R3303-HP HSR6800 Routers Security Configuration Guide

206
Creating a local asymmetric key pair
When you create an asymmetric key pair on the local device, follow these guidelines:
• Create an asymmetric key pair of the proper type to work with a target application.
• After you enter the command, specify a proper modulus length for the key pair. The following table
compares these types of key pairs.
Table 11 A comparison between different types of asymmetric key pairs
T
yp
e Number of ke
y
p
airs Modulus len
g
th Remarks
RSA
Two key pairs, one server key pair and one
host key pair. Each key pair comprises a
public key and a private key.
512 to 2048 bits.
1024 by default.
To achieve high
security, specify at least
768 bits.
DSA One key pair, the host key pair.
512 to 2048 bits.
1024 by default.
IMPORTANT:
Only SSH1.5 uses the RSA server key pair.
To create a local asymmetric key pair:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Create a local asymmetric
key pair.
public-key local create { dsa
| rsa } [ name key-name ]
By default, no asymmetric key pair is
created.
Key pairs created with this command are
saved automatically and can survive system
reboots.
In FIPS mode, the DSA key modulus length is
at least 1024 bits, and the RSA key modulus
length must be 2048 bits.
Displaying or exporting the local host public key
In some applications, such as SSH, to allow your local device to be authenticated by a peer device
through digital signature, you must display or export the local host public key, which will then be
specified on the peer device.
To display or export the local host public key, choose one of the following methods:
• Displaying and recording the host public key information
• Displaying the host public key in a specif
ic format and saving it to a file
• Exporting the host public key in a specific format to a file
If y
our local device functions to authenticate the peer device, you must specify the peer public key on the
local device. For more information, see "Specifying the peer public key on the local device."