Asymmetric Key Algorithm Applications; Configuring The Local Asymmetric Key Pair; Creating An Asymmetric Key Pair - H3C S9500E Series Security Configuration Manual

Asymmetric key algorithm applications

Asymmetric key algorithms can be used for encryption and digital signature:
•
Encryption: The sender uses the public key of the intended receiver to encrypt the information
to be sent. Only the intended receiver, the holder of the paired private key, can decrypt the
information. This mechanism ensures confidentiality.
•
Digital signature: The sender "signs" the information to be sent by encrypting the information
with its own private key. A receiver decrypts the information with the sender's public key and,
based on whether the information can be decrypted, determines the authenticity of the
information.
The Revest-Shamir-Adleman Algorithm (RSA), Digital Signature Algorithm (DSA), and Elliptic Curve
Digital Signature Algorithm (ECDSA) are all asymmetric key algorithms. RSA can be used for data
encryption and signature, whereas DSA and ECDSA are used for signature only.
Symmetric key algorithms are often used to encrypt/decrypt data for security. Asymmetric key algorithms
are usually used in digital signature applications for peer identity authentication because they involve
complex calculations and are time-consuming. In digital signature applications, only the digests, which are
relatively short, are encrypted.

Configuring the local asymmetric key pair

You can create and destroy a local asymmetric key pair, and export the host public key of a local
asymmetric key pair.

Creating an asymmetric key pair

Follow these steps to create an asymmetric key pair:
To do...
1. Enter system view
2. Create a local DSA key pair, or
RSA key pairs
The configuration of the public-key local create command can survive a reboot.
•
The public-key local create rsa command generates two key pairs: one server key pair and one
•
host key pair. Each key pair consists of a public key and a private key.
The length of an RSA key modulus is in the range 512 to 2048 bits. After entering the public-key local
•
create rsa command, you will be required to specify the modulus length. For security, a modulus of at
least 768 bits is recommended.
The public-key local create dsa command generates only one key pair, that is, the host key pair.
•
Use the command...
system-view
public-key local create {
dsa | rsa }
111
Remarks
—
Required
By default, there is no such key pair.