Content

| 9.5 |  | Securing Remote Management |
| 9.5.4 |  | Encryption key-pairs |

The most common understanding of a data encryption system is based around pre-shared secret-key cryptography. Pre-shared secret-key cryptography is where two parties share the same secret. This secret is used to both encrypt and decrypt data before sending or reading the actual data. Anyone who knows the pre-shared secret key can encrypt and decrypt data.

The problem with a preshared secret-key system is in transferring knowledge of the preshared secret key to all participating parties while keeping the key secret. This problem was solved with the development of asymmetric key pair systems, also known as public / private key pairs or Public Key Infrastructure.

With asymmetric key pairs, the public-key portion is designed to be distributed freely. The private-key portion must be kept secret. If data is encrypted with the public-key, it can only be decrypted using the corresponding private-key. For example, a message encrypted with the public key cannot be decrypted with the public key. Only the private key can be used to decrypt the message. This ensures an eavesdropper cannot decrypt the message without the secret private key.

When an RSA key pair is generated on a Cisco IOS device, both a private key and a public key are created. Once generated, these keys can be used to encrypt communications between the SSH server running on the IOS device and the SSH client. The first time an SSH client connects to an SSH server, the client is given a copy of the server’s public key. Any data encrypted using the public key can only be decrypted using the matching private key, which is kept secret on the SSH server. Even if many people have copies of the public key, only the SSH server has the private key, and only the SSH server can decrypt the encrypted communications. This allows authentication details and session traffic to be exchanged between the SSH server and client securely.