Cisco 1841 - 3G Bundle Router User manual

Corporate Headquarters:
© 2005 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco 1841 Integrated Services Router with
AIM-VPN/BPII-Plus and Cisco 2801
Integrated Services Router with
AIM-VPN/EPII-Plus FIPS 140-2 Non
Proprietary Security Policy
Level 2 Validation
Version 1.3
December 14, 2005
Introduction
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 1841
Integrated Services Routers with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Routers with
AIM-VPN/EPII-Plus. This security policy describes how the Cisco 1841 and Cisco 2801 Integrated
Services Routers (Hardware Version: 1841 or 2801; AIM-VPN/BPII-Plus Version: 1.0, Board Version:
C1; AIM-VPN/EPII-Plus Version: 1.0, Board Version: D0; Firmware Version: 12.3(11)T03) meet the
security requirements of FIPS 140-2, and how to operate the router in a secure FIPS 140-2 mode. This
policy was prepared as part of the Level 2 FIPS 140-2 validation of the Cisco 1841 and Cisco 2801
Integrated Services Routers.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
• Introduction, page 1
• Cisco 1841 and Cisco 2801 Routers, page 3
• Secure Operation of the Cisco 1841 or Cisco 2801 router, page 21
• Related Documentation, page 22

2
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Introduction
• Obtaining Documentation, page 23
• Documentation Feedback, page 24
• Cisco Product Security Overview, page 24
• Obtaining Technical Assistance, page 25
• Obtaining Additional Publications and Information, page 26
References
This document deals only with operations and capabilities of the Cisco 1841 and Cisco 2801 routers in
the technical terms of a FIPS 140-2 cryptographic module security policy. More information is available
on the routers from the following sources:
• The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:
http://www.cisco.com/en/US/products/hw/routers/index.html
• For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
• The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module.
Terminology
In this document, the Cisco 1841 or Cisco 2801 routers are referred to as the router, the module, or the
system.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
• Vendor Evidence document
• Finite State Machine
• Other supporting documentation as additional references
This document provides an overview of the routers and explains their secure configuration and
operation. This introduction section is followed by the “Cisco 1841 and Cisco 2801 Routers” section on
page 3, which details the general features and functionality of the router. The “Secure Operation of the
Cisco 1841 or Cisco 2801 router” section on page 21 specifically addresses the required configuration
for the FIPS-mode of operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Submission
Documentation is Cisco-proprietary and is releasable only under appropriate non-disclosure agreements.
For access to these documents, please contact Cisco Systems.

3
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
Cisco 1841 and Cisco 2801 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivity and merging the voice and data infrastructure to reduce costs. The
Cisco 1841 and Cisco 2801 routers provide a scalable, secure, manageable remote access server that
meets FIPS 140-2 Level 2 requirements. This section describes the general features and functionality
provided by the routers. The following subsections describe the physical characteristics of the routers.
The Cisco 1841 Cryptographic Module Physical Characteristics
Figure 1 The Cisco 1841 router case
The Cisco 1841 Router is a multiple-chip standalone cryptographic module. The router has a processing
speed of 240MHz. Depending on configuration, either the installed AIM-VPN/BPII-Plus module,
onboard FPGA or the IOS software is used for cryptographic operations.
The cryptographic boundary of the module is the device's case, shown in Figure 1. All of the
functionality discussed in this document is provided by components within this cryptographic boundary.
The interface for the router is located on the rear panel as shown in Figure 2.
Figure 2 Cisco 1841 Rear Panel Physical Interfaces
The Cisco 1841 router features a console port, an auxiliary port, Universal Serial Bus (USB) port, two
high-speed WAN interface card/WAN interface card/Voice interface card (HWIC/WIC/VIC) slots, two
10/100 Fast Ethernet RJ45 ports, and a Compact Flash (CF) drive. The Cisco 1841 router supports
AIM-VPN/BPII-Plus card and two fast Ethernet connections. Figure 2 shows the rear panel. The front
panel contains 2 LEDs that output status data about the system status (SYS OK) and system activity
(SYS ACT). The back panel consists of 8 LEDs: two duplex LEDs, two speed LEDs, two link LEDs, CF
LED and AIM LED.
SYS
PWR
122331
SYS
ACT
Cisco 1800
Series
122330
FE 0/0 AUX
FE 0/1 CONSOLE CISCO 1841
DO NOT REMOVE DURING NETWORK OPERATION CF AIM
FDX
100
LINK
FDX
100
LINK
100-240 VAC-
1 A
50/60 Hz
SLOT 0SLOT 1
37 4
651
2
89125 13
11
10

