User Guide
DDOC0108-000-A2
CNS4 CSfC
11 - 5
Command Line Interface
Revision 0.0
11.2.4
cm_key
Syntax:
cm_key [ -h | --help ] | [ -v | --version ]
cm_key [ -k | --kek ] | [ -a | --kekAck ] | [ -r | --resetKek ] | [ -z | --zero ] | [ --zero-psk ]
cm_key [ -s <int> | --slot <int> ] & [ -e <hex> | --edek <hex> ] & [ -m <hex> | --hmac <hex> ]
cm_key [ -s <int> | --slot <int> ] & [ -d <hex> | --dek <hex> ] & [ -p <hex> | --psk <hex> ]
cm_key [ --userpsk <hex> ]
Description:
The cm_key command provides the user the ability to inject DEKs into the ILE, zeroize the DEKs
or PSK, and change the PSK. The crypto officer is the only entity that has permission to inject or
change a DEK. It is to be noted that only one slot option can be chosen per transaction.
Options:
-h, --help.............................. Help
-v, --version ......................... Show version information
Encrypted Key Operation Options
-k, --kek ............................... Generates an encrypted KEK (key encryption key) and an HMAC
-a, --kekAck......................... Sets the key used to encrypt KEK to previously used key. Must be
used after HMAC has been verified and the KEK decrypted
-e, --edek <hex>.................. Encrypted DEK (data encryption key) 40 byte value represented by
80 hex characters
-m, --hmac <hex>................ MAC (message authentication code) 32 byte value represented by 64
hex characters
Plaintext Operation Options
-d, --dek <hex>................... Plaintext DEK (data encryption key) 32 byte value represented by 64
hex characters
-p, --psk <hex>................... Plaintext PSK (pre-shared key) 32 byte value represented by 64 hex
characters
Options used for both key generation methods
-r, --resetKek ....................... Resets key used to encrypt KEK to PSK
-s, --slot <int> ...................... Encryptor selector. Select either slot 0,1,2,3, or all. Only one
encryptor can be specified per transaction
-z, --zero.............................. Zeroize Crypto Module
--zero-psk ............................ Zeroize System Storage. This option will restore the ILE back to a
pre-manufacturing state making it inoperable. Will prompt user prior
to performing the erase
--userpsk <hex> .................. Changes current PSK to a user supplied PSK.User must supply
current PSK in conjunction (-p option)
Example 1.
Using Encrypted Key Operation - Request a Key Encryption Key (for external key passing method
only)
Example 2.
Send a KEK Acknowledge to the FIPS Encryptor after the HMAC has been verified and KEK has been
decrypted
cns> cm_key -k
[cm_key]
status=OK
[!cm_key]
cns>
cm_key -a
[cm_key]
status=OK
[!cm_key]
