cipher block chaining

[curtis03_2]

Hi

A recent Nessus vul scan has highlighted several issues with my customer infrastructure comprising Cisco 3850 IOS-XE switch stacks (WS-C3850-48P  v03.06.00E).

Can anyone please confirm how I can fix the following issue: -

1) 'The SSH server is configured to use Cipher Block Chaining - disable CBC mode & enable CTR or GCM encryption'

Also the scan has highlighted numerous SSL issues which I presume are due to having 'ip http secure-server' configured. Am I correct to assume disabling 'ip http secure-server' will remove these SSL issues?

Many thanks for any help!

[Aditya Ganjoo]

Hi Curtis,

The command you will want to look at is "ip ssh server algorithm encryption " command.

This allows you to change the encryption methods allowed for encrypting SSH sessions and you can disable Cipher Block Chaining (CBC) methods by omitting them from this configuration.

The configuration options available and how to implement them specifically are documented at this link:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_ssh/configuration/15-s/sec-usr-ssh-15-s-book/sec-secure-shell-algorithm-ccc.html#concept_9C253BD1B6AC4F10AB86EFC33C7FECA8

Regards,

Aditya

Please rate helpful posts.

[Aditya Ganjoo]

Hi Curtis,

Some more info on this.

Cisco didn't disable the CBC mode ciphers because it needed to provide backward compatibility and this feature cannot be disabled, though the preferred method for the server is always CTR mode cipher if that is enabled.

CTR mode is enabled by your switch or router being upgraded to the fixed-in released versions, following enhancement details provided:

CSCty14415

https://tools.cisco.com/bugsearch/bug/CSCty14415/?reffering_site=dumpcr

So CBC cannot be disabled on Cisco switches or routers, and secondly, enable CTR encryption, which will be enabled after you upgrade your device to the fixed-in versions released under the above enhancement.

Regards,

Aditya

Please rate helpful posts.

[curtis03_2]

Aditya thank you very much for such a prompt response

[Aditya Ganjoo · Accepted solution]

Hi Curtis,

Happy to help.

Regards,

Aditya

Please proceed to rate and mark as correct this respond if it helped you.