4
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
The rear panel contains the following:
• (1) Power inlet
• (2) Power switch
• (3) HWIC/WIC/VIC slot 0
• (4) Console port
• (5) FE ports
• (6) Lock
• (7) HWIC/WIC/VIC slot 1
• (8) CF drive
• (9) CF LED
• (10) AIM LED
• (11) USB port
• (12) Auxiliary port
• (13) Ground connector
Table 1 and Table 2 provide more detailed information conveyedby the LEDs on the front and rear panel
of the router:
Table 3 describes the meaning of Ethernet LEDs on the rear panel:
Table 1 Cisco 1841 Front Panel Indicators
Name State Description
System OK Solid Green
Blinking Green
Router has successfully booted up and the software is functional.
Booting or in ROM monitor (ROMMON) mode.
System Activity Solid Green
Blinking Green
Off
System is actively transferring packets.
System is servicing interrupts.
No interrupts or packet transfer occurring.
Table 2 Cisco 1841 Rear Panel Indicators
Name State Description
AIM Solid Green
Solid Orange
Off
AIM installed and initialized.
AIM installed and initialized error.
AIM not installed.
Compact Flash Solid Green
Off
Indicates that the flash is busy and should not be removed.
OK to remove flash card.

5
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in the
Table 4:
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
Table 3 Cisco 1841 Ethernet Indicators
Name State Description
Duplex Solid Green
Off
Full-Duplex
Half-Duplex
Speed Solid Green
Off
100 Mbps
10 Mbps
Link Solid Green
Off
Ethernet link is established
No link established
Table 4 Cisco 1841 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC/WIC/VIC Ports
Console Port
Auxiliary Port
Data Input Interface
10/100 Ethernet LAN Ports
HWIC/WIC/VIC Ports
Console Port
Auxiliary Port
Data Output Interface
10/100 Ethernet LAN Ports
HWIC/WIC/VIC Ports
Power Switch
Console Port
Auxiliary Port
Control Input Interface
10/100 Ethernet LAN Port LEDs
AIM LED
System OK LED
System Activity LED
Compact Flash LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug Power Interface

6
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
The module’s internal Flash does not store any IOS images. The CF card must be used to store the valid
IOS image. The CF card that stores the IOS image is considered an internal memory module, because
the IOS image stored in the card may not be modified or upgraded. The card itself must never be removed
from the drive. Tamper evident seal will be placed over the card in the drive.
The Cisco 2801 Cryptographic Module Physical Characteristics
Figure 3 The Cisco 2801 router case
The Cisco 2801 router is a multiple-chip standalone cryptographic module. The router has a processing
speed of 240MHz. Depending on configuration, either the installed AIM-VPN/BPII-Plus module,
onboard FPGA or the IOS software is used for cryptographic operations.
The cryptographic boundary of the module is the device's case Figure 3. All of the functionality
discussed in this document is provided by components within this cryptographic boundary.
The interfaces for the router are located on the front and rear panel as shown in Figure 4and Figure 5,
respectively.
Figure 4 Cisco 2801 Front Panel Physical Interfaces
Figure 5 Cisco 2801 Rear Panel Physical Interfaces
95817
95816
1234
5
6
7 9 11 12 13 14 14
8 10
95905
31
2

7
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
The Cisco 2801 router features a console port, an auxiliary port, Universal Serial Bus (USB) port, two
high-speed WAN interface card (HWIC) slots, Voice interface card (VIC) slot, WIC/VIC slot, two10/100
Fast Ethernet RJ45 ports, and a Compact Flash (CF) drive. The Cisco 2801 router has two slots for
AIM-VPN/EPII-Plus cards1, two internal packet voice data modules (PVDMs), and two fast Ethernet
connections. Figure 4 and Figure 5 show the front and read panels of the router. The front panel consists
of 14 LEDs: two duplex LEDs, two speed LEDs, two link LEDs, two PVDM LEDs, two AIM LEDs,
system status LED (SYS OK), system activity (SYS ACT) LED, inline power LED, and CF LED. The
back panel has the power inlet and on/off switch.
The front panel contains the following:
• (1) VIC slot
• (2) HWIC/WIC/VIC slot 0
• (3) WIC/VIC slot
• (4) HWIC/WIC/VIC slot 1
• (5) Console port
• (6) FE ports
• (7) System status and activity LEDs
• (8) Inline power LED
• (9) USB port
• (10) FE LEDs
• (11) Auxiliary port
• (12) CF LED
• (13) CF drive
The rear panel contains the following:
• (1) Power inlet
• (2) Power switch
• (3) Ground connector
Table 5 provides more detailed information conveyed by the LEDs on the front panel of the router:
1. The security policy covers the configuration in which one AIM card is used.
Table 5 Cisco 2801 Front Panel Indicators
Name State Description
System OK Solid Green
Blinking Green
Router has successfully booted up and the software is
functional.
Booting or in ROM monitor (ROMMON) mode.
Inline Power Solid Green
Amber
Off
Inline power supply is working properly.
Inline power failure.
Inline power supply is not present.
System Activity Solid Green
Blinking Green
Off
System is actively transferring packets.
System is servicing interrupts.
No interrupts or packet transfer occurring.

