21
Catalyst 6509 Switch, Cisco 7606 Router, and Cisco 7609 Router with VPN Services Module Certification Note
OL-6334-01
Cryptographic Key Management
The tamper evidence seals are made from a special thin-gauge vinyl with self-adhesive backing. Any
attempt to open the chassis, remove the modules or power supplies, or remove the opacity shield will
damage the tamper evidence seals or the painted surface and metal of the chassis. Because the tamper
evidence seals have nonrepeated serial numbers, they may be inspected for damage and compared
against the applied serial numbers to verify that the module has not been tampered with. Tamper
evidence seals can also be inspected for signs of tampering, which include the following: curled corners,
bubbling, crinkling, rips, tears, and slices. The word “OPEN” may appear if the label was peeled back.
Cryptographic Key Management
The switch or the router securely administers both cryptographic keys and other critical security
parameters such as passwords. The tamper evidence seals provide physical protection for all keys. Keys
are also password protected and can be zeroized by the crypto officer. Keys are exchanged manually and
entered electronically using manual key exchange or Internet Key Exchange (IKE).
Chassis containing the VPN Services Module and a cryptographic accelerator card support DES (56-bit)
(only for legacy systems) and 3DES (168-bit) IPsec encryption, MD5 and SHA-1 hashing, and hardware
support for RSA signature generation.
The module supports the critical security parameters (CSPs) as described in
Table 3
.
Table 3
Critical Security Parameters
CSP
Number
Key or CSP Name
Description
Storage
1
.key
This is the seed key for X9.31 PRNG. This key is stored
in DRAM and updated periodically after 400 bytes are
generated; hence, it is zeroized periodically. The operator
also can turn off the router to zeroize this key.
DRAM
(plaintext)
2
secret_number
The private exponent used in Diffie-Hellman (DH)
exchange. It is zeroized after a DH shared secret has been
generated.
DRAM
(plaintext)
3
skeyid
The shared secret within IKE exchange. It is zeroized
when an IKE session is terminated.
DRAM
(plaintext)
4
skeyid_d
The shared secret within IKE exchange. It is zeroized
when an IKE session is terminated.
DRAM
(plaintext)
5
skeyid_a
The shared secret within IKE exchange. It is zeroized
when an IKE session is terminated.
DRAM
(plaintext)
6
skeyid_e
The shared secret within IKE exchange. It is zeroized
when an IKE session is terminated.
DRAM
(plaintext)
7
transform_key1
The IKE session encrypt key. It is zeroized when an IKE
session is terminated.
DRAM
(plaintext)
8
transform_key2
The IKE session authentication key. It is zeroized when
an IKE session is terminated.
DRAM
(plaintext)
9
crypto_private_key
The RSA private key. The
crypto key zeroize
command
zeroizes this key.
NVRAM
(plaintext)
