Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X, Configuration Manual

Page: 247 / 366

For instructions on setting up peer public keys without a digital certificate, see
“Configuring Peer Public Keys Without Digital Certificates” on page 232
.
Public Key Format
RSA encryption and authentication require the use of a public key on both the ERX
router and on the remote peer with which the router seeks to establish IKE SAs.
The length of the public key can be 1024 bits or 2048 bits, and the format conforms
to the RSA standard defined in RFC 3447—Public-Key Cryptography Standards (PKCS)
#1: RSA Cryptography Specifications Version 2.1 (February 2003).
The public key consists of three components:
■
Abstract Syntax Notation 1 (ASN.1) header information
■
RSA public key modulus
■
RSA public key exponent
In the following example of a 1024-bit public key, the first portion of the key (shown
in
bold typeface) represents the ASN.1 header information. The second portion of
the key (shown in regular typeface) represents the RSA public key modulus. The third
portion of the key (shown in
bold typeface) represents the RSA public key exponent.
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00 A7E43C
3E2D399F 34EF6E16 F84464A9 8A145997 CC7F34C8 3DFF8216 57780FE9 D5CE2717
86239050 7A331044 EBA90120 EC13A78D C1B24285 333A9193 D94A59C8 492D8CB9
A46403A4 37461E00 768CF45C 580211AC 72793764 51E3AB3C F9A6665E 562E3681
F120405E 30235690 6FC093AA EB0FE956 51C38EE1 54D81E40 7687C387 07
020301
0001
For more information about the format of an RSA public key and about ASN.1 syntax,
see RFC 3447—Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1 (February 2003).
Configuring Digital Certificates Using the Offline Method
To use the offline method to set up digital certificates on the router:
1.
Generate RSA key pairs.
host1(config)# ipsec key generate rsa 2048
Please wait.................................................
..........................
IPsec Generate Keys complete
2.
In your IKE policy, set the authentication method to RSA signatures.
host1(config)# ipsec ike-policy-rule 1
host1(config-ike-policy)# authentication rsa-sig
host1(config-ike-policy)# exit
host1(config)#
Configuring Digital Certificates Using the Offline Method
■ 221
Chapter 8: Configuring Digital Certificates