CHAPTER 1 Planning Your Configuration
•
appliance admin
(Same as appliance admin description above. No change.)
•
HSM Admin
(Same as HSM Admin description above. No change.)
•
Crypto Officer
(full Read-Write access)
(same capabilities as HSM Partition Owner and Client in the default model)
As above for HSM Partition Owner, except that two separate Passwords can now (optionally) be associated with
the black PED Key. In both cases, the black PED Key must be presented, and the administrator at the lunash
command-line can:
–
modify partition policies
–
activate a partition for use by Clients
–
backup and restore Partition contents
The Partition Password is presented when a Client application needs to use the Partition. In this model, there are
two Passwords. The Crypto Officer Partition Password allows the Client to perform any crypto-graphic operation,
both manipulation (generation, deletion, wrap/unwrap), and use (encrypt/decrypt, sign/verify).
The other password is used (along with the black PED Key) for the Crypto User. This is set by the HSM Admin
when the Partition is created.
In operation, the Crypto Officer would log in at the management interface prompt for Partition maintenance tasks,
and/or
a Client application could connect to a registered Partition (authenticating with the Crypto Officer Password) in
order to generate and manipulate cryptographic objects in the Partition.
•
Crypto User
(or restricted Client user - Read-only)
If the Partition has been readied for access by the black PED Key, a Client can connect with a Client application,
authenticating with the Crypto User Password (a challenge secret, generated on command by the Luna PED,
similar to the Crypto Officer or Partition Owner Password that is generated on the Luna PED when a Partition is
created).
The Crypto User Client can then make use of cryptographic materials already in the Partition (signing, verifying,
encrypting, decrypting), but cannot manipulate those objects (no generating or deleting or wrapping/unwrapping).
This distinction differs from the old model, with just the one Partition Password, where Client users could not be
restricted from generating and deleting keys and certificates.
Either model can be used. If you work in an environment that mandates the Crypto Officer / Crypto User distinction, it is
available. If you have no need of the additional password, or if you have legacy applications that use the standard
Cryptoki roles, then simply do not activate the Crypto Officer / Crypto User roles.
How the Roles are Invoked
By default, the Crypto User role does not exist, and so the black PED Key owner is HSM Partition Owner. You create a
Crypto User (the restricted Client user) with the "partition createUser" command.
Luna SA Configuration Guide
Release 5.4.1 007-011136-007 Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
14
