Profile Encryption; Profile Formats - Linksys SPA2102-AU Provisioning Manual

Chapter 3 Provisioning Tutorial
Step 2
Compress the basic.txt profile from earlier exercises, by invoking gzip from the command line:
gzip basic.txt
This generates the deflated file basic.txt.gz.
Step 3
Save the deflated file in the TFTP server virtual root directory.
Step 4
Modify the Profile_Rule on the test SPA to resync to the deflated file in place of the original XML file,
as in the following example:
tftp://192.168.1.200/basic.txt.gz
Step 5
Click Submit All Changes.
Step 6
Observe the syslog trace from the SPA.
Upon resync, the new file is downloaded by the SPA and used to update its parameters.
The file size of such a small profile is not reduced by gzip. Compression is only useful with larger
profiles.
For integration into customized back-end provisioning server solutions, the open source zlib
compression library can be used in place of the standalone gzip utility to perform the profile
compression. However, the SPA expects the file to contain a valid gzip header.

Profile Encryption

A compressed or uncompressed profile can be encrypted. This is useful when the confidentiality of the
profile information is of particular concern, such as when using TFTP or HTTP for communication
between SPA clients and the provisioning server.
The SPA supports symmetric key encryption using the 256-bit AES algorithm. This encryption can be
performed using the open source OpenSSL package.
Exercise
Step 1
Install OpenSSL on a local PC.
This may require recompilation to enable the AES code.
Step 2
Starting from the XML profile in basic.txt, generate an encrypted file with the following command:
openssl enc –aes-256-cbc –k MyOwnSecret –in basic.txt –out basic.cfg
The compressed basic.txt.gz file could be used instead because the XML profile can be both compressed
and encrypted.
Step 3
Store the encrypted file basic.cfg in the TFTP server virtual root directory.
Step 4
Modify the Profile_Rule on the test SPA to resync to the encrypted file in place of the original XML file.
The encryption key is made known to the SPA with the following URL option:
[--key MyOwnSecret ] tftp://192.168.1.200/basic.cfg
Step 5
Click Submit All Changes.
Step 6
Observe the syslog trace from the SPA.
Version 3.0

Profile Formats

Linksys SPA Provisioning Guide
3-11