System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

ECC P256-based Secure Unique Device Identifiers

Updated: September 18, 2026

Want to summarize with AI?

Log in

Details ECC P256-based Secure Unique Device Identifiers, including cryptographic mechanism comparisons, related error messages, and provides verification procedures for ECC P256 configurations in the Trusted Anchor Module.

A Secure Unique Device Identifier (SUDI) is a hardware-based cryptographic identity that

  • leverages the ECC P256 curve for enhanced security,

  • enables migration from legacy RSA-based authentication to stronger ECC-based protocols, and

  • supports secure services such as TLS 1.3 for BootZ, secure Zero-Touch Provisioning (sZTP), and EMSD.

The router automatically checks for ECC p256 capability during TAM initialization and enables the API if available. If ECC p256 is not provisioned or TAM is unreachable, the system falls back to RSA-based keys from the AIKIDO module, maintaining continuity for critical features.

Feature history

The feature history table lists release support for this feature.

Table 1. Feature History Table

Feature Name

Release info

Description

ECC P256-based Secure Unique Device Identifiers

Release 26.2.1

Introduced in this release on: Fixed Systems (8200 [ASIC: , Q200 ], (select variants only*)

ECC256 enablement enhances device security by migrating identity and attestation workflows to ECCp256-based SUDI via the Trust Anchor Module (TAM). This transition enables the adoption of TLS 1.3 for critical services such as BootZ, secure Zero-Touch Provisioning (sZTP), and EMSD. Operational continuity is ensured through a resilient fallback to legacy RSA-based keys if needed. ECC p256 is automatically enabled when certificates are present; no additional configuration steps are required.

*This feature is applicable on:

  • 8202-32FH-M

  • 8202-32FH-MO

ECC P256 cryptographic mechanism comparison

The following table lists and compares the key features of RSA 2048 and ECC P256 cryptographic mechanisms, highlighting their security strengths, protocol support, and continuity solutions.

Table 2. Comparison of cryptographic mechanisms and protocol support

Crypto Mechanism

Security Strength

Protocol Support

Continuity

RSA 2048

Moderate

TLS 1.2 (legacy)

Provided by AIKIDO

ECC p256

High

TLS 1.3 (advanced)

Provided by TAM

ECC P256 error messages

The following error messages may occur when working with ECC P256 certificates or TLS negotiations:

  • ECCp256 certificate chain missing: The ECC p256 certificate is not provisioned in TAM.

  • ECCp256 capability not enabled: TAM lacks ECC p256 capability or is unreachable.

  • TLS 1.3 negotiation failed: Fallback to TLS 1.2 initiated due to RSA-only configuration.

Verify ECC P256 configuration in the Trusted Anchor Module

Ensure that the Trusted Anchor Module supports and properly configures ECC P256 SUDI certificates for secure device authentication and compliance with security standards.

ECC P256 SUDI certificates help enable secure device attestation and encrypted communications. Verifying their correct configuration in the Trusted Anchor Module is essential to meet security requirements and to ensure your device operates securely in the network.

Before you begin

  • Confirm that your device supports ECC P256 SUDI.

Procedure

  1. Display TAM security information.

    Example:

    Router# show platform security tam all location 0/RP0/CPU0
Node - 0/RP0/CPU0
---------------------------------------------
Device Type            -     AIKIDO Extended
Device PID             -     8202-32FH-M
Device Serial Number   -     FLM275101MJ
Device Firmware Version-     0x27.0016
Server Version         -     3
Server Package Version -     13.1.1
Client Package Version -     13.1.1

...
...
...

Sudi Sub CA Cert:
---------------------------------------------
...
...
...

Sudi Cert:
---------------------------------------------
Certificate:
...
...
...

HA Sudi Root Cert:
---------------------------------------------
Certificate:
...
...
...

