SSH weak MAC algorithms enabled

chenhui · Created Apr 14, 2020 12:36:10

Hi @user_3445655,
From the documentation, the weak algorithms of the algorithms your listed are hmac-sha2-256-96 and hmac-sha1-96.
Kindly disable these two algorithms to terminate the warnings.
You can refer to the example below:
<HUAWEI> system-view
[~HUAWEI] ssh server hmac sha2_256

For more deatils, you can refer to https://support.huawei.com/hedex/hdx.do?docid=EDOC1100020548&id=ssh_server_hmac&lang=en

DDSN · Created 2 days 08:11

As with most encryption schemes, SSH MAC algorithms are used to validate data integrity and authenticity. A ‘MAC algorithm’ should not be conflated with a MAC (Message Authentication Code) as these are two distinct components. The MAC algorithm uses a message and private key to generate the fixed-length MAC.

MAC algorithms may be considered weak for the following reasons:
A known weak hashing function is used (MD5)
The digest length is too small (Less than 128 bits)
The tag size is too small (Less than 128 bits)

The following are the most common weak MAC algorithms encountered:
hmac-md5
hmac-md5-96
hmac-sha1-96
hmac-sha2-256-96
hmac-sha2-512-96

chenhui · Created Apr 14, 2020 12:19:37

Hi,
Kindly wait a second, we are processing on you problem.

chenhui · Created Apr 14, 2020 12:36:10

Hi @user_3445655,
From the documentation, the weak algorithms of the algorithms your listed are hmac-sha2-256-96 and hmac-sha1-96.
Kindly disable these two algorithms to terminate the warnings.
You can refer to the example below:
<HUAWEI> system-view
[~HUAWEI] ssh server hmac sha2_256

For more deatils, you can refer to https://support.huawei.com/hedex/hdx.do?docid=EDOC1100020548&id=ssh_server_hmac&lang=en

DDSN · Created 2 days 08:11

As with most encryption schemes, SSH MAC algorithms are used to validate data integrity and authenticity. A ‘MAC algorithm’ should not be conflated with a MAC (Message Authentication Code) as these are two distinct components. The MAC algorithm uses a message and private key to generate the fixed-length MAC.

MAC algorithms may be considered weak for the following reasons:
A known weak hashing function is used (MD5)
The digest length is too small (Less than 128 bits)
The tag size is too small (Less than 128 bits)

The following are the most common weak MAC algorithms encountered:
hmac-md5
hmac-md5-96
hmac-sha1-96
hmac-sha2-256-96
hmac-sha2-512-96

SSH weak MAC algorithms enabled

Best answer

Recommended answer

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

SSH weak MAC algorithms enabled

Best answer

Recommended answer

Third Party’s Trade Secret

My Followers