Deleting ECDSA and RSA Key Pairs

You can delete both ECDSA and RSA key pairs with the crypto key zeroize command, or you can specify a key pair to be deleted. When a host key is deleted, it is deleted from the flash memory of all management modules. If all key pairs are removed from the flash memory, SSH will get disabled.

Note: The crypto key zeroize command, with or without the key pair specified, will kill all the active ssh connections irrespective of the host key pair (ec or rsa) used to establish the sessions. After you use the crypto key zeroize command, RUCKUS recommends that you reestablish the ssh session with the configured host key.

To delete both ECDSA and RSA key pairs from the flash memory, complete the following steps.

Enter global configuration mode.
```
device# configure terminal
```

Delete both ECDSA and RSA key pairs from the flash memory.
```
device(config)# crypto key zeroize
```
You can also specify a key pair if you want to delete only a particular key pair.
To delete the RSA host key pair from flash memory, enter the following command.
```
device(config)# crypto key zeroize rsa
```
To delete the ECDSA host key pair from flash memory, enter the following command.
```
device(config)# crypto key zeroize ec
```

The following example shows the steps to generate an ECDSA key pair, make an inbound connection from VM (Linux) to the device using ECDSA 384 bit, and delete the keys.

Generate an ECDSA key pair.
```
device(config)# crypto key generate ec size 384
```

After the key is generated successfully, make an outbound connection from VM (Linux) to the device with configured local user or remote user.
1. Connect to the Management IP.
```
root@iaas-l-82:~# ssh -o HostKeyAlgorithms=ecdsa-sha2-nistp384 super@10.176.156.48
Password:
SSH@ICX7250-24 Router>
```
2. Connect to the Management IP.
```
root@iaas-l-82:~# ssh -o HostKeyAlgorithms=ecdsa-sha2-nistp384 super@10.176.156.48
Password:
~ #
```

Delete all host key pairs.
```
device(config)# crypto key zeroize
```

RUCKUS FastIron Security Configuration Guide, 09.0.10 53-1005727-25

Deleting ECDSA and RSA Key Pairs