Usage Guidelines
Note |
Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more
information about the latest Cisco cryptographic recommendations, see the
Next Generation Encryption (NGE) white paper.
|
Use this command to generate RSA key pairs for your Cisco device (such as a router).
RSA keys are generated in pairs--one public RSA key and one private RSA key.
If your router already has RSA keys when you issue this command, you will be warned and prompted to replace the existing
keys with new keys.
Note |
Before issuing this command, ensure that your router has a hostname and IP domain name configured (with the
hostname and
ip
domain-name commands). You will be unable to complete the
crypto
key
generate
rsa
command without a hostname and IP domain name. (This situation is not true when you generate only a named key pair.)
|
Note |
Secure Shell (SSH) may generate an additional RSA key pair if you generate a key pair on a router having no RSA keys. The
additional key pair is used only by SSH and will have a name such as {router_FQDN }.server. For example, if a router name is “router1.cisco.com,” the key name is “router1.cisco.com.server.”
|
This command is not saved in the router configuration; however, the RSA keys generated by this command are saved in the private
configuration in NVRAM (which is never displayed to the user or backed up to another device) the next time the configuration
is written to NVRAM.
Note |
If the configuration is not saved to NVRAM, the generated keys are lost on the next reload of the router.
|
There are two mutually exclusive types of RSA key pairs: special-usage keys and general-purpose keys. When you generate RSA
key pairs, you will be prompted to select either special-usage keys or general-purpose keys.
Special-Usage Keys
If you generate special-usage keys, two pairs of RSA keys will be generated. One pair will be used with any Internet Key
Exchange (IKE) policy that specifies RSA signatures as the authentication method, and the other pair will be used with any
IKE policy that specifies RSA encrypted keys as the authentication method.
A CA is used only with IKE policies specifying RSA signatures, not with IKE policies specifying RSA-encrypted nonces. (However,
you could specify more than one IKE policy and have RSA signatures specified in one policy and RSA-encrypted nonces in another
policy.)
If you plan to have both types of RSA authentication methods in your IKE policies, you may prefer to generate special-usage
keys. With special-usage keys, each key is not unnecessarily exposed. (Without special-usage keys, one key is used for both
authentication methods, increasing the exposure of that key.)
General-Purpose Keys
If you generate general-purpose keys, only one pair of RSA keys will be generated. This pair will be used with IKE policies
specifying either RSA signatures or RSA encrypted keys. Therefore, a general-purpose key pair might get used more frequently
than a special-usage key pair.
Named Key Pairs
If you generate a named key pair using the
key-label argument, you must also specify the
usage-keys keyword or the
general-keys keyword. Named key pairs allow you to have multiple RSA key pairs, enabling the Cisco IOS software to maintain a different
key pair for each identity certificate.
Modulus Length
When you generate RSA keys, you will be prompted to enter a modulus length. The longer the modulus, the stronger the security.
However a longer modules takes longer to generate (see the table below for sample times) and takes longer to use.
Table 5. Sample Times by Modulus Length to Generate RSA Keys
|
Router
|
360 bits
|
512 bits
|
1024 bits
|
2048 bits (maximum)
|
|
Cisco 2500
|
11 seconds
|
20 seconds
|
4 minutes, 38 seconds
|
More than 1 hour
|
|
Cisco 4700
|
Less than 1 second
|
1 second
|
4 seconds
|
50 seconds
|
Cisco IOS software does not support a modulus greater than 4096 bits. A length of less than 512 bits is normally not recommended.
In certain situations, the shorter modulus may not function properly with IKE, so we recommend using a minimum modulus of
2048 bits.
Note |
As of Cisco IOS Release 12.4(11)T, peer
public RSA key modulus values up to 4096 bits are automatically supported. The largest private RSA key modulus is 4096 bits. Therefore,
the largest RSA private key a router may generate or import is 4096 bits. However, RFC 2409 restricts the private key size
to 2048 bits or less for RSA encryption. The recommended modulus for a CA is 2048 bits; the recommended modulus for a client
is 2048 bits.
|
Additional limitations may apply when RSA keys are generated by cryptographic hardware. For example, when RSA keys are generated
by the Cisco VPN Services Port Adapter (VSPA), the RSA key modulus must be a minimum of 384 bits and must be a multiple of
64.
