Cisco 7609-S User manual

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
1
Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B
FIPS 140-2 Non Proprietary Security Policy
Level 2 Validation
Version 0.5
May, 2011

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
2
Table of Contents
1 INTRODUCTION.................................................................................................................. 3
1.1PURPOSE............................................................................................................................. 3
1.2MODULE VALIDATION LEVEL ............................................................................................ 3
1.3REFERENCES....................................................................................................................... 3
1.4TERMINOLOGY ................................................................................................................... 4
1.5DOCUMENT ORGANIZATION ............................................................................................... 4
2CISCO 7606-S AND 7609-S ROUTERS WITH SUPERVISOR SUP720-3B .................. 5
2.1CRYPTOGRAPHIC MODULE PHYSICAL CHARACTERISTICS .................................................. 5
2.2MODULE INTERFACES......................................................................................................... 6
2.3ROLES AND SERVICES......................................................................................................... 8
2.3.1Authentication................................................................................................9
2.3.2Services.........................................................................................................9
a. User Services........................................................................................................9
b. Crypto Officer Services .......................................................................................10
2.3.3Unauthenticated Services............................................................................11
2.4PHYSICAL SECURITY ........................................................................................................ 11
2.4.1Module Opacity ...........................................................................................11
2.4.2Tamper Evidence........................................................................................13
2.5CRYPTOGRAPHIC ALGORITHMS........................................................................................ 17
2.5.1Approved Cryptographic Algorithms............................................................17
2.5.2Non-FIPS Approved Algorithms Allowed in FIPS Mode ..............................18
2.5.3Non-Approved Cryptographic Algorithms....................................................18
2.6CRYPTOGRAPHIC KEY MANAGEMENT.............................................................................. 18
2.7SELF-TESTS ...................................................................................................................... 20
2.7.1Self-tests performed by the IOS image .......................................................20
3SECURE OPERATION ...................................................................................................... 21
3.1SYSTEM INITIALIZATION AND CONFIGURATION................................................................ 21
3.2PROTOCOLS ...................................................................................................................... 22
3.3REMOTE ACCESS .............................................................................................................. 22

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
3
1 Introduction
1.1 Purpose
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 7606-
S and 7609-S Routers with Supervisor SUP720-3B. This security policy describes how the
Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B (Hardware Version: Chassis:
7606-S and 7609-S with SUP720-3B; Firmware Version: 15.1(2)S) meet the security
requirements of FIPS 140-2, and how to operate the router with on-board crypto enabled in a
secure FIPS 140-2 mode. This policy was prepared as part of the Level 2FIPS 140-2 validation
of the Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2 — Security
Requirements for Cryptographic Modules) details the U.S. Government requirements for
cryptographic modules. More information about the FIPS 140-2 standard and validation program
is available on the NIST website at http://csrc.nist.gov/groups/STM/index.html.
1.2 Module Validation Level
The following table lists the level of validation for each area in the FIPS PUB 140-2.
No. Area Title Level
1 Cryptographic Module Specification 2
2 Cryptographic Module Ports and Interfaces 2
3 Roles, Services, and Authentication 3
4 Finite State Model 2
5 Physical Security 2
6 Operational Environment N/A
7 Cryptographic Key management 2
8 Electromagnetic Interface/Electromagnetic Compatibility 2
9 Self-Tests 2
10 Design Assurance 2
11 Mitigation of Other Attacks N/A
Overall module validation level 2
Table 1 Module Validation Level
1.3 References
This document deals only with operations and capabilities of the Cisco 7606-S and 7609-S
Routers with Supervisor SUP720-3B in the technical terms of a FIPS 140-2 cryptographic
module security policy. More information is available on the routers from the following sources:
The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
4
http://www.cisco.com/en/US/prod/collateral/routers/ps368/ps371/product_data_sheet0900aecd80
57f3c8.html
For answers to technical or sales related questions please refer to the contacts listed on
the Cisco Systems website at www.cisco.com.
The NIST Validated Modules website
(http://csrc.nist.gov/groups/STM/cmvp/validation.html) contains contact information
for answers to technical or sales-related questions for the module.
1.4 Terminology
In this document, the Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B is referred
to as the router, the module, or the system.
1.5 Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
Vendor Evidence document
Finite State Machine
Other supporting documentation as additional references
This document provides an overview of the Cisco 7606-S and 7609-S Routers with Supervisor
SUP720-3B and explains the secure configuration and operation of the module. This introduction
section is followed by Section 2, which details the general features and functionality of the
router. Section 3 specifically addresses the required configuration for the FIPS-mode of
operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation
Submission Documentation is Cisco-proprietary and is releasable only under appropriate non-
disclosure agreements. For access to these documents, please contact Cisco Systems.

