112
•
The length of a DSA key modulus is in the range 512 to 2048 bits. After entering the
public-key local
create dsa
command, you will be required to specify the modulus length. For security, a modulus of at
least 768 bits is recommended.
Displaying or exporting the local RSA or DSA host public
key
Display the local RSA or DSA host public key on the screen or export it to a specified file. Then,
you can configure the local RSA or DSA host public key on the remote end so that the remote end
can use the host public key to authenticate the local end through digital signature.
Follow these steps to display or export the local RSA or DSA host public key:
To do…
Use the command…
Remarks
1.
Enter system view
system-view
—
2.
Display the local RSA host public key
on the screen in a specified format, or
export it to a specified file
public-key local export rsa
{
openssh
|
ssh1
|
ssh2
} [
filename
]
Select a command
according to the type of
the key to be exported.
3.
Display the local DSA host public key
on the screen in a specified format, or
export it to a specified file
public-key local export dsa
{
openssh
|
ssh2
} [
filename
]
Support for the
public-key local export dsa
command depends on the device model.
Destroying an asymmetric key pair
An asymmetric key pair may expire or leak. In this case, you need to destroy it and generate a
new pair.
Follow these steps to destroy an asymmetric key pair:
To do…
Use the command…
Remarks
1.
Enter system view
system-view
—
2.
Destroy an asymmetric key pair
public-key local destroy
{
dsa
|
rsa
}
Required
Configuring the public key of a peer
To authenticate the remote host, you need to configure the RSA or DSA public key of that peer on
the local host.
To configure the public key of the peer, you can:
•
Configure it manually: You can input or copy the public key of the peer to the local host. The
copied public key must have not been converted and be formatted in the distinguished
encoding rules (DER) encoding format.