HA Sudi Cert:
---------------------------------------------
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:57:34:23:36:75:41:16:24:a5
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O=Cisco, CN=ACT2 ECC SUDI CA
        Validity
            Not Before: Nov 11 01:08:36 2025 GMT
            Not After : Apr  4 08:15:42 2053 GMT
        Subject: serialNumber=PID:8202-32FH-M SN:FLM275101MJ, O=Cisco, OU=ACT-2 Lite SUDI, CN=Cisco 8200 2RU 32x400G QSFP56-DD w\/IOS XR HBM MACsec MAC:70da48df0800-0200
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:08:cb:4c:7c:df:5e:7b:55:d9:50:76:7e:1d:e8:
                    3f:c4:63:86:f2:80:f9:26:65:f0:ef:85:61:d7:d2:
                    7e:1a:a7:8c:06:3f:3a:2d:2b:b7:5d:5c:08:51:c6:
                    b7:3a:72:40:f7:c1:2e:24:54:c6:a0:bb:27:50:b6:
                    78:23:0f:79:a1
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier:
                96:87:3A:D8:89:81:91:41:15:33:BF:E0:34:8F:20:8F:C2:BB:C3:96
            X509v3 Subject Alternative Name:
                othername: 1.3.6.1.4.1.9.21.3.4.2::<unsupported>, othername: 1.3.6.1.4.1.9.21.2.3::<unsupported>
            X509v3 Subject Key Identifier:
                E7:B7:21:95:3F:0F:F5:BF:F7:05:F5:21:CD:F7:B9:D4:0F:5D:ED:2D
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:65:02:31:00:8f:77:87:7d:3d:e8:b3:72:86:47:04:a2:41:
        ab:52:35:d1:44:9e:1d:ae:cd:e2:b3:8b:13:4c:26:9a:41:f2:
        d4:bb:fc:4b:67:bb:66:77:72:d8:c5:df:9a:f3:71:c7:51:02:
        30:00:bd:cd:7d:1e:fb:c7:2a:e7:21:60:28:5e:de:d8:58:45:
        7a:06:05:e0:54:13:b7:2b:40:34:d5:e1:7e:2c:fd:02:b0:ba:
        ad:62:47:77:26:a5:60:75:b8:14:02:82:af

    Review the output to ensure TAM is ECC p256 capable.

  2. Verify ECC p256 certificate details.

    Example:

    Router# show platform security tam ECCp256-sudi-certs location 0/RP0/CPU0
Node - 0/RP0/CPU0
---------------------------------------------

HA Sudi Root Cert:
---------------------------------------------
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3 (0x3)
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: O=Cisco, CN=Cisco ECC Root CA
        Validity
            Not Before: Apr  4 08:15:44 2013 GMT
            Not After : Sep  7 16:24:07 2099 GMT
        Subject: O=Cisco, CN=Cisco ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:7e:c0:c3:bc:d8:1b:c6:f3:67:91:4d:d6:78:8c:
                    e6:b5:75:39:04:7f:2f:fe:60:d0:ac:77:2a:d3:6d:
                    02:41:45:54:67:b0:58:b7:19:bf:cc:bd:4b:36:5c:
                    7b:5b:83:38:ec:a6:d7:4d:30:26:61:b3:4b:8b:ab:
                    5e:0e:15:26:3b:4c:88:ab:02:70:c9:22:37:02:50:
                    75:c0:d5:d4:48:34:c7:bf:58:53:fe:ae:cb:8f:73:
                    20:f5:06:5b:12:87:ca
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A4:45:B6:2F:A3:31:B1:76:15:B0:0A:18:33:CA:F6:AD:4F:3D:28:04
    Signature Algorithm: ecdsa-with-SHA384
    Signature Value:
        30:65:02:31:00:f0:9b:71:dc:7b:40:56:9f:ff:61:a9:3a:ba:
        6d:f1:19:10:44:4f:88:f9:80:ff:a5:86:6f:13:89:c8:19:75:
        39:9e:0e:b6:e8:85:bb:9f:06:0d:07:31:11:ba:80:57:2b:02:
        30:08:b9:e0:52:29:8f:89:14:84:28:c7:27:80:1d:98:73:ea:
        97:2c:6b:31:e3:84:b7:ac:48:b1:d6:54:d5:49:35:54:ca:66:
        27:8f:7a:f6:e2:b1:1e:38:ab:8a:a5:f3:86