© Copyri
g
This docum
e
2Cis
c
The Cis
c
form fac
t
Label S
w
service
p
infrastru
c
applicati
o
WAN a
n
followin
g
2.1 Cr
y
g
ht 2011 Cis
c
e
nt may be freel
y
c
o 7606-S
c
o 7600-S R
o
t
or for depl
o
w
itching (M
P
p
roviders. It
e
c
ture that su
p
o
ns in both
t
n
d metropoli
t
g
subsectio
n
y
p
t
o
g
raphi
c
c
o Systems, I
n
y
reproduced an
and 7609
-
o
uter is a co
m
o
yment at th
e
P
LS) servic
e
e
nables Car
r
p
ports a ran
g
t
he residenti
t
an-area net
w
n
s describe t
h
c
Module P
h
n
c.
d distributed wh
o
-
S Router
m
pact, high
-
e
network e
d
e
s are neces
s
r
ier Etherne
t
g
e of IP vid
e
al and busi
n
w
ork (MA
N
h
e physical
c
hy
sical Cha
r
Figure 1 -
C
o
le and intact in
c
5
s with Su
p
-
performan
c
d
ge, where r
o
s
ary to meet
t
service pro
e
o and tripl
e
n
ess services
N
) networkin
g
c
haracteristi
c
r
acteristics
C
isco 7606-S
R
c
luding this Cop
y
p
ervisor
S
c
e router des
i
o
bust perfo
r
the require
m
viders to de
p
e
-play (voic
e
markets. T
h
g
solutions
a
c
s of the ro
u
R
outer
y
right Notice.
S
UP720-3
B
i
gned in a 6
-
r
mance and
I
m
ents of bot
h
p
loy an adv
a
e
, video, an
d
h
e Cisco 76
0
a
t the enterp
r
u
ters.
B
-
slot and 9-
s
I
P/Multipro
t
h
enterprise
s
a
nced netw
o
d
data) syste
m
0
0-S also de
l
r
ise edge. T
h
s
lot
t
ocol
s
and
o
rk
m
l
ivers
h
e

© Copyri
g
This docum
e
The cry
p
The cry
p
module.
All of th
e
cryptogr
a
2.2 M
o
The mo
d
1.
T
2.
O
3.
O
4. F
5.
T
6.
T
7.
T
These in
t
g
ht 2011 Cis
c
e
nt may be freel
y
p
tographic b
o
p
tographic b
o
e
functional
i
a
phic boun
d
o
dule Inter
fa
d
ule features
T
wo SFP Et
h
O
ne 10/100/
1
O
ne serial co
n
our Status
L
T
wo Disk L
E
T
hree Link
L
T
wo Compa
c
t
erfaces are
d
c
o Systems, I
n
y
reproduced an
o
undary is
d
o
undary is i
l
i
ty describe
d
d
ary. The m
o
fa
ces
the followi
n
h
ernet ports
1
000 Ethern
e
n
sole port
L
EDs
E
Ds
L
EDs
c
tFlash Typ
e
d
epicted in
t
n
c.
d distributed wh
o
Figure 2 -
C
d
efined as
b
e
l
lustrated in
d
in this pub
l
o
dule incorp
o
n
g interface
s
e
t port
e
II slots (
d
i
s
t
he figures
b
o
le and intact in
c
6
C
isco 7609-S
R
ing the phy
s
Figures 1 a
n
l
ication is p
r
o
rates one o
r
s
:
s
abled via T
E
b
elow:
c
luding this Cop
y
R
outer
s
ical enclos
u
n
d 2 above
a
r
ovided by
c
r
more supe
r
E
L)
y
right Notice.
u
re of the ch
a
a
s the dark b
o
c
omponents
w
r
visor blade
s
a
ssis.
o
rder aroun
d
w
ithin this
s
.
d
the

