470
Configuring keychains
Overview
A keychain, a sequence of keys, provides dynamic authentication to ensure secure communication
by periodically changing the key and authentication algorithm without service interruption.
Each key in a keychain has a key string, authentication algorithm, sending lifetime, and receiving
lifetime. When the system time is within the lifetime of a key in a keychain, an application uses the
key to authenticate incoming and outgoing packets. The keys in the keychain take effect one by one
according to the sequence of the configured lifetimes. In this way, the authentication algorithms and
keys are dynamically changed to implement dynamic authentication.
A keychain operates in absolute time mode. In this mode, each time point during a key's lifetime is
the UTC time and is not affected by the system's time zone and daylight saving time.
Configuration procedure
Follow these guidelines when you configure a keychain:
•
To make sure only one key in a keychain is used at a time to authenticate packets to a peer, set
non-overlapping sending lifetimes for the keys in the keychain.
•
The keys used by the local device and the peer device must have the same authentication
algorithm and key string.
To configure a keychain:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a keychain and
enter keychain view.
keychain keychain-name
[
mode
absolute
]
By default, no keychains exist.
3.
(Optional.) Set a
tolerance time for accept
keys in the keychain.
accept-tolerance
{
value
|
infinite
}
By default, no tolerance time is
configured for accept keys in a
keychain.
4.
Create a key and enter
key view.
key
key-id
By default, no keys exist.
5.
Specify an authentication
algorithm for the key.
authentication-algorithm
hmac-sha-256
By default, no authentication
algorithm is specified for a key.
6.
Configure a key string for
the key.
key-string
{
cipher
|
plain
}
string
By default, no key string is
configured.
7.
Set the sending lifetime in
UTC mode for the key.
send-lifetime
utc
start-time start-date
{
duration
{
duration-value
|
infinite
} |
to
end-time end-date
}
By default, the sending lifetime is
not configured for a key.
8.
Set the receiving lifetime
in UTC mode for the key.
accept-lifetime
utc
start-time
start-date
{
duration
{
duration-value
|
infinite
} |
to
end-time end-date
}
By default, the receiving lifetime
is not configured for a key.
9.
(Optional.) Specify the
key as the default send
key.
default-send-key
By default, no key in a keychain
is specified as the default send
key.
