System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

FIPS-compliant cryptographic keys

Updated: September 18, 2026

Want to summarize with AI?

Explains when cryptographic key pairs require manual generation, how key purpose affects RSA generation, and which generated keys appear in the running configuration.

A FIPS-compliant cryptographic key pair is a collection of key material that

uses a key type and size permitted by the documented FIPS mode
supports signing, encryption, or both functions, and
can be inspected or removed with the corresponding key-management commands.

The router automatically generates cryptographic keys when it boots. Generate keys manually only when required keys are missing.

Key generation in configuration mode

Cisco IOS XR Release 7.3.2 and later supports key-pair generation and deletion in XR configuration mode.

Only keys generated in configuration mode appear in the running configuration.

Supported cryptographic key types and sizes in FIPS mode

Use this information to select a documented key type and size before generating a key pair.

Table 1. Cryptographic key types and sizes
Key type	Documented FIPS-mode sizes	Key removal command
RSA	2048, 3072, or 4096 bits	crypto key zeroize rsa keypair-label
DSA	2048 bits	crypto key zeroize dsa keypair-label
ECDSA	nistp256, nistp384, or nistp512	crypto key zeroize ecdsa keypair-label

Generate and verify FIPS-compliant cryptographic keys

Create missing cryptographic keys for applications that operate in FIPS mode.

The router generates cryptographic keys during startup. Use this task when an application requires a key that is missing.

Before you begin

Enable FIPS mode.
Generate keys manually only when the required keys were not generated during router startup.
Select a supported key type and size.

Procedure

Generate an RSA key pair when the application requires RSA.
Example:
```
Router# crypto key generate rsa general-keys sample-rsa-keypair
```
Use a key size of 2048, 3072, or 4096 bits. The usage-keys option generates separate signing and encryption keys; general-keys generates one key pair for both purposes.

To delete the RSA key pair, use the crypto key zeroize rsa keypair-label command.
Generate a DSA key pair when the application requires DSA.
Example:
```
Router# crypto key generate dsa
```
The permitted DSA size in FIPS mode is 2048 bits.

To delete the DSA key pair, use the crypto key zeroize dsa keypair-label command.
Generate an ECDSA key pair when the application requires ECDSA.
Example:
```
Router# crypto key generate ecdsa
```
The ECDSA key sizes allowed under FIPS mode are nistp256 , nistp384 , and nistp512 .

To delete the ECDSA key pair, use the crypto key zeroize ecdsa keypair-label command.

Display the generated RSA public keys.

Example:

Router# show crypto key mypubkey rsa
Key label: system-root-key
Type : RSA General purpose
Size : 2048
Created : 01:13:10 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 <public-key output omitted>
Key label: system-enroll-key
Type : RSA General purpose
Size : 2048
Created : 01:13:16 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 <public-key output omitted>

Display the generated DSA public keys.
Example:
```
Router# show crypto key mypubkey dsa
```

Optionally verify keys that were generated in the configuration mode in the running configuration.

Example:

Router# configure
Router(config)# crypto key generate rsa sample-rsa-key general-keys 2048
Router(config)# commit
Router(config)# end
Router# show running-config
!! IOS XR Configuration 7.3.4
!
username sample-user
 group root-lr
 group cisco-support
 secret 10
 <encrypted-secret omitted>
!
crypto key generate rsa sample-rsa-key general-keys 2048 | -----BEGIN PUBLIC KEY-----
MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAgiXFnld/AADcil6eV38A
<public-key output omitted>
-----END PUBLIC KEY-----
 |
end

Only keys generated in configuration mode appear in the running configuration. The displayed keys use OpenSSL format.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.