Chapter 3: System planning
Security planning
Page 3-58
TLS-RSA
Determine TLS Minimum Security Level. This is the smallest key size that will be allowed in a
link between Master and Slave. For example, if the Master has TLS Minimum Security Level of
128-bit AES and the Slave has no AES license then the link cannot be established.
In a network where all links must be encrypted, set TLS Minimum Security Level to TLS RSA
128-bit or TLS RSA 256-bit to prevent inadvertent connection of unencrypted links.
Select Factory-installed or User-supplied device certificates. Factory-installed certificates are
convenient because they can be used without needing to generate any additional
cryptographic material. Generate and install User-supplied certificates where the additional
security of 2048-bit key size is required, or where there is an operational requirement to be able
to zeroize the certificates in the event that the ODU may be compromised.
For Group Access, select Whitelist or Blacklist operation. The selection of Whitelist and Blacklist
is independent of the selection of Factory or User-provided certificates.
Note
The default combination of Blacklist and Factory certificates offers limited benefits in
a deployed network, because the system will authorize any genuine PTP 670 ODU.
Use the Whitelist and/or User-supplied certificates to ensure that access is allowed
only for trusted ODUs.
A disadvantage of TLS-RSA is that the Whitelist must be updated if new hardware is introduced
to the network. This may require access to both ends of the link. Consider using TLS-PSK if it is
important to replace hardware without needing access to both ends of the link.
TLS-RSA is not available if Access Method is configured for Link Name Access.
Install User-supplied device certificates using the Security Wizard.
Table 73 User-supplied device certificates for wireless encryption
Item
Description
Quntity required
Device Private
Key and Public
Certificates
An RSA private key of size 2048 bits, generated
in either PKCS#1 or PKCS#5 format,
unencrypted, and encoded in the ASN.1 DER
format.
An X.509 certificate containing a 2048-bit RSA
public key, signed using SHA-256, generated in
either PKCS#1 or PKCS#5 format, unencrypted,
and encoded in the ASN.1 DER format.
The public key certificate must have Common
Name equal to the MAC address of the ODU as a
string of 12 hexadecimal characters without
punctuation.
The public key certificate must form a valid pair
with the private key.
Two pairs per link. These
items are unique to the
MAC address.