8
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
Table 6 describes the meaning of Ethernet LEDs on the front panel:
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in the
Table 7:
Compact Flash Solid Green
Off
Indicates that the flash is busy and should not be removed.
OK to remove flash card.
PVDM1 Solid Green
Solid Orange
Off
PVDM1 installed and initialized.
PVDM1 installed and initialized error.
PVDM1 not installed.
PVDM0 Solid Green
Solid Orange
Off
PVDM0 installed and initialized.
PVDM0 installed and initialized error.
PVDM0 not installed.
AIM1 Solid Green
Solid Orange
Off
AIM1 installed and initialized.
AIM1 installed and initialized error.
AIM1 not installed.
AIM0 Solid Green
Solid Orange
Off
AIM0 installed and initialized.
AIM0 installed and initialized error.
AIM0 not installed.
Table 5 Cisco 2801 Front Panel Indicators (Continued)
Table 6 Cisco 2801 Ethernet Indicators
Name State Description
Duplex Solid Green
Off
Full-Duplex
Half-Duplex
Speed Solid Green
Off
100 Mbps
10 Mbps
Link Solid Green
Off
Ethernet link is established
No link established
Table 7 Cisco 2801 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC/WIC/VIC Ports
Console Port
Auxiliary Port
Data Input Interface

9
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
The module’s internal Flash does not store any IOS images. The CF card must be used to store the valid
IOS image. The CF card that stores the IOS image is considered an internal memory module. The reason
is the IOS image stored in the card cannot be modified or upgraded. The card itself must never be
removed from the drive. Tamper evident seal will be placed over the card in the drive.
Roles and Services
Authentication to the Cisco 1841 and Cisco 2801 is role-based. There are two main roles in the router
that operators can assume: the Crypto Officer role and the User role. The administrator of the router
assumes the Crypto Officer role in order to configure and maintain the router using Crypto Officer
services, while the Users exercise only the basic User services. The module supports RADIUS and
TACACS+ for authentication. A complete description of all the management and configuration
capabilities of the router can be found in the Performing Basic System Management manual and in the
online help for the router.
10/100 Ethernet LAN Ports
HWIC/WIC/VIC Ports
Console Port
Auxiliary Port
Data Output Interface
10/100 Ethernet LAN Ports
HWIC/WIC/VIC Ports
Power Switch
Console Port
Auxiliary Port
Control Input Interface
10/100 Ethernet LAN Port LEDs
AIM LEDs
PVDM LEDs
Inline Power LED
System Activity LED
System OK LED
Compact Flash LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug Power Interface
Table 7 Cisco 2801 FIPS 140-2 Logical Interfaces (Continued)

