User Guide
DDOC0108-000-A2
CNS4 CSfC
6 - 13
Operation
Revision 1.0
6.4.2.2
Internal Security Mode
The DEK is generated by the ILE's RNG to create a 256-bit DEK. It is stored in the ILE EEPROM,
SRAM, or not stored per the user's selection at login. The not stored selection requires a new DEK
be generated at each power-on cycle.
Advantages:
•
Requires less effort on the user's part.
•
Creates a DEK known and stored exclusively by the ILE.
Disadvantages:
•
Stored data lost if ILE is zeroized.
6.4.2.3
External Security Mode
In the External Security Mode the user is required to use their host computer to create four DEKs,
along with their corresponding Message Authentication Code (MAC). It is recommended that the
user utilize software that allows the entry or generation of DEKs (32 bytes long, plus an 8-byte
Initialization Vector, terminated with pressing E
NTER
key) using an AES-ECB-256 key wrap
encryption algorithm and generates the corresponding MAC (32 bytes) using an HMACSHA-256
algorithm.
The software should also handle the transmission of each of the four required DEK packages
(DEK of 64 ASCII hex characters, plus an Initialization Vector of 16 ASCII hex characters,
terminated with pressing E
NTER
key). The initialization vector provides the required information to
unwrap the package and extract the KEK. The DEKs are stored in the EEPROM or SRAM, or
None (not stored on the ILE) per the user's selection at login. The None selection retains the DEK
on the host.
Advantages:
•
Stored data retained / accessible if ILE is zeroized (as long as DEK has been retained).
•
Creates a custom DEK created and known by the user.
Disadvantages:
•
Requires more effort on the user's part.
6.4.2.4
ILE Account Creation
NOTE
The ILE must be zeroized to change the hardware layer password.
NOTE
The first account created on the ILE is always the administrator / crypto officer account. Four
additional user accounts can be created as well.
After the CNS4 has been initially configured, the administrator / crypto officer may create up to four
additional user accounts using the cm_create_account command. The accounts must comply with
the following considerations.
•
User name
•
Composed by the user
•
Must be 16 characters maximum, 8 characters minimum.
•
Password
•
Composed by the user
•
Must be 8 to 64 character
•
Must contain at least one number
•
Must have one upper and one lower case letter
•
Cannot contain symbols.
•
Mode. The mode will be either internal or external. See Security Mode above.
•
Transfer. If external mode is selected, the DEK can be either plain text or encrypted using
another key (referred to as Key Encryption Key [KEK]). Use of a KEK provides extra security
when the DEK is transferred.
•
Storage. Where the key will be stored; None (not stored), EEPROM or SRAM.
