Cisco 2811 Series Operations - Page 16
Browse online or download pdf Operations for Network Router Cisco 2811 Series. Cisco 2811 Series 31 pages. 2800 series integrated services routers
Also for Cisco 2811 Series: Datasheet (20 pages), Installing And Upgrading (14 pages), Operations (31 pages), Quick Start Manual (47 pages)
Print Page
Cisco 2811 and Cisco 2821 Routers
•
•
•
•
The DRAM running configuration must be copied to the start-up configuration in NVRAM in order to
completely zeroize the keys.
The following commands will zeroize the pre-shared keys from the DRAM:
•
•
The DRAM running configuration must be copied to the start-up configuration in NVRAM in order to
completely zeroize the keys.
The module supports the following keys and critical security parameters (CSPs). Note that keys stored
in NVRAM are in plaintext unless the configuration file encryption key is configured via the "key
config-key" command is used.
Table 9
Cryptographic Keys and CSPs
Name
Algorithm
PRNG Seed
X9.31
Diffie Hellman
DH
private
exponent
Diffie Hellman
DH
public key
skeyid
Keyed
SHA-1
skeyid_d
Keyed
SHA-1
skeyid_a
HMAC-
SHA-1 or
DES MAC
skeyid_e
DES/TDES
/AES
IKE session
DES/TDES
encrypt key
/AES
IKE session
HMAC-
authentication
SHA-1 or
key
DES MAC
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
16
no set session-key inbound ah spi hex-key-data
no set session-key outbound ah spi hex-key-data
no set session-key inbound esp spi cipher hex-key-data [authenticator hex-key-data]
no set session-key outbound esp spi cipher hex-key-data [authenticator hex-key-data]
no crypto isakmp key key-string address peer-address
no crypto isakmp key key-string hostname peer-hostname
Description
This is the seed for X9.31 PRNG. This CSP is
stored in DRAM and updated periodically after
the generation of 400 bytes – after this it is
reseeded with router-derived entropy; hence, it is
zeroized periodically. Also, the operator can turn
off the router to zeroize this CSP.
The private exponent used in Diffie-Hellman
(DH) exchange. Zeroized after DH shared secret
has been generated.
The public key used in Diffie-Hellman (DH)
exchange as part of IKE. Zeroized after the DH
shared secret has been generated.
Value derived from the shared secret within IKE
exchange. Zeroized when IKE session is
terminated.
The IKE key derivation key for non ISAKMP
security associations.
The ISAKMP security association authentication
key.
The ISAKMP security association encryption key. DRAM
The IKE session encrypt key.
The IKE session authentication key.
Zeroization
Storage
Method
DRAM
Automatically every
(plaintext)
400 bytes, or turn off
the router.
DRAM
Automatically after
(plaintext)
shared secret generated.
DRAM
Automatically after
(plaintext)
shared secret generated.
DRAM
Automatically after IKE
(plaintext)
session terminated.
DRAM
Automatically after IKE
(plaintext)
session terminated.
DRAM
Automatically after IKE
(plaintext)
session terminated.
Automatically after IKE
(plaintext)
session terminated.
DRAM
Automatically after IKE
(plaintext)
session terminated.
DRAM
Automatically after IKE
(plaintext)
session terminated.
OL-8663-01