Certification Authorities - Cisco CRS-1 - Carrier Routing System Router Configuration Manual

Implementing Certification Authority Interoperability on Cisco IOS XR Software
•
•
•
•
•
•

Certification Authorities

The following sections provide background information about CAs:
•
•
•
•
•
•
Purpose of CAs
CAs are responsible for managing certificate requests and issuing certificates to participating IPSec
network devices. These services provide centralized key management for the participating devices.
CAs simplify the administration of IPSec network devices. You can use a CA with a network containing
multiple IPSec-compliant devices, such as routers.
Digital signatures, enabled by public key cryptography, provide a means of digitally authenticating
devices and individual users. In public key cryptography, such as the RSA encryption system, each user
has a key pair containing both a public and a private key. The keys act as complements, and anything
encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed
when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the
message with the sender's public key. The fact that the message could be decrypted using the sender's
OL-20382-01
protocols and algorithms based on local policy, and to generate the encryption and authentication
keys to be used by IPSec. IPSec can be used to protect one or more data flows between a pair of
hosts, a pair of security gateways, or a security gateway and a host.
IKE—A hybrid protocol that implements Oakley and Skeme key exchanges inside the Internet
Security Association Key Management Protocol (ISAKMP) framework. Although IKE can be used
with other protocols, its initial implementation is with the IPSec protocol. IKE provides
authentication of the IPSec peers, negotiates IPSec keys, and negotiates IPSec security associations
(SAs).
Public-Key Cryptography Standard #7 (PKCS #7)—A standard from RSA Data Security Inc. used
to encrypt and sign certificate enrollment messages.
Public-Key Cryptography Standard #10 (PKCS #10)—A standard syntax from RSA Data Security
Inc. for certificate requests.
RSA keys—RSA is the public key cryptographic system developed by Ron Rivest, Adi Shamir, and
Leonard Adelman. RSA keys come in pairs: one public key and one private key.
SSL—Secure Socket Layer protocol.
X.509v3 certificates—Certificate support that allows the IPSec-protected network to scale by
providing the equivalent of a digital ID card to each device. When two devices want to communicate,
they exchange digital certificates to prove their identity (thus removing the need to manually
exchange public keys with each peer or specify a shared key at each peer). These certificates are
obtained from a CA. X.509 as part of the X.500 standard of the ITU.
Purpose of CAs, page SC-63
IPSec Without CAs, page SC-64
IPSec with CAs, page SC-64
IPSec with Multiple Trustpoint CAs, page SC-65
How IPSec Devices Use CA Certificates, page SC-65
CA Registration Authorities, page SC-65
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
Information About Implementing Certification Authority
SC-63