HA Sudi Sub CA Cert:
---------------------------------------------
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5 (0x5)
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: O=Cisco, CN=Cisco ECC Root CA
        Validity
            Not Before: Apr  4 08:26:13 2013 GMT
            Not After : Sep  7 16:24:06 2099 GMT
        Subject: O=Cisco, CN=ACT2 ECC SUDI CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:8c:61:dc:fa:79:d2:31:0a:f8:ce:e0:11:cc:3c:
                    47:17:a4:c3:8b:de:df:ed:e1:aa:49:d0:ca:e6:68:
                    ac:56:9a:01:3f:43:70:c1:c9:9a:ce:cf:86:4e:24:
                    fe:52:ce:76:fc:12:ae:a3:82:65:69:9e:f8:72:79:
                    73:cc:12:27:90:fc:2d:b9:a8:36:6d:74:82:79:85:
                    49:85:c0:77:b1:5b:95:bd:88:92:29:51:22:d4:e2:
                    20:c7:ce:5d:b5:77:70
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                CA Issuers - URI:http://www.cisco.com/security/pki/certs/eccroot.cer
                OCSP - URI:http://pkicvs.cisco.com/pki/ocsp
            X509v3 Authority Key Identifier:
                A4:45:B6:2F:A3:31:B1:76:15:B0:0A:18:33:CA:F6:AD:4F:3D:28:04
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.9.21.1.19.0
                  CPS: http://www.cisco.com/security/pki/policies/index.html
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.cisco.com/security/pki/crl/eccroot.crl
            X509v3 Subject Key Identifier:
                96:87:3A:D8:89:81:91:41:15:33:BF:E0:34:8F:20:8F:C2:BB:C3:96
    Signature Algorithm: ecdsa-with-SHA384
    Signature Value:
        30:66:02:31:00:cf:27:bd:bf:58:79:9b:fd:5b:01:44:94:d0:
        c4:30:4a:10:c3:09:12:47:5e:c7:3e:d5:3b:5b:a8:e2:51:d5:
        c6:4c:9a:1b:08:cc:d3:72:fc:0b:24:90:1a:08:80:d3:6d:02:
        31:00:93:70:c0:2b:19:01:c7:70:d8:c9:94:b8:53:3d:c1:e7:
        43:29:6e:b6:70:a7:13:d3:50:2a:96:9b:ba:84:c4:23:3b:9b:
        51:63:22:0f:7c:96:d7:dd:96:d3:c7:82:a3:ff

HA Sudi Cert:
---------------------------------------------
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:57:34:23:36:75:41:16:24:a5
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O=Cisco, CN=ACT2 ECC SUDI CA
        Validity
            Not Before: Nov 11 01:08:36 2025 GMT
            Not After : Apr  4 08:15:42 2053 GMT
        Subject: serialNumber=PID:8202-32FH-M SN:FLM275101MJ, O=Cisco, OU=ACT-2 Lite SUDI, CN=Cisco 8200 2RU 32x400G QSFP56-DD w\/IOS XR HBM MACsec MAC:70da48df0800-0200
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:08:cb:4c:7c:df:5e:7b:55:d9:50:76:7e:1d:e8:
                    3f:c4:63:86:f2:80:f9:26:65:f0:ef:85:61:d7:d2:
                    7e:1a:a7:8c:06:3f:3a:2d:2b:b7:5d:5c:08:51:c6:
                    b7:3a:72:40:f7:c1:2e:24:54:c6:a0:bb:27:50:b6:
                    78:23:0f:79:a1
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier:
                96:87:3A:D8:89:81:91:41:15:33:BF:E0:34:8F:20:8F:C2:BB:C3:96
            X509v3 Subject Alternative Name:
                othername: 1.3.6.1.4.1.9.21.3.4.2::<unsupported>, othername: 1.3.6.1.4.1.9.21.2.3::<unsupported>
            X509v3 Subject Key Identifier:
                E7:B7:21:95:3F:0F:F5:BF:F7:05:F5:21:CD:F7:B9:D4:0F:5D:ED:2D
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:65:02:31:00:8f:77:87:7d:3d:e8:b3:72:86:47:04:a2:41:
        ab:52:35:d1:44:9e:1d:ae:cd:e2:b3:8b:13:4c:26:9a:41:f2:
        d4:bb:fc:4b:67:bb:66:77:72:d8:c5:df:9a:f3:71:c7:51:02:
        30:00:bd:cd:7d:1e:fb:c7:2a:e7:21:60:28:5e:de:d8:58:45:
        7a:06:05:e0:54:13:b7:2b:40:34:d5:e1:7e:2c:fd:02:b0:ba:
        ad:62:47:77:26:a5:60:75:b8:14:02:82:af

