Users Guide

Security Commands 1216
the private key is never displayed to the user. DSA keys, along with other
switch credentials, are distributed to all units in a stack on a configuration
save.
Use the crypto key zeroize dsa command to remove the DSA key pair from
the system.
Private keys should never be shared with unauthorized users. This command
generates the following private/public key pair in the ssh_host_dsa_key and
ssh_host_dsa_key.pub files. Both the RSA and DSA keys must be generated to
enable the SSH server.
Example
The following example generates DSA key pairs.
console(config)#crypto key generate dsa
crypto key generate ecdsa
Use this command to generate an ECDSA key pair for SSH.
Syntax
crypto key generate ecdsa key-len
• ken-len — Key length for ECDSA key in bits. Valid lengths are 256, 384,
and 521.
Default Configuration
By default, no ECDSA key are present on the switch. Use the crypto key
zeroize command to remove the generated private key from the local file
system. See the crypto key zeroize {rsa|dsa|ecdsa} command.
Command Mode
Global Configuration mode
User Guidelines
This command overwrites any existing ECDSA keys.
Example
console(config)#crypto key generate ecdsa