

PK

[leam_hall]

How do I tell? Is there an IOS command to show? Can it be configured? If there's an option for SHA-1 or SHA-256, how do I make sure I'm only using the latter.

Thanks!

Leam

[wzhang]

Hi,

I'm not aware of an IOS command that will show this, but you can easily tell if the SHA2 capabilities are supported by trying to configure it under either the isakmp policy or ipsec transform-set. Eg.,

router#config t

Enter configuration commands, one per line.  End with CNTL/Z.

*Jan 19 11:45:57.975: %SYS-5-CONFIG_I: Configured from console by consolet

router(config)#crypto ipsec transform-set test ?

  ....snip....

  esp-sha-hmac     ESP transform using HMAC-SHA auth

  esp-sha256-hmac  ESP transform using HMAC-SHA256 auth

  esp-sha384-hmac  ESP transform using HMAC-SHA384 auth

  esp-sha512-hmac  ESP transform using HMAC-SHA512 auth

Hope this helps,

Wen

[leam_hall]

I don't seem to have that capability. We are using  12.2.(53) (IPSERVICESK9-M) and 12.2(55).

Still looking...

Leam

[wzhang · Accepted solution]

Hi, Leam:

No your code won't have it. The sha-2 support (as part of Suite B) wasn't introduced until very recently - 15.1(2)T for the software crypto engine, and 15.1(3)T for the ISR G2 platforms, see:

http://www.cisco.com/en/US/partner/docs/ios/15_1/release/notes/151TNEWF.html#wp1094818

Thanks,

Wen

[leam_hall]

Wen, thanks!

Is there an expected time SHA-2 will get to the 12.2 line? I can't see the "partner" website you sent, we're only on a customer support level.

Leam

[wzhang]

Hi, Leam:

Try this link instead:

http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151TNEWF.html#wp1094818

No I don't know if/when SHA-2 support will be added to the 12.2S train. You may want to check with your cisco account rep on that.

Thanks,

Wen