System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Public key-pairs

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains public key-pairs for Cisco IOS XR certificate-based trust, including the source behavior, constraints, and operational details that support certification authority interoperability.

A public key-pair is a cryptographic credential that

  • consists of a mathematically linked public and private key

  • enables secure communication and authentication, and

  • supports multiple cryptographic algorithms such as RSA, DSA, ECDSA, and ED25519.

Feature history

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Syslog alerts on public keys generated in XR config mode

Release 26.1.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

This enhancement ensures Cisco IOS XR devices remain compliant with evolving security standards. During system reboot, the device now sends syslog warnings for public keys if weak SSH host keys are detected—specifically, RSA keys less than 3072 bits or any DSA keys. Additionally, the default RSA key size has been increased from 2048 to 3072 bits to further strengthen security.

This feature introduces these changes:

CLI: .

Public Key-Pair Generation in XR Config Mode

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])(select variants only*)

*This feature is supported on the Cisco 8712-MOD-M routers.

Public Key-Pair Generation in XR Config Mode

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

  • 8212-48FH-M

  • 8711-32FH-M

Public Key-Pair Generation in XR Config Mode

Release 7.3.2

This feature allows you to generate public-key pairs in the XR Config mode, which in turn lets you save configurations. You can then load these saved configurations across different routers to quickly deploy the key-pair configurations.

You could generate public-key pairs in earlier releases only in the XR EXEC mode, which does not save configurations. So manually executing the key-pair generation commands on every router was time-consuming.

The following commands are available in XR Config mode, in addition to XR EXEC mode:

Additional reference information

Syslog alerts on public keys generated in XR config mode (Cisco IOS XR Release 26.1.1):

  • The default RSA key size is 3072 bits.

  • A syslog warning is triggered during system boot if a weak SSH host key is detected (RSA key less than 3072 bits).

  • DSA keys are no longer auto-generated at boot. If present, a syslog warning prompts removal.

  • These changes align device behavior with current cryptographic security standards and improve protection.

The following table lists the supported key types and key sizes in FIPS and non-FIPS modes:

Key Type Non-FIPS Mode FIPS Mode
RSA Supported for all key sizes from 512–4096 Supported for key sizes 2048, 3072, 4096
DSA Supported for key sizes 512, 768, 1024 Supported for key size 2048
ECDSA Supported for nistp256, nistp384, nistp512 Supported for nistp256, nistp384, nistp512
ED25519 Supported Not Supported

For more details on FIPS, see the Configuring FIPS Mode chapter.

Requirement: Follow public key-pair usage guidelines

Follow these requirements when generating public key-pairs in XR config mode:

  • Do not generatesystem-root-key and system-enroll-key in XR config mode.

  • Generating a key-pair in XR config mode overwrites any key-pair previously generated in XR EXEC mode, except in Cisco IOS XR Release 24.4.1 and later.

  • From Release 24.4.1 onwards, generate keys in XR config mode only after zeroizing or removing any existing key using the no generate command.

  • You cannot overwrite or delete keys generated in XR config mode from XR EXEC mode.

  • When you use the no form of the crypto key generate command in XR config mode, only keys generated in config mode are deleted.

  • The show crypto key mypubkey displays keys generated in XR EXEC mode first, followed by those generated in XR config mode.

Configure public key-pairs in XR config mode

Establish cryptographic key-pairs in Cisco IOS XR config mode to secure device communication.

Use cryptographic key-pairs with certificate authorities to support secure operations in Cisco IOS XR devices. XR config mode allows you to generate DSA, RSA, ECDSA, and ED25519 keys of various sizes.

Before you begin

  • Review certificate authority prerequisites.

  • Ensure you are running Cisco IOS XR Release 26.1.1 or later, as the default RSA key size is 3072 bits.

Procedure

  1. Generate desired cryptographic keys.

    Example:

    Router# conf t
Router(config)# crypto key generate dsa 1024
Router(config)# crypto key generate rsa user1 general-keys 3072
Router(config)# crypto key generate rsa user2 usage-keys 3072
Router(config)# crypto key generate rsa 3072
Router(config)# crypto key generate ecdsa nistp256
Router(config)# crypto key generate ecdsa nistp384
Router(config)# crypto key generate ecdsa nistp521
Router(config)# crypto key generate ed25519
Router(config)# commit

    Use no form of the command in XR Configuration mode to delete any of the key-pairs.

    Starting with Cisco IOS XR Release 26.1.1, the default RSA key size is 3072 bits; syslog warning is triggered during system boot for weak SSH host key (RSA key < 3072 bits). Additionally, if you configure the DSA key, a syslog on system boot alerts you to remove the DSA key.