Specifying a Storage Location for RSA Keys
When you issue the
crypto
key
generate
rsa command with the
storage
devicename
: keyword and argument, the RSA keys will be stored on the specified device. This location will supersede any
crypto
key
storage command settings.
Specifying a Device for RSA Key Generation
As of Cisco IOS Release 12.4(11)T and later releases, you may specify the device where RSA keys are generated. Devices supported
include NVRAM, local disks, and USB tokens. If your router has a USB token configured and available, the USB token can be
used as cryptographic device in addition to a storage device. Using a USB token as a cryptographic device allows RSA operations
such as key generation, signing, and authentication of credentials to be performed on the token. The private key never leaves
the USB token and is not exportable. The public key is exportable.
RSA keys may be generated on a configured and available USB token, by the use of the
on
devicename
: keyword and argument. Keys that reside on a USB token are saved to persistent token storage when they are generated. The
number of keys that can be generated on a USB token is limited by the space available. If you attempt to generate keys on
a USB token and it is full you will receive the following message:
% Error in generating keys:no available resources
Key deletion will remove the keys stored on the token from persistent storage immediately. (Keys that do not reside on a
token are saved to or deleted from nontoken storage locations when the
copy or similar command is issued.)
For information on configuring a USB token, see “ Storing PKI Credentials ” chapter in the Cisco IOS Security Configuration
Guide, Release 12.4T. For information on using on-token RSA credentials, see the “ Configuring and Managing a Cisco IOS Certificate
Server for PKI Deployment ” chapter in the Cisco IOS Security Configuration Guide , Release 12.4T.
Specifying RSA Key Redundancy Generation on a Device
You can specify redundancy for existing keys only if they are exportable.
Examples
The following example generates a general-usage 1024-bit RSA key pair on a USB token with the label “ms2” with crypto engine
debugging messages shown:
Router(config)# crypto key generate rsa label ms2 modulus 2048 on usbtoken0:
The name for the keys will be: ms2
% The key modulus size is 2048 bits
% Generating 1024 bit RSA keys, keys will be on-token, non-exportable...
Jan 7 02:41:40.895: crypto_engine: Generate public/private keypair [OK]
Jan 7 02:44:09.623: crypto_engine: Create signature
Jan 7 02:44:10.467: crypto_engine: Verify signature
Jan 7 02:44:10.467: CryptoEngine0: CRYPTO_ISA_RSA_CREATE_PUBKEY(hw)(ipsec)
Jan 7 02:44:10.467: CryptoEngine0: CRYPTO_ISA_RSA_PUB_DECRYPT(hw)(ipsec)
Now, the on-token keys labeled “ms2” may be used for enrollment.
The following example generates special-usage RSA keys:
Router(config)# crypto key generate rsa usage-keys
The name for the keys will be: myrouter.example.com
Choose the size of the key modulus in the range of 360 to 2048 for your Signature Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus[512]? <return>
Generating RSA keys.... [OK].
Choose the size of the key modulus in the range of 360 to 2048 for your Encryption Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus[512]? <return>
Generating RSA keys.... [OK].
The following example generates general-purpose RSA keys:
Note |
You cannot generate both special-usage and general-purpose keys; you can generate only one or the other.
|
Router(config)# crypto key generate rsa general-keys
The name for the keys will be: myrouter.example.com
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus[512]? <return>
Generating RSA keys.... [OK].
The following example generates the general-purpose RSA key pair “exampleCAkeys”:
crypto key generate rsa general-keys label exampleCAkeys
crypto ca trustpoint exampleCAkeys
enroll url
http://exampleCAkeys/certsrv/mscep/mscep.dll
rsakeypair exampleCAkeys 1024 1024
The following example specifies the RSA key storage location of “usbtoken0:” for “tokenkey1”:
crypto key generate rsa general-keys label tokenkey1 storage usbtoken0:
The following example specifies the
redundancy keyword:
Router(config)# crypto key generate rsa label MYKEYS redundancy
The name for the keys will be: MYKEYS
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]:
% Generating 512 bit RSA keys, keys will be non-exportable with redundancy...[OK]
Feedback