10
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
User Services
Users enter the system by accessing the console port with a terminal program or via IPSec protected
telnet or SSH session to a LAN port. The IOS prompts the User for username and password. If the
password is correct, the User is allowed entry to the IOS executive program.
The services available to the User role consist of the following:
• Status Functions—View state of interfaces and protocols, version of IOS currently running.
• Network Functions—Connect to other network devices through outgoing telnet, PPP, etc. and
initiate diagnostic network services (i.e., ping, mtrace).
• Terminal Functions—Adjust the terminal session (e.g., lock the terminal, adjust flow control).
• Directory Services—Display directory of files kept in flash memory.
Crypto Officer Services
During initial configuration of the router, the Crypto Officer password (the “enable” password) is
defined. A Crypto Officer can assign permission to access the Crypto Officer role to additional accounts,
thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. The Crypto
Officer services consist of the following:
• Configure the router—Define network interfaces and settings, create command aliases, set the
protocols the router will support, enable interfaces and network services, set system date and time,
and load authentication information.
• Define Rules and Filters—Create packet Filters that are applied to User data streams on each
interface. Each Filter consists of a set of Rules, which define a set of packets to permit or deny based
on characteristics such as protocol ID, addresses, ports, TCP connection establishment, or packet
direction.
• View Status Functions—View the router configuration, routing tables, active sessions, use gets to
view SNMP MIB statistics, health, temperature, memory status, voltage, packet statistics, review
accounting logs, and view physical interface status.
• Manage the router—Log off users, shutdown or reload the router, manually back up router
configurations, view complete configurations, manage user rights, and restore router configurations.
• Set Encryption/Bypass—Set up the configuration tables for IP tunneling. Set keys and algorithms
to be used for each IP range or allow plaintext packets to be set from specified IP address.
Physical Security
The router is entirely encased by a metal, opaque case. The rear of the unit contains HWIC/WIC/VIC
connectors, LAN connectors, a CF drive, power connector, console connector, auxiliary connector, USB
port, and fast Ethernet connectors. The front of the unit contains the system status and activity LEDs.
The top, side, and front portion of the chassis can be removed to allow access to the motherboard,
memory, AIM slot, and expansion slots.
Once the router has been configured in to meet FIPS 140-2 Level 2 requirements, the router cannot be
accessed without signs of tampering. To seal the system, apply serialized tamper-evidence labels as
follows:

11
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
To apply serialized tamper-evidence labels to the Cisco 1841:
Step 1 Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2 The tamper evidence label should be placed over the CF card in the slot so that any attempt to remove
the card will show sign of tampering.
Step 3 The tamper evidence label should be placed so that the one half of the label covers the enclosure and the
other half covers the port adapter slot.
Step 4 The tamper evidence label should be placed so that the one half of the label covers the enclosure and the
other half covers the rear panel.
Step 5 The labels completely cure within five minutes.
Figure 6 and Figure 7 show the tamper evidence label placements for the Cisco 1841.
Figure 6 Cisco 1841 Tamper Evident Label Placement (Back View)
Figure 7 Cisco 1841 Tamper Evident Label Placement (Front View)
To apply serialized tamper-evidence labels to the Cisco 2801:
Step 1 Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2 The tamper evidence label should be placed so that one half of the label covers the front panel and the
other half covers the enclosure.

12
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
Step 3 The tamper evidence label should be placed over the CF card in the slot so that any attempt to remove
the card will show sign of tampering.
Step 4 The tamper evidence label should be placed so that the one half of the label covers the enclosure and the
other half covers the port adapter slot.
Step 5 The labels completely cure within five minutes.
Figure 8 and Figure 9 show the tamper evidence label placements for the 2821.
Figure 8 Cisco 2801 Tamper Evident Label Placement (Back View)
Figure 9 Cisco 2801 Tamper Evident Label Placement (Front View)
The tamper evidence seals are produced from a special thin gauge vinyl with self-adhesive backing. Any
attempt to open the router will damage the tamper evidence seals or the material of the module cover.
Since the tamperevidence seals have non-repeated serial numbers, they can be inspected for damage and
compared against the applied serial numbers to verify that the module has not been tampered. Tamper
evidence seals can also be inspected for signs of tampering, which include the following: curled corners,
bubbling, crinkling, rips, tears, and slices. The word “OPEN” may appear if the label was peeled back.
Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters such as
passwords. The tamper evidence seals provide physical protection for all keys. All keys are also
protected by the password-protection on the Crypto Officer role login, and can be zeroized by the Crypto
Officer. All zeroization consists of overwriting the memory that stored the key. Keys are exchanged and
entered electronically or via Internet Key Exchange (IKE).
The routers support the following FIPS 140-2 approved algorithm implementations:
• Software (IOS) implementations
– AES

