Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 167 / 564

Managing Shared Keys
145
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.decrypt=true
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.derive=false
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.encrypt=false
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.private=true
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.sensitive=true
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.sign=false
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.signRecover=false
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.token=true
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.unwrap=true
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.verify=false
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.verifyRecover=false
op.enroll. userKeyTemporary .keyGen.encryption.private.keyCapabilities.wrap=false
op.enroll. userKeyTemporary .keyGen.encryption.privateKeyAttrId=k4
op.enroll. userKeyTemporary .keyGen.encryption.privateKeyNumber=4
... snip ...
5.6. Managing Shared Keys
The Token Key Service (TKS)
derives
keys for the TPS to use. TKS keys process key material sent
from the user, the token CUID, an agreed on algorithm, and a public key to recombine a key that
exists on the token (that is why the keys are
derived
rather than generated). These derived keys both
encrypt sessions between the TPS and the Enterprise Security Client and generate keys for the token
enrollment.
Part of the way that the TKS derives these keys is by using a common
master key
that is known to the
TKS and existent on each of the smart cards or tokens. New master keys can be generated, stored
in the TKS, and transported to the smart cards or additional HSM key stores to be used for token
management operations using the
tkstool
command.
Managing master keys is described in this section.
•
Section 5.6.1, “Generating Master Keys”
•
Section 5.6.2, “Generating and Transporting Wrapped Master Keys”
•
Section 5.6.3, “Using HSM for Generating Keys”
•
Section 5.6.4, “Updating Master Key Versions and Associating the Master Key with Its Version”
•
Section 5.6.5, “Configuring Symmetric Key Changeover”
5.6.1. Generating Master Keys
Generate a master key is used as part of the algorithm to derive other keys on tokens and smart
cards. New master keys can be generated on the TKS using the
tkstool
utility.
1. Get the PIN to use to access the TKS's security databases. The
internal
PIN is the one used
for the security databases.
cat /var/lib/pki-tks/conf/password.conf
internal=649713464822
internaldb=secret12
replicationdb=-752230707
2. Open the TKS instance
alias/
directory.