© Copyri
g
This docum
e
The foll
o
rear pan
e
g
ht 2011 Cis
c
e
nt may be freel
y
o
wing tables
e
l of the rou
t
Name
Status
System
Active
c
o Systems, I
n
y
reproduced an
provide m
o
t
er:
State
Green
Orange
Red
Green
Orange
Red
Green
Orange
n
c.
d distributed wh
o
Figure 3 - S
o
re detailed i
o
le and intact in
c
7
UP 720-3B in
t
nformation
c
Descriptio
n
All diagnosti
c
operational (
n
The supervis
o
diagnostics (
n
The diagnost
i
failed. The s
u
b
ecause a fau
l
sequence.
All chassis e
n
OK.
A minor hard
w
A major hard
w
The supervis
o
The supervis
o
c
luding this Cop
y
t
erfaces
c
onveyed b
y
n
c
s pass. The s
u
n
ormal initiali
z
o
r engine is bo
o
n
ormal initiali
z
i
c test (includi
n
u
pervisor engi
n
l
t occurred du
r
n
vironmental
m
w
are problem
w
are problem
h
o
r engine is op
e
o
r engine is in
s
y
right Notice.
y
the LEDs
o
u
pervisor engi
n
z
ation sequenc
e
o
ting or runni
n
z
ation sequenc
e
n
g FIPS POST
n
e is not opera
t
r
ing the initiali
m
onitors are re
p
has been dete
c
h
as occurre
d
e
rational and
a
s
tandby mode.
o
n the front
a
n
e is
e
).
n
g
e
)
s)
t
ional
zation
p
orting
c
ted.
a
ctive.
a
nd

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
8
PWR MGMT Orange Power-up mode; running self-diagnostics.
Green Power management is functioning normally and
sufficient power is available for all modules.
Orange A minor power management problem has been
detected. There is insufficient power for all
modules to power up.
Red A major power failure has occurred.
DISK 0 and
DISK 1 N/A These LEDs are illuminated green when the installed Flash PC card is being accessed and is
performing either a read operation or a write
operation.
Table 2 – LED Indicators
The module provides a number of physical and logical interfaces to the device, and the physical
interfaces provided by the module are mapped to the following FIPS 140-2 defined logical
interfaces: data input, data output, control input, status output, and power. The logical interfaces
and their mapping are described in the following table:
Router Physical Interface FIPS 140-2 Logical Interface
Gigabit/SFP Ethernet ports
Console Port Data Input Interface
Gigabit/SFP Ethernet ports
Console Port Data Output Interface
Gigabit/SFP Ethernet ports
Console Port Control Input Interface
Gigabit/SFP Ethernet ports
Console Port
LEDs
Status Output Interface
Power plug Power Interface
Table 3 – FIPS 140-2 Logical Interfaces
2.3 Roles and Services
Authentication in the module is identity-based. There are two main roles in the router that
operators can assume:
1. the Crypto Officer role and
2. the User role.
The administrators of the router assumes the Crypto Officer role in order to configure and
maintain the router using Crypto Officer services, while the Users exercise only the basic User
services. A detailed list of services attributed to each role can be found in section 2.3.2