13
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
– DES (for legacy use only - transitional phase only – valid until May 19th, 2007)
– 3DES
– SHA-1 hashing
– HMAC-SHA-1
– X9.31 PRNG
• Onboard FPGA implementations
– AES
– DES (for legacy use only - transitional phase only – valid until May 19th, 2007)
– 3DES
– SHA-1 hashing
– HMAC-SHA-1
• AIM module implementations
– AES
– DES (for legacy use only - transitional phase only – valid until May 19th, 2007)
– 3DES
– SHA-1 hashing
– HMAC-SHA-1
The routers also support the following algorithms which are not FIPS 140-2 approved: MD5,
MD5-HMAC, and DH.
The router is in the approved mode of operation only when FIPS 140-2 approved algorithms are used
(except DH which is allowed in the approved mode for key establishment despite being non-approved).
Note: The module supports DH key sizes of 1024 and 1536 bits. Therefore, DH provides 80-bit and
96-bit of encryption strength per NIST 800-57.
The following are not FIPS 140-2 approved algorithms: RC4, MD5, HMAC-MD5, RSA and DH;
however again DH is allowed for use in key establishment.
The module contains a HiFn 7814-W cryptographic accelerator chip, integrated in the AIM card. Unless
the AIM card is disabled by the Crypto Officer with the “no crypto engine aim” command, the HiFn
7814-W provides AES (128-bit, 192-bit, and 256-bit), DES (56-bit) (for legacy use only - transitional
phase only – valid until May 19th, 2007), and 3DES (168-bit) encryption; MD5 and SHA-1 hashing; and
hardware support for DH, RSA encryption, and RSA public key signature/verification. However, all
RSA operations are prohibited by policy
The module supports two types of key management schemes:
• Pre-shared key exchange via electronic key entry. DES/3DES/AES key and HMAC-SHA-1 key are
exchanged and entered electronically.
• Internet Key Exchange method with support for pre-shared keys exchanged and entered
electronically.
– The pre-shared keys are used with Diffie-Hellman key agreement technique to derive DES,
3DES or AES keys.
– The pre-shared key is also used to derive HMAC-SHA-1 key.
The module supports the commercially available Diffie-Hellman method of key establishment. See
Document 7A, Cisco IOS Reference Guide.

14
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
All pre-shared keys are associated with the CO role that created the keys, and the CO role is protected
by a password. Therefore, the CO password is associated with all the pre-shared keys. The Crypto
Officer needs to be authenticated to store keys. AllDiffie-Hellman (DH) keys agreed upon for individual
tunnels are directly associated with that specific tunnel only via the IKE protocol.
Key Zeroization:
Each key can be zeroized by sending the “no” command prior to the key function commands. This will
zeroize each key from the DRAM, the running configuration.
“Clear Crypto IPSec SA” will zeroize the IPSec DES/3DES/AES session key (which is derived using
the Diffie-Hellman key agreement technique) from the DRAM. This session key is only available in the
DRAM; therefore this command will completely zeroize this key. The following command will zeroize
the pre-shared keys from the DRAM:
• no set session-key inbound ah spi hex-key-data
• no set session-key outbound ah spi hex-key-data
• no set session-key inbound esp spi cipher hex-key-data [authenticator hex-key-data]
• no set session-key outbound esp spi cipher hex-key-data [authenticator hex-key-data]
The DRAM running configuration must be copied to the start-up configuration in NVRAM in order to
completely zeroize the keys.
The following commands will zeroize the pre-shared keys from the DRAM:
• no crypto isakmp key key-string address peer-address
• no crypto isakmp key key-string hostname peer-hostname
The DRAM running configuration must be copied to the start-up configuration in NVRAM in order to
completely zeroize the keys.
The module supports the following keys and critical security parameters (CSPs).
Table 8 Cryptographic Keys and CSPs
Name Algorithm Description Storage Zeroization Method
PRNG Seed X9.31 This is the seed for X9.31 PRNG. This CSP is
stored in DRAM and updated periodically after
the generation of 400 bytes – after this it is
reseeded with router-derived entropy; hence, it is
zeroized periodically. Also, the operator can turn
off the router to zeroize this CSP.
DRAM
(plaintext) Automatically every 400 bytes, or turn off the router.
Diffie Hellman
private
exponent
DH The private exponent used in Diffie-Hellman
(DH) exchange. Zeroized after DH shared secret
has been generated.
DRAM
(plaintext) Automatically after shared secret generated.
Diffie Hellman
public key DH The public key used in Diffie-Hellman (DH) exchange. Zeroized after the DH shared secret
has been generated
DRAM
(plaintext) Automatically after shared secret generated.
skeyid Keyed
SHA-1 Value derived from the shared secret within IKE exchange. Zeroized when IKE session is
terminated.
DRAM
(plaintext) Automatically after IKE session terminated.
skeyid_d Keyed
SHA-1 The IKE key derivation key for non ISAKMP security associations. DRAM (plaintext) Automatically after IKE session terminated.

