This question is about encryption in data communications, defined broadly to include:
- Line scrambling at layer 1
- MACsec at layer 2
- IPsec at layer 3
- TLS at layer 4
All of these encryption methods require secrets to be installed on the device, such as:
- Pre-shared secret keys for symmetric encryption
- Private keys corresponding to the certificate of the device itself.
There may also be some material that must be protected from manipulation but which is not per-se secret, for example the certifates of the trusted root certificate authorities, the certificate of the device itself, etc.
My questions is: what is/are the standard way(s) for installing and managing (e.g. rolling over, revoking, etc.) these secret and sensitve materials on the devices?
An hour or so of Googling seems to indicate that the major network vendors universally seem to use the following approach:
(a) Secret keys are configured using the CLI (or management interface, e.g. NETCONF). They even show up in show config, albeit behind a very thin layer of obfuscation.
(b) Certificates are installed as local files, either copied using SFTP etc. or with a simple CLI front-end.
Is that indeed the state of the art?
Does any network equipment vendor support KMIP / PKCS #11 etc. to interoperate with a key management system (KMS) for key exchange and key management functions?