Certification Authorities - Cisco IOS XR Configuration Manual

Implementing Certification Authority Interoperability on Cisco IOS XR Software
•
•
•
•

Certification Authorities

The following sections provide background information about CAs:
•
•
•
•
•
•
Purpose of CAs
CAs are responsible for managing certificate requests and issuing certificates to participating IPSec
network devices. These services provide centralized key management for the participating devices.
CAs simplify the administration of IPSec network devices. You can use a CA with a network containing
multiple IPSec-compliant devices, such as routers.
Digital signatures, enabled by public key cryptography, provide a means of digitally authenticating
devices and individual users. In public key cryptography, such as the RSA encryption system, each user
has a key pair containing both a public and a private key. The keys act as complements, and anything
encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed
when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the
message with the sender's public key. The fact that the message could be decrypted using the sender's
public key indicates that the holder of the private key, the sender, must have created the message. This
process relies on the receiver's having a copy of the sender's public key and knowing with a high degree
of certainty that it does belong to the sender and not to someone pretending to be the sender.
Digital certificates provide the link. A digital certificate contains information to identify a user or device,
such as the name, serial number, company, department, or IP address. It also contains a copy of the
entity's public key. The certificate is itself signed by a CA, a third party that is explicitly trusted by the
receiver to validate identities and to create digital certificates.
To validate the signature of the CA, the receiver must first know the CA's public key. Normally, this
process is handled out-of-band or through an operation done at installation. For instance, most web
browsers are configured with the public keys of several CAs by default. IKE, an essential component of
IPSec, can use digital signatures to authenticate peer devices for scalability before setting up SAs.
Public-Key Cryptography Standard #10 (PKCS #10)—A standard syntax from RSA Data Security
Inc. for certificate requests.
RSA keys—RSA is the public key cryptographic system developed by Ron Rivest, Adi Shamir, and
Leonard Adelman. RSA keys come in pairs: one public key and one private key.
SSL—Secure Socket Layer protocol.
X.509v3 certificates—Certificate support that allows the IPSec-protected network to scale by
providing the equivalent of a digital ID card to each device. When two devices want to communicate,
they exchange digital certificates to prove their identity (thus removing the need to manually
exchange public keys with each peer or specify a shared key at each peer). These certificates are
obtained from a CA. X.509 is part of the X.500 standard of the ITU.
Purpose of CAs, page SC-3
IPSec Without CAs, page SC-4
IPSec with CAs, page SC-4
IPSec with Multiple Trustpoint CAs, page SC-4
How CA Certificates Are Used by IPSec Devices, page SC-5
CA Registration Authorities, page SC-5
Information About Implementing Certification Authority
Cisco IOS XR System Security Configuration Guide
SC-3