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
9
2.3.1 Authentication
The module provides password based and digital signature based authentication. Crypto Officers
are always authenticated using passwords whereas a User can be authenticated either via a
password or digital signature.
a. Password based Authentication
The security policy stipulates that all user passwords and shared secrets must be 8 alphanumeric
characters, so the password space is 2.8 trillion possible passwords. The possibility of randomly
guessing a password is thus far less than one in one million. To exceed a one in 100,000
probability of a successful random password guess in one minute, an attacker would have to be
capable of 28 million password attempts per minute, which far exceeds the operational
capabilities of the module to support.
b. Digital signature based Authentication
When using RSA based authentication, RSA key pair has modulus size of 1024 bit to 2048 bit,
thus providing between 80 bits and 112 bits of strength. Assuming the low end of that range, an
attacker would have a 1 in 280 chance of randomly obtaining the key, which is much stronger
than the one in a million chance required by FIPS 140-2. To exceed a one in 100,000 probability
of a successful random key guess in one minute, an attacker would have to be capable of
approximately 1.8x1021 attempts per minute, which far exceeds the operational capabilities of the
modules to support.
2.3.2 Services
a. User Services
Users can access the system via the console port with a terminal program or SSH session to an
Ethernet port. The IOS prompts the User for username and password. If the password is correct,
the User is allowed entry to the IOS executive program. In addition to username/password
combination, RSA digital certificates can be used to authenticate the user over the SSH session.
The services available to the User role consist of the following:
Services &
Access Description Keys & CSPs
Status Functions
(r, x) View state of interfaces and protocols,
version of IOS currently running.
User password
Network Connect to other network devices DRBG seed, DRBG V, DH

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
10
Functions (r, w,
x, z) through SSH, telnet, PPP, etc. and
initiate diagnostic network services
(i.e., ping, mtrace).
shared secret, DH private
exponent, SSH Private key, SSH
session key
Terminal
Functions Adjust the terminal session (e.g., lock
the terminal, adjust flow control). N/A
Directory
Services Display directory of files kept in flash
memory. N/A
Perform Self-
Tests Perform the FIPS 140 start-up tests on
demand N/A
Table 4 - User Services
b. Crypto Officer Services
During initial configuration of the router, the Crypto Officer password (the “enable” password) is
defined. A Crypto Officer can assign permission to access the Crypto Officer role to additional
accounts, thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. Just
like the User, the Crypto Officer can access the router via the console port or via SSH session.
The Crypto Officer services consist of the following:
Services & Access Description Keys & CSPs
Configure the router
(r, w, z) Define network interfaces and
settings, create command aliases, set
the protocols the router will support,
enable interfaces and network
services, set system date and time, and
load authentication information.
User password, Enable
password, RADIUS secret,
TACACS+ secret, DH shared
secret, Router Authentication
key, PPP authentication key,
SSH private key
Define Rules and
Filters Create packet Filters that are applied
to User data streams on each interface.
Each Filter consists of a set of Rules,
which define a set of packets to permit
or deny based on characteristics such
as protocol ID, addresses, ports, TCP
connection establishment, or packet
direction.
N/A
View Status
Functions (r, x) View the router configuration, routing
tables, active sessions, use gets to
view SNMP MIB statistics, health,
temperature, memory status, voltage,
packet statistics, review accounting
logs, and view physical interface
User password, Enable
password, RADIUS secret,
TACACS+ secret, DH shared
secret, Router Authentication
key, PPP authentication key,
SSH private key

