Sun Oracle Crypto Accelerator 6000 Board, User Manual

Page: 60 / 266

38 Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
scamgr
Secure Communication
The
scamgr
utility establishes an encrypted network connection (channel) between
the
scamgr
application and the Sun Crypto Accelerator 6000 firmware running on a
specific board. This point-to-point encrypted channel is not visible to any of the
other software components between
scamgr
and the device (for example, the
mca
device driver). This encrypted channel allows
scamgr
to run safely and securely
over the network. The key exchange is performed with RSA 1024-bit keys while the
bulk data is protected using AES-128. SHA1 HMACs provide data integrity for each
command data payload.
During setup of the encrypted channel, boards identify themselves by their
hardware serial ID address and an RSA public key. A trust database
(
$HOME/.sunw/sca/trustdb
) is created the first time
scamgr
connects to a board.
This file contains all of the boards that are currently trusted by the security officer.
When the firmware gives
scamgr
an RSA public key, a SHA-1 hash is taken on the
modulus. This action forms a key fingerprint that can be stored in a database in the
UNIX user's home directory. When a connection is made and an unrecognized key is
given to
scamgr
by the firmware,
scamgr
prompts the security officer to either
abort the connection, accept the key for this one session, or accept the key
permanently as a trusted key in the trust database. If a key to a previously trusted
card changes,
scamgr
offers the same choices except that when accepting the key as
a trusted key it overwrites the old key with the new one.
Note –
The Sun Crypto Accelerator 6000 board is preprogrammed with a unique
remote access key for connecting to an uninitialized board. The fingerprint for this
remote access key is printed on the board and must be verified when logging into a
board for the first time to ensure that a secure channel is established with the correct
board.
Initializing the Board With
scamgr
The first step in configuring a Sun Crypto Accelerator 6000 board is to initialize it.
There are two types of initialization. The first is board initialization and the second is
keystore initialization. When you first connect to an uninitialized board with
scamgr
, you are prompted to perform a board initialization, which creates a device
security officer (DSO) account. Once the board is initialized, you are prompted to
perform a keystore initiailiztion, which creates a keystore security officer (KSO)
account. For more information on DSOs and KSO, see
“Device and Keystore Security
Officers” on page 34 .