15
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
skeyid_a HMAC-
SHA-1 The ISAKMP security association authentication key. DRAM (plaintext) Automatically after IKE session terminated.
skeyid_e DES/TDES
/AES The ISAKMP security association encryption key. DRAM (plaintext) Automatically after IKE session terminated.
IKE session
encrypt key DES/TDES /AES The IKE session encrypt key. DRAM (plaintext) Automatically after IKE session terminated.
IKE session
authentication
key
HMAC-
SHA-1 The IKE session authentication key. DRAM (plaintext) Automatically after IKE session terminated.
ISAKMP
preshared Secret The key used to generate IKE skeyid during preshared-key authentication. “no crypto isakmp
key” command zeroizes it. This key can have two
forms based on whether the key is related to the
hostname or the IP address.
NVRAM
(plaintext) “# no crypto isakmp key”
IKE hash key HMAC-
SHA-1 This key generates the IKE shared secret keys. This key is zeroized after generating those keys. DRAM (plaintext) Automatically after generating IKE shared
secret keys.
secret_1_0_0 The fixed key used in Cisco vendor ID
generation. This key is embedded in the module
binary image and can be deleted by erasing the
Flash.
NVRAM
(plaintext) Deleted by erasing the flash.
IPSec
encryption key DES/TDES /AES The IPSec encryption key. Zeroized when IPSec session is terminated. DRAM (plaintext) Automatically when IPSec session terminated.
IPSec
authentication
key
HMAC-
SHA-1 The IPSec authentication key. The zeroization is the same as above. DRAM (plaintext) Automatically when IPSec session terminated.
Configuration
encryption key AES The key used to encrypt values of the configuration file. This key is zeroized when the
“no key config-key” is issued. Note that this
command does not decrypt the configuration file,
so zeroize with care.
NVRAM
(plaintext) “# no key config-key”
Router
authentication
key 1
Shared
secret This key is used by the router to authenticate itself to the peer. The router itself gets the
password (that is used as this key) from the AAA
server and sends it onto the peer. The password
retrieved from the AAA server is zeroized upon
completion of the authentication attempt.
DRAM
(plaintext) Automatically upon completion of
authentication attempt.
PPP
authentication
key
RFC 1334 The authentication keyused in PPP. This key is in
the DRAM and not zeroized at runtime. One can
turn off the router to zeroize this key because it is
stored in DRAM.
DRAM
(plaintext) Turn off the router.
Table 8 Cryptographic Keys and CSPs (Continued)

16
Cisco 1841IntegratedServicesRouterwithAIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouterwithAIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
Note All RSA operations are prohibited by policy, and commands that can be executed by Officer are shown
“# command”.
Router
authentication
key 2
Shared
Secret This key is used by the router to authenticate itself to the peer. The key is identical to Router
authentication key 1 except that it is retrieved
from the local database (on the router itself).
Issuing the “no username password” zeroizes the
password (that is used as this key) from the local
database.
NVRAM
(plaintext) “# no username password”
SSH session
key Various symmetric This is the SSH session key. It is zeroized when the SSH session is terminated. DRAM (plaintext) Automatically when SSH session terminated
User password Shared
Secret The password of the User role. This password is zeroized by overwriting it with a new password. NVRAM (plaintext) Overwrite with new password
Enable
password Shared Secret The plaintext password of the CO role. This password is zeroized by overwriting it with a new
password.
NVRAM
(plaintext) Overwrite with new password
Enable secret Shared
Secret The ciphertext password of the CO role. However, the algorithm used to encrypt this
password is not FIPS approved. Therefore, this
password is considered plaintext for FIPS
purposes. This password is zeroized by
overwriting it with a new password.
NVRAM
(plaintext) Overwrite with new password
RADIUS secret Shared
Secret The RADIUS shared secret. This shared secret is zeroized by executing the “no radius-server key”
command.
NVRAM
(plaintext),
DRAM
(plaintext)
“# no radius-server key”
TACACS+
secret Shared Secret The TACACS+ shared secret. This shared secret is zeroized by executing the “no tacacs-server
key” command.
NVRAM
(plaintext),
DRAM
(plaintext)
“# no tacacs-server key”
Table 8 Cryptographic Keys and CSPs (Continued)