  2. Verify the generated keys.

    Example:

    Router# show crypto key mypubkey ecdsa
Key label: the_default
Type     : ECDSA General Curve Nistp256
Degree   : 256
Created  : 11:49:22 IST Wed Apr 21 2021
Data     :
 04D6D132 2253ABD0 81449E3F 9D5CEA3A 1107950A 829E9090 8960FBD5 ABA039B7
 24A4E217 7EA47475 91C60AC7 013DBC2E EA8434D9 0BD5B0FC 694913AE 0098A4F5
 77

Key label: the_default
Type     : ECDSA General Curve Nistp521
Degree   : 521
Created  : 22:44:22 IST Thu Mar 18 2021
Data     :
 04017798 4369F493 8D0E57D1 1975FC46 CDC03A78 03A9F90E B38CA504 17DB9A64
 D1DEA6A6 D23E7E20 4D8D4D31 C7878BDB BF5EEE40 1978A889 70C5D703 BB033B77
 0FFD9201 366A9AC8 35E69BB3 97FF4E91 6B498510 39425971 C5E43858 83286088
 A6A7BF92 0EA2B416 BD4E81CE DCEB65F1 15CC75B5 91204E89 3339A168 2382CAB6
 40170131 8F


-----------------------------
 Public keys from config sysdb:
 -----------------------------
 Key label: the_default
Type     : ECDSA General Curve Nistp384
Degree   : 384
Created  : 11:51:52 IST Wed Apr 21 2021
Data     :
 045F7C14 1A88C27E 9CED3FF1 7FEDFA03 B49575FA 7AD88370 BC9C7D7F F99C8917
 33620916 758BDEFC 7187E33A 2D3CCD33 14FF3267 9855A5E9 E3BD166C CE838462
 40742231 6198EE12 3E189F42 22A8149A 8E7B186D 88E728D4 7F47D565 53441061
 79

The device now has public key-pairs configured as required. The verification command confirms certificate authority interoperability and key presence in XR config mode.

System logs and error messages for public key-pair operations

Use this reference to look up details of public key-pair system logs and error messages generated during key-pair operations. Apply these facts when planning, configuring, or validating certificate authority interoperability.

Log messages for key-pair operations

  • Logs on successful key-pair creation:

    cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key DSA generated, label:the_default, modBits:1024
cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key ECDSA_NISTP256 generated, label:the_default, modBits:256

  • Logs on key-pair deletion:

    cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key RSA zeroized, label:user1
cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key DSA zeroized, label:the_default

  • Error messages when overwriting key-pairs generated in XR Config Mode from XR EXEC mode:

    Router# conf t
Router(config)# crypto key generate ed25519
Router(config)# commit
Router# crypto key generate ed25519
Cannot execute the command : Operation not permitted
ce_cmd[68727]: %SECURITY-CEPKI-6-ERR_2 : Cannot       execute the command :   Operation not permitted
ce_cmd[68736]: %SECURITY-CEPKI-6-ERR : Key is added as part of config mode, key deletion is not allowed , delete key from config mode

  • Error messages when deleting key-pairs generated in XR Config Mode from XR EXEC mode:

    Router# conf t
Router(config)# crypto key generate ed25519
Router(config)# commit
Router# crypto key zeroize ed25519
Cannot execute the command : Operation not permitted
ce_cmd[68736]: %SECURITY-CEPKI-6-ERR_2 : Cannot execute the command :   Operation not permitted

  • Logs and warnings after process restart (examples):

    Router# process restart cepki
Tue Dec  9 04:50:55.396 UTC
RP/0/RP0/CPU0:Dec  9 04:50:55.445 UTC: sysmgr_control[66932]: %OS-SYSMGR-4-PROC_RESTART_NAME : User cafyauto (con0_RP0_CPU0) requested a restart of process cepki at 0/RP0/CPU0
Router#


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply third-party
authority to import, export, distribute or use encryption. Importers,
exporters, distributors and users are responsible for compliance with
U.S. and local country laws. By using this product you agree to comply
with applicable laws and regulations. If you are unable to comply with
U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be
found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

RP/0/RP0/CPU0:Dec  9 04:50:56.430 UTC: cepki[277]: %INFRA-WARN_INSECURE-4-INSECURE_FEATURE_WARN : Feature 'Weak RSA SSH host key present' utilized or configured. This feature is deprecated as it is known to be insecure; it will be removed in a future release. Consider upgrading RSA (crypto key generate rsa) to at least 3072 bits

...
Router# process restart cepki
Tue Dec  9 05:14:49.926 UTC
RP/0/RP0/CPU0:Dec  9 05:14:49.973 UTC: sysmgr_control[68825]: %OS-SYSMGR-4-PROC_RESTART_NAME : User cafyauto (con0_RP0_CPU0) requested a restart of process cepki at 0/RP0/CPU0
Router#

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply third-party
authority to import, export, distribute or use encryption. Importers,
exporters, distributors and users are responsible for compliance with
U.S. and local country laws. By using this product you agree to comply
with applicable laws and regulations. If you are unable to comply with
U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be
found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

RP/0/RP0/CPU0:Dec  9 05:14:50.969 UTC: cepki[277]: %INFRA-WARN_INSECURE-4-INSECURE_FEATURE_WARN : Feature 'Weak DSA SSH host key present' utilized or configured. This feature is deprecated as it is known to be insecure; it will be removed in a future release. Consider removing DSA (crypto key zeroize dsa)