TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)
| Page 19
Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French),
Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten
www.zazooltd.com
2.8.2
Authenticate HSM - Request Step
On the
TSM Operators
page click on “Authenticate HSM and Set Initial Passwords” tab.
Select “Request” from the “Action” drop down menu. Click on
REQUEST
.
Write the “Expected Response” down and keep this safe. It will be of the form “ER12345678”.
Copy the “Token” into the text file. The token will comprise 112 ascii-hex characters.
Send the “Token” (Device Authentication Token) to Prism (the Manufacturer) so that the HSM can be
authenticated before control is transferred to the Customer.
In the same email, provide the manufacturer with the names and email addresses of the two crypto
officers that will be established during the ‘FINALIZE’ step of this process. This information should be
provided on a company letterhead. Sample wording for the request is provided in a template on the
support CD that is provided with the HSM.
Having issued the Request and sent the token to the Manufacturer, DO NOT initiate the Request
step again prior to completing the Finalize step detailed below. Authenticating the HSM uses a
challenge-response mechanism. The Finalize step will only work if it is in response to the last
challenge issued.
2.8.3
Authenticate HSM - Finalise Step
To perform this operation you must have completed the Request step and received the necessary
response from the Manufacturer (Prism). The tokens will be emailed individually to the 2 officers
identified in the Request step.
Both officers need to be present simultaneously to complete this step.
Confirm that both crypto officers have received their Control Transfer Tokens from the Manufacturer.
Confirm that the Expected Response that was returned by the Manufacturer matches the expected
response that was recorded in the first step.
Select “Finalise” from the “Action” drop down menu.
Ensure that the KCED is attached to the appropriate port of the HSM before proceeding.
Whenever the KCED is connected to the HSM, the Cryptographic Officers must inspect the HSM, the
externally connected device, and the inter-connecting cable for any signs of tampering or insertion
of a bugging device.
Officer 1 will be required to enter their name and token. The token will be of the form “0187654321”
Officer 2 will be required to enter their name and token. The token will be of the form “0287654321”
Click on
FINALISE
.
Officer 1 will be required to enter and confirm their password via the KCED.
Make a record of the
password and keep in a safe place
.
Officer 2 will be required to enter and confirm their password via the KCED.
Make a record of the
password and keep in a safe place
.
A password must be at least 7 digits in length, using digits in the range 0 to 9.
