Cisco 2851 - Integrated Services Router Benutzerhandbuch - Seite 10
Blättern Sie online oder laden Sie pdf Benutzerhandbuch für Netzwerk-Router Cisco 2851 - Integrated Services Router herunter. Cisco 2851 - Integrated Services Router 25 Seiten. Power up and initial configuration procedures
Auch für Cisco 2851 - Integrated Services Router: Installation und Upgrades (21 seiten), Datenblatt (20 seiten), Schnellstart-Handbuch (47 seiten), Konfiguration (10 seiten)
Seite drucken
Cisco 2851 Routers
•
•
The router is in the approved mode of operation only when FIPS 140-2 approved algorithms are used
(except DH which is allowed in the approved mode for key establishment despite being non-approved).
The following are not FIPS 140-2 approved algorithms: RC4, MD5, HMAC-MD5, RSA and DH.
Note: The module supports DH key sizes of 1024 and 1536 bits. Therefore, DH provides 80-bit and
96-bit of encryption strength per NIST 800-57.
The module supports two types of key management schemes:
•
•
The module supports commercially available Diffie-Hellman for key establishment. See the Cisco IOS
Reference Guide.
All pre-shared keys are associated with the CO role that created the keys, and the CO role is protected
by a password. Therefore, the CO password is associated with all the pre-shared keys. The Crypto
Officer needs to be authenticated to store keys. All Diffie-Hellman (DH) keys agreed upon for individual
tunnels are directly associated with that specific tunnel only via the IKE protocol.
Key Zeroization:
Each key can be zeroized by sending the "no" command prior to the key function commands. This will
zeroize each key from the DRAM, the running configuration.
"Clear Crypto IPSec SA" will zeroize the IPSec DES/3DES/AES session key (which is derived using
the Diffie-Hellman key agreement technique) from the DRAM. This session key is only available in the
DRAM; therefore this command will completely zeroize this key. The following command will zeroize
the pre-shared keys from the DRAM:
•
•
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
10
Software (IOS) implementations
AES
–
DES (for legacy use only) (transitional phase only – valid until May 19th, 2007)
–
3DES
–
SHA-1
–
HMAC-SHA-1
–
X9.31 PRNG
–
Onboard hardware implementations
AES
–
DES (for legacy use only) (transitional phase only – valid until May 19th, 2007)
–
3DES
–
SHA-1
–
HMAC-SHA-1
–
Pre-shared key exchange via electronic key entry. DES/3DES/AES key and HMAC-SHA-1 key are
exchanged and entered electronically.
Internet Key Exchange method with support for pre-shared keys exchanged and entered
electronically.
The pre-shared keys are used with Diffie-Hellman key agreement technique to derive DES,
–
3DES or AES keys.
The pre-shared key is also used to derive HMAC-SHA-1 key.
–
no set session-key inbound ah spi hex-key-data
no set session-key outbound ah spi hex-key-data
OL-8717-01