Image 43: Secure Auditing with HSM
IDENTIKEY Appliance will request a signature from the HSM for each epoch, and this will be used as an epoch ID.
An epoch keypair will be generated, consisting of an epoch public key and an epoch private key. Each Secure Audit
entry will contain the epoch public key, the epoch ID and an cryptographic signature which relates it to the previous
and subsequent entries.
To verify each Secure Audit entry, the Secure Auditing Verification Tool uses the following:
n
The epoch public key
n
The epoch ID (supplied on each secure audit line)
n
The master audit public key which has been exported to a
.pem
file.
The entire file will be verified with a
Yes
(verification successful) or
No
(verification unsuccessful) result provided
after verification.
13.3.1. Secure Auditing with SafeNet
The ctcert tool provided with SafeNet software is used to apply the required configuration to the HSM for Secure
Auditing. Refer to the
ProtectToolkit C Administration Guide
supplied with the HSM for more details and further
options for ctcert.
To enable Secure Auditing on the HSM, the Master Audit keypair must be created. Use ctcert to create the Master
Audit Keypair and then export the public certificate from the device.
A Master Audit keypair requires an attributes file. This file contains details of the issuer, subject, and key usage for
this certificate. The minimum key usage required is:
keyusage { digitalSignature, nonRepudiation }
The following is an example of the contents of an attributes file.
Example
label { MasterAuditCertificate }
serialnumber { 1234 }
issuer {
CN=MasterAudit,
OU=Identikey,
O=VASCO,
C=US
13. Hardware Security Module
IDENTIKEY Appliance 3.11.12 - Installation and Maintenance Guide
80