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
11
status.
Manage the router
(r, w) Log off users, shutdown or reload the
router, erase the flash memory,
manually back up router
configurations, view complete
configurations, manager user rights,
and restore router configurations.
User password, Enable
password, RADIUS secret,
TACACS+ secret, DH shared
secret, Router Authentication
key, PPP authentication key,
SSH private key
Perform Self-Tests Perform the FIPS 140 start-up tests on
demand N/A
r: read, w: write, x: execute, z: zeroize
Table 5 - Crypto Officer Services
2.3.3 Unauthenticated Services
The services available to unauthenticated users are:
•Viewing the status output from the module’s LEDs
•Powering the module on and off using the power switch on the third-party chassis
2.4 Physical Security
This module is a multi-chip standalone cryptographic module.
The FIPS 140-2 level 2 physical security requirements for the modules are met by the use of
opacity shields covering the front panels of modules to provide the required opacity and tamper
evident seals to provide the required tamper evidence. The following sections illustrate the
physical security provided by the module.
The tamper evident labels and opacity shields shall be installed for the module to operate in a
FIPS Approved mode of operation. The following table shows the number of tamper evident
labels and opacity shields. The CO is responsible for securing and having control at all times of
any unused tamper evident labels.
Model Tamper Evident Labels Opacity Shields
7606-S 20 1
7609-S 15 N/A
Table 6 – TELs
2.4.1 Module Opacity
To install an opacity shield on the module, follow these steps:
1. The opacity shield is designed to be installed on a Catalyst 7606-S chassis that is already
rack-mounted. If your Cisco 7606-S chassis is not rack-mounted, install the chassis in the

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
12
rack using the procedures contained in Cisco 7600 Series Router Installation Guide. If
your Cisco 7606-S chassis is already rack-mounted, proceed to step 2.
2. Open the FIPS kit packaging (part number CVPN7600FIPS/KIT=). The kit contains the
following items:
•An opacity shield assembly for the Cisco 7606-S router (part number 800-26211).
The opacity shield part number is located on the outside of the protective packaging.
•A bag containing the installation hardware (In some kits there is no bag; the
installation hardware is premounted in the opacity shield.
•An envelope with 30 FIPS tamper evidence labels and a disposable ESD wrist strap.
3. Remove the opacity shield from its protective packaging.
•If the thumbscrews and the snap rivet fasteners are already installed on the opacity
shield, remove the four snap rivet fasteners from the opacity shield; leave the
thumbscrews installed. Proceed to step 5.
Note: Verify that the thumbscrews are started only two or three turns in the opacity
shield.
•If the opacity shield comes with a bag of installation hardware (69-1483), open the
bag and remove the two thumbscrews and four snap rivet fasteners. The snap rivet
fasteners come assembled; you need to separate the two pieces of the snap rivet
fastener by removing the snap rivet pin from the snap rivet sleeve before you install
them. Proceed to step 4.
Note: Extra snap rivet fasteners are included in the bag of installation hardware in
case of loss or damage.
•Start the two thumbscrews in the corresponding threaded holes in the opacity shield
(see Figure 5); two or three turns is sufficient. Do not thread the thumbscrews too far
into the opacity shield.
•Open the envelope containing the disposable ESD wrist strap. Attach the disposable
ESD wrist strap to your wrist. Attach the other end of the wrist strap to exposed metal
on the chassis.
•Position the opacity shield over the air intake side of the chassis so that the two
thumbscrews on the opacity shield are aligned with the unused L-bracket screw holes
on the chassis.
•Press the opacity shield firmly against the side of the chassis and secure the opacity
shield to the chassis with the two thumbscrews.
4. Position the rivet sleeve over one of the square cutouts on the opacity shield. Refer to
Figure 5 for snap rivet fastener placement. Press the rivet sleeve through the cutout,
through the opacity shield material, and through one of the chassis air vent perforations.
Note: You might need to try different cutouts to find the one cutout that aligns correctly
with a chassis air vent perforation.
5. Push the rivet pin through the rivet sleeve until you hear a click.
Note: If you do not hear a click, remove and inspect the snap rivet fastener. If the rivet
sleeve appears expanded or damaged, discard the snap rivet fastener and use a new one
from the extras supplied in the bag of fasteners.
6. Repeat step 4 and step 5 for the remaining three snap rivet fasteners.

