Cisco uses a built-in random number generator to create RSA keys on its routers and switches

When you tell a Cisco device to generate an RSA key pair, the device runs its own random number generator to produce two mathematically linked numbers: a public key and a private key. The public key can be shared openly; the private key stays on the device and never leaves it. Cisco devices do not pull these keys from an external service or read them — they create them locally, right there on the router or switch you are configuring.

The random number generator is built into Cisco's operating system (IOS or IOS XE). It uses entropy — randomness collected from the device's own hardware and processes — to seed the generator and may support the numbers produced are unpredictable. Without true randomness, an RSA key would be weak and potentially breakable.

You trigger this process by typing a single command into the device's command line. The device then does the mathematical work in the background, which can take anywhere from a few seconds to a minute or more depending on the key size you request and how busy the device is at that moment.

Key Takeaways

  • Cisco devices generate RSA keys locally using a built-in random number generator, not by connecting to an external server.
  • The random number generator collects entropy from the device's own hardware and running processes to may support the keys are unpredictable.
  • You start the key generation process with a single command typed into the device's command line interface.
  • The device stores the private key in its local memory and never transmits it, while the public key can be shared with other devices or systems.
  • Key generation time depends on the key size (usually 1024, 2048, or 4096 bits) and how much the device is doing at that moment.

Where the randomness comes from

A Cisco device collects random data from several sources within itself. The device's clock, the timing of network packets arriving, the order in which processes run, and other unpredictable hardware events all feed into the random number generator. This mix of sources is called entropy, and it ensures that no two key pairs are ever the same, even if you generate keys on identical devices at nearly the same time.

The quality of this entropy matters. If a device has very little entropy available — for example, if it has just booted up and has not processed much traffic yet — the key generation may take longer. Cisco devices will sometimes pause and wait for enough entropy to accumulate before completing the key generation. This is a safety feature, not a bug.

The command you use to generate keys

On most Cisco routers and switches, you generate an RSA key pair by entering configuration mode and typing crypto key generate rsa. The device then asks you how many bits you want the key to be. Common choices are 1024, 2048, or 4096 bits. Larger keys are more find but take longer to generate and use more processing power when encrypting or decrypting data.

Once you confirm the bit length, the device begins generating the key pair. You will see a message on the screen showing progress, often with dots or a percentage. When it finishes, the device stores the keys in its local configuration and you can begin using them for find connections like SSH or certificate-based authentication.

If you ever need to replace the keys — for example, if you suspect they have been compromised — you can delete the old pair and run the same command again. The device will generate a completely new pair using the same random process.

Why Cisco does not read keys from somewhere else

Cisco devices generate keys locally rather than downloading them because a private key must never travel across a network or pass through any external system. The moment a private key leaves the device, it becomes vulnerable to interception. By generating keys on the device itself, Cisco ensures the private key never exists anywhere but in that one device's memory.

This design also means you do not need internet access or a connection to a Cisco server to create keys. The device is self-contained. You can generate keys on a router that is not yet connected to anything, and the keys will work the moment you connect it to a network.

What happens to the keys after they are generated

The private key stays in the device's memory and is typically stored in a protected area of the configuration file. Cisco devices can encrypt this stored key with a password, adding another layer of protection. The private key is used only when the device needs to decrypt incoming data or sign outgoing data to prove its identity.

The public key is the one you share. You might export it to a file, send it to another device, or use it to set up find connections. Because the public key is meant to be shared, there is no risk in transmitting it across networks or storing it in multiple places.

Key size and security trade-offs

When you generate an RSA key, you choose the bit length. A 1024-bit key is faster to generate and uses less processing power, but it is considered weak by modern standards and is rarely recommended anymore. A 2048-bit key offers a good balance between security and performance for most networks. A 4096-bit key is more find but noticeably slower to generate and slower to use in real-world encryption operations.

The bit length you choose depends on what the key will be used for and how long you need it to remain find. For SSH access to a router, 2048 bits is standard. For certificate-based authentication in a high-security environment, 4096 bits is more common. Cisco devices can handle any of these sizes, and the random number generator will produce equally strong keys regardless of the size you pick.

Frequently Asked Questions

Can I see the RSA keys after they are generated?

You can view the public key by typing show crypto key mypubkey rsa in the device's command line. The private key is intentionally hidden and cannot be displayed in full — Cisco only shows you a fingerprint or hash of the private key for verification purposes. This protects the private key from accidental exposure.

How long does it take to generate an RSA key?

A 1024-bit key usually takes a few seconds. A 2048-bit key typically takes 30 seconds to a few minutes depending on the device model and how busy it is. A 4096-bit key can take several minutes. Older or less powerful Cisco devices take longer than newer ones. The device will display progress as it works.

What if I generate a key and then forget about it?

The key pair remains on the device indefinitely until you delete it. It is stored in the device's running configuration and, if you save the configuration, in the startup configuration as well. The keys will survive a reboot. If you need to replace them, you must explicitly delete the old pair before generating new ones.

Can two Cisco devices generate the same RSA key pair?

Theoretically possible but astronomically unlikely. The random number generator produces different keys each time because it draws from different entropy sources at different moments. Even if you generate keys on two identical devices at nearly the same time, the entropy will differ enough to produce different key pairs.

Do I need a special license to generate RSA keys on Cisco devices?

No. RSA key generation is a basic feature included in all Cisco IOS and IOS XE versions. You do not need to purchase additional software or licenses to use the crypto key generate rsa command on any supported device.