Avaya 3050-VM, Руководство пользователя, Страница: 235 / 274

and the User must login before the second "Write Key Split" can be performed. The two iKey
tokens used for carrying key parts are labeled with the word "CODE". The two key parts are
then physically carried by separate trusted individuals to another device. If this device is also
an HSM, the two parts may loaded into it using the "Read Key Split" command. Similarly, this
command must be issued twice, once for the Security Officer and once for the User. Separate
authentications are required for each "Read Key Split" command. After the second "Read Key
Split " command has been successfully completed the destination device will contain the same
Key-Wrapping-Key as the originating device. Once two or more devices that contain the same
Key-Wrapping-Key, they are said to be in the same family. Devices in the same family may
share other secrets. Secrets are moved between devices under the control of a Rainbow
Technologies key management utility. The key management utility runs on the host, and uses
"Wrap Key" and "Unwrap" commands to move wrapped keys between devices in the same
family.
10.5 Key Destruction
Critical security parameters including plaintext private keys, symmetric keys and intermediate
values will be zeroized according to various conditions as described in
Table 9: Key
Destruction on page 235. It is also possible for the security officer to command the board to
un-initialize, which causes the data stored in RAM, FLASH and BBRAM to be erased.
Table 9: Key Destruction
Tamper
Detected
Voltage Applied Storage
Battery PCI BRAM RAM and Other Flash
NO YES YES Retained Retained Retained
NO YES NO Retained Erased Retained
NO NO YES Retained Retained Retained
NO NO NO Erased Erased Retained
YES YES YES Erased Erased Retained
YES YES NO Erased Erased Retained
YES NO YES Erased Erased Retained
YES NO NO Erased Erased Retained
10.6 Key Archiving
Under the control of the Rainbow Technologies key management utility, it is also possible to
archive keys. This may be done so that keys may be stored on backup media such as tape or
hard drives. The Rainbow Technologies key management utility utilizes the "Wrap Key"
10.0 Key Management
User Guide April 2013 235