TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)
| Page 33
Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French),
Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten
www.zazooltd.com
4.4
Storage Master Key Migration
This functionality is NOT applicable on TSM500i HSMs with STS firmware.
This section relates to replacing an existing Storage Master Key (SMK) while maintaining all operational
keys in the system. For details on how to load an SMK for the first time or to load a new SMK without
maintaining operational keys, you should refer to Section 2.13.2.
WARNING:
Loading a Migration SMK causes the current SMK to be ERASED. This is true even if
the Migration SMK is never activated.
The current SMK must be reloaded after loading the Migration SMK and before key
translation.
TSM500i HSMs used in EFT, Key Management/Trusted Centres and Mobile Commerce systems have the
functionality to assist the customer in migrating keys encrypted under the current SMK to the new (migration)
SMK.
A summary of the process to perform a migration is listed below. More details are then provided in the
subsequent paragraphs.
1.
Backup your database by following the procedure provided by the vendor of the software that
drives the TSM500i
2.
Export the encrypted keys from the database to a CSV / Excel file
3.
Use Excel to make necessary format changes to ensure that you have only the fields as defined by
the key file format, see Appendix A for more details about the require format.
4.
Your current SMK must already be loaded into the TSM500i. Refer to Section 2.13.2 for details on
how to do this.
5.
Load the new SMK as the migration SMK, see 4.4.2 below. This process will DELETE the CURRENT
SMK.
6.
Reload the current SMK. See section 2.13.2.
7.
Translate (or migrate) the operational keys by uploading the file resulting from step 3 above, see
section 0 below.
8.
Take the output from step 6 and then reformat the file so that it can be imported into the database
9.
Import the file into the database
10.
Set the migration SMK as the active SMK
11.
To verify that the translation was successful, perform a test transaction to confirm that the
TSM500i can use at least one of the translated keys.
4.4.1
Select Migration Menu and Login
A KCED will need to be connected to the KCED port on the front panel of the TSM500i-NSS.
To perform key migration, use a Web Browser to access TSM-WEB (refer section 2.7). Select the “Migrate”
page from the left hand menu.
If not already in the Privileged state, the two Cryptographic Officers will be prompted to login.
