RSA modulus size is the number of bits in an RSA modulus. It determines encryption strength: larger modulus sizes provide stronger protection. Although commonly called key size or key length, the modulus is only one component of an RSA key pair. section 5.3.1 section 5.4
Apply these Cisco IOS rules when generating RSA keys:
- Use crypto key generate rsa and enter the requested modulus size, or specify it directly with crypto key generate rsa modulus bits. section 5.3.1
- Prefer at least 2,048 bits; newer software versions do not support SSH with smaller modulus sizes. section 5.3.1 section 5.4
- Use at least 768 bits when the RSA key pair must support SSHv2. section 5.4
- Configure a hostname and domain name before generation when the device names the key pair with its FQDN. section 5.3.1
Generate a 4096-bit RSA key pair
SW1(config)# ip domain name jeremysitlab.com SW1(config)# crypto key generate rsa The name for the keys will be: SW1.jeremysitlab.com How many bits in the modulus [512]: 4096 % Generating 4096 bit RSA keys, keys will be non-exportable... [OK] The device names the keys with its FQDN, generates the selected modulus, and enables SSH. Verify the result with show ip ssh. section 5.3.1
SW1(config)# ip domain name jeremysitlab.com #1 SW1(config)# crypto key generate rsa #2 The name for the keys will be: SW1.jeremysitlab.com #3 Choose the size of the key modulus in the range of 360 to 4096 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 4096 #4 % Generating 4096 bit RSA keys, keys will be non-exportable... [OK] (elapsed time was 7 seconds) *Sep 10 04:05:47.397: %SSH-5-ENABLED: SSH 1.99 has been enabled #5 #1 Configures a domain name #2 Generates an RSA key pair #3 The keys are named using the FQDN. #4 Larger modulus sizes are more secure. #5 A log message indicates that SSH version 1.99 is enabled.
Inspect the annotated IOS transcript showing domain configuration, modulus selection, key generation, and SSH enablement. section 5.3.1
