payShield 10K Installation and User Guide
©Thales Group
Page 303
All Rights Reserved
Load 'Old' LMK into Key Change Storage (LO)
Variant
Key Block
Online
Offline
Secure
Authorization:
Required
Activity:
admin.console
Command:
LO
Function:
To load an old LMK component set into Key Change Storage for use in
translations from old to new keys. Note that the current LMK must be installed
before an "old" LMK can be installed. Also note that it is possible to install a
Variant LMK as the "old" LMK, and with a Key Block LMK as the "new" LMK.
Authorization:
The HSM must be in the secure state to run this command. Additionally, the
HSM must be either in the Authorized State, or the activity
admin.console
must be authorized, using the Authorizing Officer cards of the specified LMK.
Inputs:
•
LMK identifier: 2 numeric digits.
•
Smartcards (RLMKs are supported) with old LMK components.
•
PINs for the Smartcards or passwords. PINs must be entered within 60
seconds of being requested.
Outputs:
•
Individual LMK Component check value(s).
•
Final LMK key check value.
Errors:
•
No LMK loaded – there is no LMK loaded in main memory.
•
Invalid LMK identifier – entered identifier out of range
•
Key Block LMK not permitted – it is not permitted to load a Key Block LMK
into key change storage if a variant LMK is loaded in main memory.
•
Load failed check comparison – card is blank.
•
Not a LMK card – card is not formatted for LMK or key storage.
•
Card not formatted – card is not formatted.
•
Smartcard error; command/return: 0003 – invalid PIN is entered.
•
Invalid PIN; re-enter – a PIN of less than 4 or greater than 8 is entered.
•
Command only allowed from Secure-Authorized – the HSM is not in Secure
State, or the HSM is not authorized to perform this operation, or both.
•
Invalid key – a standard Thales test key cannot be given live status.
•
Incompatible cards – the component cards have different formats.
•
Incompatible key status – the components have different status ("live" or
"test").
•
Invalid key - Multiple key components required – an attempt has been made
to load an LMK (other than a Test LMK) using a single component when the
security setting to enforce multiple components has been set to YES.
Notes:
•
For PCI HSM compliance, PINs and smartcards must be used to
authenticate the Security Officers.
•
Use of this command will always create an entry in the Audit Log.
•
It is not permitted to load a Key Block LMK into the "old" LMK slot of a Variant
LMK.
•
It is not permitted to load an AES Key Block LMK into the "old" LMK slot of a
3DES Key Block LMK.
•
If multiple LMKs are loaded on the HSM, each can have a corresponding
old LMK. The ID of the LMK being processed is defined in the command
input.
