Polycom VSX 5000, VSX 3000, VSX 7000s manual Key Generation, Key Input/Output

Non-Proprietary Security Policy, Version 1.0						June 15, 2007
Key	Key Type	Generation /	Output	Storage	Zeroization	Use
		Input
x.509 certificate	1024 bits RSA	Generated	Output in	Stored in Flash	Erasing the flash	Authenticates the
(RSA Public	public key	externally, input	plaintext	in plaintext	image	module during
key)		in plaintext				TLS handshake
RSA Private key	1024 bits RSA	Generated	Never exits the	Stored in Flash	Erasing the flash	Authenticates the
	private key	externally, input	module	in plaintext	image	module during
		in plaintext				TLS handshake
Diffie-Hellman	1024 bits	Generated	Output in	Stored in	Zerorized on	Establishes a
public key	public key	internally	plaintext	volatile	reboot.	session key (IP or
				memory		ISDN Encryption
						Key) during
						H.323 negotiation
Diffie-Hellman	1024 bits	Generated	Never exits the	Stored in	Zerorized on	Establishes a
private key	private key	internally	module	volatile	reboot.	session key (IP or
				memory		ISDN Encryption
						Key) during
						H.323 negotiation
Integrity Check	1024 bits DSA	Generated	Never exits the	Stored in Flash	Erasing the flash	Checks integrity
Key	Public key	externally,	module	in plaintext	image	of the software at
		inputted in				power-up of the
		plaintext				module
Session Key	192 bits TDES	Generated	Exits in	Held in volatile	Zerorized on	Encrypts TLS
	CBC key	internally during	encrypted form	memory in	reboot.	traffic
		TLS handshake	(RSA key	plaintext.
			transport)
IP Encryption	128 bits AES	Generated	Never exits the	Held in volatile	Zerorized on	Encrypts IP calls
Key	CBC key	internally during	module	memory in	reboot.
		Diffie-Hellman		plaintext.
		key agreement
ISDN	128, 192, 256	Generated	Never exits the	Held in volatile	Zerorized on	Encrypts ISDN
Encryption Key	bits AES OFB	internally during	module	memory in	reboot.	calls
	keys	Diffie-Hellman		plaintext.
		key agreement
PRNG seed	20 bytes of	Internally	Never exits the	Held in volatile	Zerorized on	Produce FIPS
	seed value	generated	module	memory only in	reboot	approved random
				plaintext.		number

1.7.1Key Generation

The modules generate symmetric keys and FIPS-approved PRNG seeds internally. The symmetric keys (Session Key, IP Encryption Key, and ISDN Encryption Key) and Diffie-Hellman key pair are generated using a FIPS- approved 186-2 Appendix 3.1 algorithm. Twenty bytes of hardware generated noise is used to create a PRNG seed, and RSA key pair is generated externally and input into the module in plaintext.

1.7.2Key Input/Output

Rivest, Shamir, Adleman (RSA) key pair is generated externally and input to the modules in plaintext. The RSA private key and DH private key never exit the module, while the public keys are output in plaintext. The Session key exits the module in encrypted form during TLS handshakes (protected within RSA key transport). The IP Encryption Key and ISDN Encryption Key are never output from the module. Other CSPs and keys, such as the Integrity Check Key and PRNG seed are never output from the modules.

Polycom VSX 3000, VSX 5000, and VSX 7000s Page 18 of 23

© 2007 Polycom, Inc. - This document may be freely reproduced and distributed whole and intact including this Copyright Notice.