    Confirm that the leaf certificate and certificate chain are correctly displayed.

  3. Perform attestation with ECC p256.

    Example:

    Router# show platform security attest certificate CiscoECCp256SUDI nonce 1234 location 0/RP0/CPU0
 Node location: node0_RP0_CPU0
+--------------------------------------+
Nonce: 1234
Certificate name: Cisco ECC256 SUDI Root
-----BEGIN CERTIFICATE-----
MIIByDCCAU6gAwIBAgIBAzAKBggqhkjOPQQDAzAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRUNDIFJvb3QgQ0EwIBcNMTMwNDA0MDgxNTQ0WhgPMjA5
OTA5MDcxNjI0MDdaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBF
Q0MgUm9vdCBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABH7Aw7zYG8bzZ5FN1niM
5rV1OQR/L/5g0Kx3KtNtAkFFVGewWLcZv8y9SzZce1uDOOym100wJmGzS4urXg4V
JjtMiKsCcMkiNwJQdcDV1Eg0x79YU/6uy49zIPUGWxKHyqNCMEAwDgYDVR0PAQH/
BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKRFti+jMbF2FbAKGDPK
9q1PPSgEMAoGCCqGSM49BAMDA2gAMGUCMQDwm3Hce0BWn/9hqTq6bfEZEERPiPmA
/6WGbxOJyBl1OZ4OtuiFu58GDQcxEbqAVysCMAi54FIpj4kUhCjHJ4AdmHPqlyxr
MeOEt6xIsdZU1Uk1VMpmJ4969uKxHjiriqXzhg==
-----END CERTIFICATE-----

Certificate name: Cisco ECC256 SUDI CA
-----BEGIN CERTIFICATE-----
MIIDETCCApagAwIBAgIBBTAKBggqhkjOPQQDAzAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRUNDIFJvb3QgQ0EwIBcNMTMwNDA0MDgyNjEzWhgPMjA5
OTA5MDcxNjI0MDZaMCsxDjAMBgNVBAoTBUNpc2NvMRkwFwYDVQQDExBBQ1QyIEVD
QyBTVURJIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEjGHc+nnSMQr4zuARzDxH
F6TDi97f7eGqSdDK5misVpoBP0Nwwcmazs+GTiT+Us52/BKuo4JlaZ74cnlzzBIn
kPwtuag2bXSCeYVJhcB3sVuVvYiSKVEi1OIgx85dtXdwo4IBiTCCAYUwDgYDVR0P
AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwfQYIKwYBBQUHAQEEcTBvMD8G
CCsGAQUFBzAChjNodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2Vy
dHMvZWNjcm9vdC5jZXIwLAYIKwYBBQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28u
Y29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFKRFti+jMbF2FbAKGDPK9q1PPSgEMFwG
A1UdIARVMFMwUQYKKwYBBAEJFQETADBDMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3
LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvcG9saWNpZXMvaW5kZXguaHRtbDBCBgNV
HR8EOzA5MDegNaAzhjFodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kv
Y3JsL2VjY3Jvb3QuY3JsMB0GA1UdDgQWBBSWhzrYiYGRQRUzv+A0jyCPwrvDljAK
BggqhkjOPQQDAwNpADBmAjEAzye9v1h5m/1bAUSU0MQwShDDCRJHXsc+1TtbqOJR
1cZMmhsIzNNy/AskkBoIgNNtAjEAk3DAKxkBx3DYyZS4Uz3B50MpbrZwpxPTUCqW
m7qExCM7m1FjIg98ltfdltPHgqP/
-----END CERTIFICATE-----

