How do I disable Cipher Block Chaining (CBC) encryption for SSH server on Cisco 3560X Switches

[yclee88_ncs]

Hi, a security audit has found that the SSH server service on our WS-C3560X-48T-L running IOS version 15.0(2)SE5 is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.

The advice from auditor is to disable Cipher Block Chaining specifically and then enable CTR or GCM cipher mode encryption - how can this be done? Is it something that can be performed from the IOS command line?  Please advise and thanks in advanced.

[Karsten Iwen · Accepted solution]

I don't think that the 3560X already supports CTR. On the IOS-routers, support was added in IOS 15.4(2)T. Until we have the support in IOS, the SSH-crypto is quite limited.

[carlbaca]

Hi,

I have switches 2960G with this problem. In this case, not is posibble solve the problem?

Thanks