HP 5500 Ei 5500 Si Switch Series Configuration Guide

 246 
 
Task  Remarks 
Configuring a local 
asymmetric key pair on the 
local device   Creating a local asymmetric key pair  
Required 
Displaying or exporting the local host public key Optional 
Destroying a local asymmetric key pair Optional 
Specifying the peer public key on the local device  Optional 
 
Creating a local asymmetric key pair 
When you create an asymmetric key pair on the local device, follow these guidelines: 
•  Create an asymmetric key pair of the proper type to work with a target...

 247 
If your local device functions to authenticate the peer device, you must specify the peer public key on the 
local device. For more information, see Specifying the peer public key on the local device .
  
Displaying and recording the host public key information 
To display the local public key:  
Task Command Remarks 
Display the local RSA public keys. display public-key local
 rsa  public  
[ |  { begin |  exclude | include } 
regular-expression  ] 
Available in any view. 
Use at least one...

 248 
Destroying a local asymmetric key pair 
You may need to destroy a local asymmetric key pair and generate a new pair when an intrusion event 
has occurred, the storage media of the device is repl aced, the asymmetric key has been used for a long 
time, or the local certificate expires. For more information about the local certificate, see 
1Configuring 
PKI . 
To destroy a local asymmetric key pair: 
 
Step Command 
1.   Enter system view. 
system-view 
2.  Destroy a local asymmetric key pair....

 249 
Step Command Remarks 
1.  Enter system view. 
system-view  N/A 
2.  Specify a name for the public 
key and enter public key view.  public-key peer 
keyname N/A 
3.  Enter public key code view. 
public-key-code begin  N/A 
4.  Configure the peer public key. 
Type or copy the key  Spaces and carriage returns are 
allowed between characters. 
5.
  Return to public key view. 
public-key-code end  When you exit public key code 
view, the system automatically 
saves the public key. 
6.
  Return to system...

 250 
[DeviceA] public-key local create rsa 
The range of public key size is (512 ~ 2048). 
NOTES: If the key modulus is greater than 512, 
It will take a few minutes. 
Press CTRL+C to abort. 
Input the bits of the modulus[default = 1024]: 
Generating Keys... 
++++++ 
++++++ 
++++++++ 
++++++++ 
# Display the public keys of the local RSA key pairs. 
[DeviceA] display public-key local rsa public 
 
===================================================== 
Time of Key pair created: 09:50:06  2012/03/07 
Key...

 251 
[DeviceB-pkey-key-code] public-key-code end 
[DeviceB-pkey-public-key] peer-public-key end 
# Display the host public key of Device A saved on Device B. 
[DeviceB] display public-key peer name devicea 
 
===================================== 
  Key Name  : devicea 
  Key Type  : RSA 
  Key Module: 1024 
===================================== 
Key Code: 
30819F300D06092A864886F70D010101050003818D0030818902818100D90003FA95F5A4\
4A2A2CD3F...

 252 
# Display the public keys of the local RSA key pairs. 
[DeviceA] display public-key local rsa public 
 
===================================================== 
Time of Key pair created: 09:50:06  2012/03/07 
Key name: HOST_KEY 
Key type: RSA Encryption Key 
===================================================== 
Key code: 
30819F300D06092A864886F70D010101050003818D0030818902818100D90003FA95F5A4\
4A2A2CD3F
814F9854C4421B57CAC64CFFE4782A87B0360B600497D87162D1F398E6E5E51E5E353B3A\
9AB16C9E7...

 253 
200 Type set to I. 
[ftp] get devicea.pub 
227 Entering Passive Mode (10,1,1,1,5,148). 
125 BINARY mode data connection already open, transfer starting for /dev\
icea.pub. 
226 Transfer complete. 
FTP: 299 byte(s) received in 0.189 second(s), 1.00Kbyte(s)/sec. 
[ftp] quit 
221 Server closing. 
4. Import the host public key  of Device A to Device B: 
# Import the host public key of  Device A from the key file devicea.pub to Device B. 
 system-view 
[DeviceB] public-key peer devicea import sshkey...

 254 
Configuring PKI 
Overview 
The Public Key Infrastructure (PKI) is a general security infrastructure used to provide information security 
through public key technologies.  
PKI, also called asymmetric key infrastructure, uses a key pair to encrypt and decrypt the data. The key 
pair consists of a private key and a public key. The private key must be kept secret but the public key 
needs to be distributed. Data encrypted by one of  the two keys can only be decrypted by the other. 
A key problem with...

 255 
such as phone, disk, and email. As different CAs might use different methods to examine the 
binding of a public key with an entity, make su re that you understand the CA policy before 
selecting a trusted CA fo r certificate request. 
PKI architecture 
A PKI system consists of entities, a CA, a regi stration authority (RA) and a PKI repository. 
Figure 94  PKI architecture 
 
 
•  Entity 
An entity is an end user of PKI products or serv ices, such as a person, an organization, a device, 
or a...