Certificate name: Cisco ECC256 SUDI
-----BEGIN CERTIFICATE-----
MIIC9jCCAnygAwIBAgIKAVc0IzZ1QRYkpTAKBggqhkjOPQQDAjArMQ4wDAYDVQQK
EwVDaXNjbzEZMBcGA1UEAxMQQUNUMiBFQ0MgU1VESSBDQTAgFw0yNTExMTEwMTA4
MzZaGA8yMDUzMDQwNDA4MTU0MlowgagxJzAlBgNVBAUTHlBJRDo4MjAyLTMyRkgt
TSBTTjpGTE0yNzUxMDFNSjEOMAwGA1UEChMFQ2lzY28xGDAWBgNVBAsTD0FDVC0y
IExpdGUgU1VESTFTMFEGA1UEAxNKQ2lzY28gODIwMCAyUlUgMzJ4NDAwRyBRU0ZQ
NTYtREQgdy9JT1MgWFIgSEJNIE1BQ3NlYyBNQUM6NzBkYTQ4ZGYwODAwLTAyMDAw
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQIy0x83157VdlQdn4d6D/EY4bygPkm
ZfDvhWHX0n4ap4wGPzotK7ddXAhRxrc6ckD3wS4kVMaguydQtngjD3mho4IBBjCC
AQIwDgYDVR0PAQH/BAQDAgXgMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUloc6
2ImBkUEVM7/gNI8gj8K7w5YwgaEGA1UdEQSBmTCBlqBQBgorBgEEAQkVAwQCoEIT
QDAzNzU3NzJGNDM4OTUxRTJCMEM0QTAwMUZCMDhCOTFFMjI5RTg0QTI0NDI1Mjgx
NTFBMTA0QkQ4OEI1RDdEOTSgQgYJKwYBBAEJFQIDoDUTM0NoaXBJRD1uZVJmTEpa
Wk85cnJSc3BiREV1ZW1BQUFBQUFBQUFBQUFBQUFBQUFBQUFBPTAdBgNVHQ4EFgQU
57chlT8P9b/3BfUhzfe51A9d7S0wCgYIKoZIzj0EAwIDaAAwZQIxAI93h3096LNy
hkcEokGrUjXRRJ4drs3is4sTTCaaQfLUu/xLZ7tmd3LYxd+a83HHUQIwAL3NfR77
xyrnIWAoXt7YWEV6BgXgVBO3K0A01eF+LP0CsLqtYkd3JqVgdbgUAoKv
-----END CERTIFICATE-----

signature: MEQCIFIi1NZvNCcsO2/50eLx/AoypWd4KS8OSX4jS0kw1StuAiAmeAJk9wIw1p5tCzGEOI9mpTk/chDP82GEKERuuvOmqQ==
signature version: 2

    Ensure the PEM-formatted certificate chain and explicit signature using the ECC p256 private key are generated successfully.

  4. Check TAM status and take necessary actions based on these conditions.

    Table 3. Table

    If

    Then

    TAM is shown as ECC p256 capable

    No further action is required

    ECC p256 certificates are missing

    Initiate TAM provisioning or troubleshooting procedures

    Signature verification fails

    Verify the nonce and consult security policies.

The Trusted Anchor Module confirms ECC P256 capability and displays valid certificate information, demonstrating that secure device authentication and attestation are enabled.