HP VPN Firewall Appliances VPN Configuration Guide

309
Complete these tasks to configure public keys:
Task Remarks
Configuring a local
asymmetric key pair on the
local device
Creating a local asymmetric key pair
C
hoose one or more
tasks.
Displaying or exporting the local host public key
Destroying a local asymmetric key pair
Specifying the peer public key on the local device
Creating a local asymmetric key pair
When you create an asymmetric key pair on the local device, follow these guidelines:
• Create an asymmetric key pair of the proper type to work with a target application.
• After you enter the command, specify a proper modulus length for the key pair. The following table
compares these types of key pairs.
In FIPS mode, the DSA key modulus length is at least 1024 bits, and the RSA key modulus length must be
2048 bits.
Table 29 A comparison between different types of asymmetric key pairs
T
yp
e Number of ke
y
p
airs Modulus len
g
th Remarks
RSA
Two key pairs, one server key pair and one
host key par. Each key pair comprises a
public key and a private key
512 to 2048 bits.
1024 by default.
To achieve high
security, specify at least
768 bits.
DSA One key pair, the host key pair
512 to 2048 bits.
1024 by default.
IMPORTANT:
Only SSH1.5 uses the RSA server key pair.
To create a local asymmetric key pair:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Create a local
asymmetric key pair.
public-key local create { dsa
| rsa }
By default, no asymmetric key pair is created.
Key pairs created with this command are saved
automatically and can survive system reboots.
Displaying or exporting the local host public key
In some applications, such as SSH, to allow your local device to be authenticated by a peer device
through digital signature, you must display or export the local host public key, which will then be
specified on the peer device.
To display or export the local host public key, choose one of the following methods: