Cisco Catalyst 4503-E - Page 63

Cisco Cat4K NDPP ST 11 March 2014
EDCS-1228241
63
TOE SFRs
How the SFR is Met
exchanged and entered electronically. Persistent keys are entered
by the privileged administrator via the console port CLI, transient
keys are generated or established and stored in DRAM. If present,
a VSS link can export all DRAM and NVRAM keys to another
switch over a secure connection for high availability purposes.
The module supports the following critical security parameters
(CSPs). It is noted that there may be keys and CSPs that are not
applicable to this evaluation and should not be reviewed. They
are included for completeness of the module.
ID
Algorit
hm
Size
Description
Storag
e
Zeroizati
on
Method
10
General Keys/CSPs
User
Password
Passwo
rd
Variable
(8+
characters)
Used to
authenticate
local users
NVRA
M
(plainte
xt)
Zeroized
by
overwriti
ng with
new
password
Enable
Password
Passwo
rd
Variable
(8+
characters)
Used to
authenticate
local users at a
higher privilege
level
NVRA
M
(plainte
xt)
Zeroized
by
overwriti
ng with
new
password
RADIUS
secret
Shared
Secret
Variable
(8+
characters)
The RADIUS
Shared Secret
NVRA
M
(plainte
xt)
Zeroized
using the
following
command
:
# no
radius-
server key
Overwritt
en with:
0x0d
RADIUS
Key wrap
key
AES
128/256
bits
Used to protect
SAK
DRAM
(plainte
xt)
Zeroized
when data
structure
is freed
TACACS
+ secret
Shared
Secret
Variable
(8+
characters)
The TACACS+
shared secret
NVRA
M
(plainte
xt)
Zeroized
using the
following
command
:
# no
tacacs-
10
Unless specifically noted, the zeroization method used for secrets, keys, etc is to overwrite with zeros
(0x00).