© Copyri
g
This docum
e
C
F
i
m
o
p
o
C
C
p
r
e
s
N
o
p
r
a
The 760
9
2.4.2
T
Once th
e
module
tamperi
n
To seal t
h
g
ht 2011 Cis
c
e
nt may be freel
y
C
aution: Du
e
IPS 140-2
v
m
pacted. Sh
o
p
acity shiel
d
C
.
C
aution: We
r
event dust
b
s
pecially du
N
ote: If you
n
p
acity shiel
d
a
ck.
F
i
9
-S does no
t
T
amper Evid
e
e
module h
a
cannot be
a
n
g perio
d
ical
h
e system,
a
c
o Systems, I
n
y
reproduced an
e
to decrease
v
alidation, s
h
o
rt-term op
e
d
installed, t
h
recommend
b
uil
d
-up an
d
sty, inspect
a
n
eed to rem
o
d
. With the
o
ig
ure 4 - Inst
a
t
require an
y
e
nce
a
s been co
n
a
ccessed wi
ly.
a
pply seriali
z
n
c.
d distributed wh
o
d airflow w
h
h
ort-term op
e
e
ration requi
h
e system
w
that you ch
a
d
the possibi
a
nd replace
o
ve the 760
6
o
pacity shie
l
a
llin
g
the Opa
c
y
opacity shi
e
n
figured to
m
thout signs
z
ed tampe
r
-
e
o
le and intact in
c
13
h
en using th
e
ration as s
p
rements wil
l
w
ill meet the
a
nge the op
a
lity of over
h
the opacity
s
6
-S chassis
fr
l
d installed,
t
c
it
y
Shield on
e
lds.
m
eet overal
l
of tamperi
n
e
vidence lab
c
luding this Cop
y
e opacity sh
p
ecified by
G
l
only
b
e m
e
short-term
o
a
city shield
e
h
eating the c
s
hield more
fr
om the rac
k
t
he chassis i
the Cisco 76
0
l
FIPS 140-
n
g. The C
O
els as depic
t
y
right Notice.
ield, which
i
G
R-63-COR
E
e
t at 40
o
C.
W
o
perations r
e
e
very three
m
hassis. If th
e
often.
k
, you must
f
s too wide t
o
0
6-S Router
2 Level 2
r
O
shall ins
p
t
ed in the fi
g
i
s required
f
E
at 55
o
C is
W
ithout the
e
quirements
m
onths to
e
environme
f
irst remove
o
slide out o
r
equirement
s
p
ect for sig
n
g
ures below.
f
or
at 55
nt is
the
f the
s
, the
n
s of

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
14
11-13
14-
15
1
2-7
8-
10

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
15
Figure 5 - TEL placement for 7606-S
16-17
18-20

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
16
1-9
10-11

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
17
Figure 6 - TEL placement for 7609-S
2.5 Cryptographic Algorithms
The module implements a variety of approved and non-approved algorithms.
2.5.1 Approved Cryptographic Algorithms
The routers support the following FIPS-2 approved algorithm implementations:
12-15

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
18
Table 7 Approved Cryptographic Algorithms
2.5.2 Non-FIPS Approved Algorithms Allowed in FIPS Mode
The module supports the following non-FIPS approved algorithms which are permitted for use in
the FIPS approved mode:
•Diffie-Hellman (key agreement; key establishment methodology provides between 80
and 156 bits of encryption strength)
•RSA (key wrapping; key establishment methodology provides between 80 and 112 bits of
encryption strength)
2.5.3 Non-Approved Cryptographic Algorithms
The module supports the following non-approved cryptographic algorithms that shall not be used
in FIPS mode of operation:
•DES
•DES MAC
•MD5
•MD4
•HMAC MD5
•Non Approved RNGs
2.6 Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters
such as passwords. All keys and CSPs are also protected by the password-protection provided
by the crypto-officer logins and can be zeroized by either the Crypto Officer or User. Zeroization
consists of overwriting the memory that stored the key or refreshing the volatile memory. Keys
are both manually and electronically distributed but entered electronically. Manual distribution is
used for pre-shared keys whereas SSH is used for electronic distribution.
The module supports the following types of key management schemes:
Algorithm
IOS
AES 1634
Triple-DES 1070
SHS 1439
HMAC 961
DRBG 88
RSA 808

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
19
1. Pre-shared key exchange via electronic key entry. Triple-DES/AES key and HMAC-
SHA-1 key are exchanged and entered electronically.
2. Diffie-Hellman key exchange is used to establish the Triple-DES or AES keys during
SSHv2 exchange.
All pre-shared keys are associated with the CO role that created the keys, and the CO role is
protected by a password. Therefore, the CO password is associated with all the pre-shared keys.
The Crypto Officer needs to be authenticated to store keys. All Diffie-Hellman (DH) keys agreed
upon for individual tunnels are directly associated with that specific tunnel only via the SSH
protocol. RSAPublickeysareenteredintothemodulesusingdigitalcertificateswhich
containrelevantdatasuchasthenameofthepublickey'sowner,whichassociatesthekey
withthecorrectentity.All other keys are associated with the user/role that entered them.
The module supports the following keys and critical security parameters (CSPs):
ID Algorithm Size Description Origin Storage Zeroization
Method
GeneralKeys/CSPs
User
password
Password8charactersUsedtoauthenticate
Userrole
Configuredby
CryptoOfficer
NVRAM
(plaintext)
Zeroizedby
overwriting
withnew
password
Enable
password
Password8charactersUsedtoauthenticate
CryptoOfficerrole
Configuredduring
moduleinitialization
NVRAM
(plaintext)
Zeroizedby
overwriting
withnew
password
RADIUS
secret
Shared
Secret
128bitsUsedtoauthenticate
RADIUSserverto
module
Configuredby
CryptoOfficer
NVRAM
(plaintext)
Zeroizedby“#
noradius‐
serverkey”
TACACS+
secret
Shared
Secret
128bitsUsedtoauthenticate
TACACS+serverto
module
Configuredby
CryptoOfficer
NVRAM
(plaintext)
Zeroizedby“#
notacacs‐
serverkey”
DRBG
Seed
SP800‐90128‐bitsThisistheseedforSP
800‐90DRBG.
Generatedby
entropysourcevia
theCTR_DRBG
derivationfunction
DRAM
(plaintext)
powercycle
thedevice

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
20
DRBGVSP800‐90

256‐bitsThisistheseedkeyfor
SP800‐90DRBG.
generatedfrom
entropysourcevia
theCTR_DRBG
derivationfunction
DRAM
(plaintext)
powercycle
thedevice
Diffie
Hellman
shared
secret
DH1024‐4096bitsThisistheshared
secretagreeduponas
partofDHexchange
N/ADRAM
(plaintext)
Zeroizedupon
deletion
Diffie
Hellman
private
exponent
DH1024‐4096bitsTheprivateexponent
usedinDiffie‐Hellman
(DH)exchange.
GeneratedusingFIPS
approvedDRBG
DRAM
(plaintext)
Automatically
aftershared
secret
generated.
SSHkeys/CSPs
SSH
Private
key
RSA1024‐2048bitsThisistheSSHprivate
keyusedto
authenticatethe
module
Generatedor
enteredlikeanyRSA
key
NVRAM
(plaintext)
Zeroizedby
eitherdeletion
(via#crypto
keyzeroize
rsa)orby
overwriting
withanew
valueofthe
key
SSH
session
key
Triple‐
DES/AES
3‐keyTriple‐
DES
128/192/256
bitsAESkeys
Thisisthesymmetric
SSHkeyusedto
protectSSHsession
Createdaspartof
SSHsessionset‐up
DRAM
(plaintext)
Zeroized
automatically
whenSSH
sessionis
closed
Table 8 Cryptographic Keys and CSPs
2.7 Self-Tests
In order to prevent any secure data from being released, it is important to test the cryptographic
components of a security module to insure all components are functioning correctly. The router
includes an array of self-tests that are run during startup and periodically during operations.
2.7.1 Self-tests performed by the IOS image
•IOS Self Tests
oPOST tests
AES Known Answer Test
RSA Signature Known Answer Test (both signature/verification)
Software/firmware test