TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)
| Page 26
Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French),
Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten
www.zazooltd.com
2.13.2
Loading SMK components
The TSM500i requires two Cryptographic Officers to authenticate themselves to the HSM to permit
the loading of an SMK
.
Key loading should take place according to established security procedures, and is usually witnessed
by an auditor
.
The SMK must be generated and stored in the form of components, which are split between two or more
trusted custodians. When the HSM is first commissioned (or after a Tamper event has been reset) the SMK
must be loaded into the HSM.
Key Spaces are used in some environments to establish key variants for exchanging keys between disparate
systems. System documentation should indicate when special Key Space configurations are required.
All HSMs that use the same key database (i.e. HSMs in a load balancing or fault tolerant configuration) must
have the same SMK and Key Space configuration.
Before proceeding, refer to the
KCED Installation and User Guide
for details on how to use the Key Component
Entry Device (KCED).
Procedure:
Click on the
TSM Management
page
Two cryptographic officers must login using the KCED in order to enter the
AC:Privileged
mode. To login click
Login
on the
TSM management
page.
The
TSM management
page will reload after the cryptographic officers have successfully
logged in to the TSM500i. Select the tab labelled “Load Storage Master Key (SMK)” on this
page.
Note that this tab will not be available if the current TSM state is not AC:PRIVILEGED.
Select the number of components from the drop down menu labelled “Components”
Select an appropriate algorithm type and key size from the drop down menu labelled
“Algorithm”. An AES-KB SMK is recommended.
Click on
Load SMK
.
A confirmation page should be displayed. To continue click on
Yes, load SMK
Follow the on-screen instructions on the
KCED
display (NOT on TSM-WEB) to enter the SMK.
Although the TSM500i HSM will revert to the Operational state after a period of time (as
determined by the firmware license type and detailed in the Security Policy), the HSM should be
set back to the
AC:Operational
mode after loading an SMK to prevent it from staying in a
Privileged state once the Crypto Officers have completed this procedure.
