RSA encry

[mcardell]

Good Afternoon,

What is the benefits of RSA encrypted nonces against the RSA signatures?

ANy particular reason to use one instead of the other?

Any CCO link available?

Thanks in advance

[#2]

This is not just the technical advantage of one over the other, it also depends on the products. Some products do not support both.

[Steve Fuller]

RSA encrypted nonces are somewhat cumbersome due to the fact that you need to generate the public / private key on each device and then exchange the public key with each and every peer. The other issue with nonces is that, should your head-end router fail, you would have to re-generate and exchange new keys with every peer unless you used exportable keys (see http://www.cisco.com/en/US/partner/products/sw/iosswrel/ps1839/products_feature_guide09186a00801541cf.html).

Digital signatures, while involving additional work to set up, are far more scaleable and offer the added benefit of non-redudiation and certificate revocation.

In recent discussions with Cisco I've been quoted a ratio 75/1/24 for Pre-shared keys, RSA nonces and Digital Signatures. Seems no one likes or uses encrypted nonces.

Regards

Steve