17
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
.Table 9 Role and Service Access to CSP
Note: An enpty entry indicates that a particular SRDI is not accessible by the corresponding service.
SRDI/Role/Service Access Policy
Role/Service User Role Status Functions Network Functions Terminal Functions Directory Services Crypto-Officer Role Configure the Router Define Rules and Filters Status Functions Manage the Router Set Encryptions/Bypass Change WAN Interface Cards
Security Relevant Data Item
PRNG Seed r d r
w
d
DH private exponent r r
w
d
DH public key r r
w
d
skeyid r r
w
d
skeyid_d r r
w
d
skeyid_a r r
w
d
skeyid_e r r
w
d
IKE session encrypt key r r
w
d
IKE session authentication key r r
w
ISAKMP preshared r r
w
d

18
Cisco 1841IntegratedServices Routerwith AIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouter with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
IKE hash key r r
w
d
secret_1_0_0 r r
w
d
IPSec encryption key r r
w
d
IPSec authentication key r r
w
d
Configuration encryption key r
w
d
r
w
d
Router authentication key r r
w
d
PPP Authentication key r d r
w
Router authentication key 2 r r
w
d
SSH session key r r
w
d
User password r r
w
d
Enable password r
w
d
Table 9 Role and Service Access to CSP (Continued)
Note: An enpty entry indicates that a particular SRDI is not accessible by the corresponding service.
SRDI/Role/Service Access Policy
Role/Service User Role Status Functions Network Functions Terminal Functions Directory Services Crypto-Officer Role Configure the Router Define Rules and Filters Status Functions Manage the Router Set Encryptions/Bypass Change WAN Interface Cards

19
Cisco 1841 Integrated Services Router with AIM-VPN/BPII-Plus and Cisco 2801 Integrated Services Router with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
Self-Tests
In order to prevent any secure data from being released, it is important to test the cryptographic
components of a security module to insure all components are functioning correctly. The router includes
an array of self-tests that are run during startup and periodically during operations. All self-tests are
implemented by the software. Anexample of self-tests run at power-up is a cryptographic known answer
test (KAT) on each of the FIPS-approved cryptographic algorithms and on the Diffie-Hellman algorithm.
Examples of tests performed at startup are a software integrity test using an EDC, and a set of Statistical
Random Number Generator (RNG) tests. Examples of tests run periodically or conditionally include: a
bypass mode test performed conditionally prior to executing IPSec, and a continuous random number
generator test. If any of the self-tests fail, the router transitions into an error state. In the error state, all
secure data transmission is halted and the router outputs status information indicating the failure.
Examples of the errors that cause the system to transition to an error state:
• IOS image integrity checksum failed
• Microprocessor overheats and burns out
• Known answer test failed
• NVRAM module malfunction.
• Temperature high warning
Enable secret r
w
d
RADIUS secret r
w
d
TACACS+ secret r
w
d
Table 9 Role and Service Access to CSP (Continued)
Note: An enpty entry indicates that a particular SRDI is not accessible by the corresponding service.
SRDI/Role/Service Access Policy
Role/Service User Role Status Functions Network Functions Terminal Functions Directory Services Crypto-Officer Role Configure the Router Define Rules and Filters Status Functions Manage the Router Set Encryptions/Bypass Change WAN Interface Cards

20
Cisco 1841IntegratedServices Routerwith AIM-VPN/BPII-PlusandCisco 2801IntegratedServicesRouter with AIM-VPN/EPII-Plus
OL-8719-01
Cisco 1841 and Cisco 2801 Routers
Self-tests performed by the IOS image
IOS Self Tests
• POST tests
– AES Known Answer Test
– Software/firmware test
– Power up bypass test
– RNG Known Answer Test
– Diffie Hellman test
– HMAC-SHA-1 Known Answer Test
– SHA-1 Known Answer Test
– DES Known Answer Test
– 3DES Known Answer Test
• Conditional tests
– Conditional bypass test
– Continuous random number generation test
Self-tests performed by the Onboard FPGA
FPGA Self Tests
• POST tests
– AES Known Answer Test
– Firmware integrity test
– HMAC-SHA-1 Known Answer Test
– SHA-1 Known Answer Test
– DES Known Answer Test
– 3DES Known Answer Test
Self-tests performed by AIM
AIM Self Tests
• POST tests
– AES Known Answer Test
– DES Known Answer Test
– 3DES Known Answer Test
– SHA-1 Known Answer Test
– HMAC-SHA-1 Known Answer Test
– Firmware integrity test