Cisco 3825 Series Непропрієтарна політика безпеки - Сторінка 16
Переглянути онлайн або завантажити pdf Непропрієтарна політика безпеки для Мережевий маршрутизатор Cisco 3825 Series. Cisco 3825 Series 30 сторінок. Integrated services routers
Також для Cisco 3825 Series: Встановлення та модернізація (20 сторінок), Посібник із швидкого старту (38 сторінок), Посібник із швидкого старту (40 сторінок)
Друкувати сторінку
Cisco 3825 and Cisco 3845 Routers
The routers support the following FIPS 140-2 approved algorithm implementations:
•
•
The router is in the approved mode of operation only when FIPS 140-2 approved algorithms are used
(except DH which is allowed for use in FIPS approved mode for key establishment). The following are
not FIPS 140-2 approved algorithms: RC4, MD5, HMAC-MD5, RSA and DH. DH is allowed for use in
key establishment. The key establishment methodology provides between 80-bits and 96-bits of
encryption strength.
The module supports two types of key management schemes:
•
•
The module supports commercially available methods of key establishment, including Diffie-Hellman
and IKE. See Document 7A, Cisco IOS Reference Guide.
All pre-shared keys are associated with the CO role that created the keys, and the CO role is protected
by a password. Therefore, the CO password is associated with all the pre-shared keys. The Crypto
Officer needs to be authenticated to store keys. All Diffie-Hellman (DH) keys agreed upon for individual
tunnels are directly associated with that specific tunnel only via the IKE protocol.
Key Zeroization:
Each key can be zeroized by sending the "no" command prior to the key function commands. This will
zeroize each key from the DRAM, the running configuration.
"Clear Crypto IPSec SA" will zeroize the IPSec DES/3DES/AES session key (which is derived using
the Diffie-Hellman key agreement technique) from the DRAM. This session key is only available in the
DRAM; therefore this command will completely zeroize this key. The following command will zeroize
the pre-shared keys from the DRAM:
•
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
16
Software (IOS) implementations
AES
–
DES (for legacy use only)
–
3DES
–
SHA-1
–
HMAC-SHA-1
–
X9.31 PRNG
–
Onboard hardware implementations (Safenet chip)
AES
–
DES (for legacy use only)
–
3DES
–
SHA-1
–
HMAC-SHA-1
–
Pre-shared key exchange via electronic key entry. DES/3DES/AES key and HMAC-SHA-1 key are
exchanged and entered electronically.
Internet Key Exchange method with support for pre-shared keys exchanged and entered
electronically.
The pre-shared keys are used with Diffie-Hellman key agreement technique to derive DES,
–
3DES or AES keys.
The pre-shared key is also used to derive HMAC-SHA-1 key.
–
no set session-key inbound ah spi hex-key-data
OL-8662-01