Contents

Configuring keychains· 1

About keychains· 1

Operating mechanism·· 1

Time modes· 1

Restrictions and guidelines: Keychain configuration· 1

Configuring a keychain in absolute time mode· 1

Configuring a keychain in periodic time mode· 3

Verifying and maintaining keychains· 4

 

Configuring keychains

About keychains

A keychain, a sequence of keys, provides dynamic authentication to ensure secure communication by periodically changing the key and authentication algorithm without service interruption.

Operating mechanism

Each key in a keychain has a key string, authentication algorithm, sending lifetime, and receiving lifetime. When the system time is within the lifetime of a key in a keychain, an application uses the key to authenticate incoming and outgoing packets. The keys in the keychain take effect one by one according to the sequence of the configured lifetimes. In this way, the authentication algorithms and keys are dynamically changed to implement dynamic authentication.

Time modes

A keychain operates in absolute time mode or periodic time mode. The lifetime for a key varies by time mode.

·     Absolute time mode—Each time point during a key's lifetime is the UTC time and is not affected by the system's time zone or daylight saving time.

·     Periodic time mode—A key's lifetime is calculated based on the local time and is affected by the system's time zone and daylight saving time.

¡     daily—The lifetime for a key is from the specified start time to the specified end time of each day.

¡     weekly—The lifetime for a key is from the specified start day to the specified end day of each week.

¡     monthly—The lifetime for a key is from the specified start date to the specified end date of each month.

¡     yearly—The lifetime for a key is from the specified start month to the specified end month of each year.

Restrictions and guidelines: Keychain configuration

Follow these guidelines when you configure a keychain:

·     To make sure only one key in a keychain is used at a time to authenticate packets to a peer, set non-overlapping sending lifetimes for the keys in the keychain.

·     The keys used by the local device and the peer device must have the same authentication algorithm and key string.

Configuring a keychain in absolute time mode

1.     Enter system view.

system-view

2.     Create a keychain and enter keychain view.

keychain keychain-name mode absolute

3.     (Optional.) Configure TCP authentication.

¡     Set the kind value in the TCP Enhanced Authentication Option.

tcp-kind kind-value

By default, the kind value is 254.

¡     Set an algorithm ID for a TCP authentication algorithm.

tcp-algorithm-id { hmac-md5 | hmac-sha-256 | hmac-sm3 | md5 | sm3 } algorithm-id

By default, the algorithm ID is 3 for the MD5 authentication algorithm, 5 for the HMAC-MD5 authentication algorithm, 7 for the HMAC-SHA-256 authentication algorithm, 51 for the SM3 authentication algorithm, and 52 for the HMAC-SM3 authentication algorithm.

Support of the command for the hmac-sm3 and sm3 keywords depends on the device model. For more information, see the command reference.

When the local device uses TCP to communicate with a peer device from another vendor, make sure both devices have the same kind value and algorithm ID settings. If they do not, modify the settings on the local device.

4.     (Optional.) Set a tolerance time for accept keys in the keychain.

accept-tolerance { value | infinite }

By default, no tolerance time is configured for accept keys in a keychain.

If authentication information is changed, information mismatch occurs on the local and peer devices, and the service might be interrupted. Use this command to ensure continuous packet authentication.

5.     Create a key and enter key view.

key key-id

6.     Configure the key.

¡     Specify an authentication algorithm for the key.

authentication-algorithm { hmac-md5 | hmac-sha-1 | hmac-sha-256 | hmac-sm3 | md5 | sm3 }

By default, no authentication algorithm is specified for a key.

Support of the command for the hmac-sm3 and sm3 keywords depends on the device model. For more information, see the command reference.

¡     Configure a key string for the key.

key-string { cipher | plain } string

By default, no key string is configured.

¡     Set the sending lifetime in UTC mode for the key.

send-lifetime utc start-time start-date { duration { duration-value | infinite } | to end-time end-date }

By default, the sending lifetime is not configured for a key.

¡     Set the receiving lifetime in UTC mode for the key.

accept-lifetime utc start-time start-date { duration { duration-value | infinite } | to end-time end-date }

By default, the receiving lifetime is not configured for a key.

¡     (Optional.) Specify the key as the default send key.

default-send-key

By default, a keychain does not have a default send key.

You can specify only one key as the default send key in a keychain.

Configuring a keychain in periodic time mode

1.     Enter system view.

system-view

2.     Create a keychain and enter keychain view.

keychain keychain-name mode periodic { daily | monthly | weekly | yearly }

3.     (Optional.) Configure TCP authentication.

¡     Set the kind value in the TCP Enhanced Authentication Option.

tcp-kind kind-value

By default, the kind value is 254.

¡     Set an algorithm ID for a TCP authentication algorithm.

tcp-algorithm-id { hmac-md5 | hmac-sha-256 | hmac-sm3 | md5 | sm3 } algorithm-id

By default, the algorithm ID is 3 for the MD5 authentication algorithm, 5 for the HMAC-MD5 authentication algorithm, 7 for the HMAC-SHA-256 authentication algorithm, 51 for the SM3 authentication algorithm, and 52 for the HMAC-SM3 authentication algorithm.

Support of the command for the hmac-sm3 and sm3 keywords depends on the device model. For more information, see the command reference.

When the local device uses TCP to communicate with a peer device from another vendor, make sure both devices have the same kind value and algorithm ID settings. If they do not, modify the settings on the local device.

4.     (Optional.) Set a tolerance time for accept keys in the keychain.

accept-tolerance { value | infinite }

By default, no tolerance time is configured for accept keys in a keychain.

If authentication information is changed, information mismatch occurs on the local and peer devices, and the service might be interrupted. Use this command to ensure continuous packet authentication.

5.     Create a key and enter key view.

key key-id

6.     Configure the key.

¡     Specify an authentication algorithm for the key.

authentication-algorithm { hmac-md5 | hmac-sha-1 | hmac-sha-256 | hmac-sm3 | md5 | sm3 }

By default, no authentication algorithm is specified for a key.

Support of the command for the hmac-sm3 and sm3 keywords depends on the device model. For more information, see the command reference.

¡     Configure a key string for the key.

key-string { cipher | plain } string

By default, no key string is configured.

¡     Set the daily, weekly, monthly, or yearly sending lifetime in periodic time mode for the key.

send-lifetime daily start-day-time to end-day-time

send-lifetime date { month-day&<1-31> | start-month-day to end-month-day }

send-lifetime day { week-day | start-week-day to end-week-day }

send-lifetime month { month | start-month to end-month }

By default, the sending lifetime is not configured for a key.

¡     Set the daily, weekly, monthly, or yearly receiving lifetime in periodic time mode for the key.

accept-lifetime daily start-day-time to end-day-time

accept-lifetime date { month-day&<1-31> | start-month-day to end-month-day }

accept-lifetime day { week-day | start-week-day to end-week-day }

accept-lifetime month { month | start-month to end-month }

By default, the receiving lifetime is not configured for a key.

¡     (Optional.) Specify the key as the default send key.

default-send-key

By default, a keychain does not have a default send key.

You can specify only one key as the default send key in a keychain.

Verifying and maintaining keychains

To display keychain information, execute the following command in any view:

display keychain [ name keychain-name [ key key-id ] ]