Curtiss-Wright DTS1, Руководство пользователя

Страница: 33 / 140

User Guide DDOC0099-000-AH
DTS1 CSfC 5 - 3 Encryption
© 2020 Curtiss-Wright Defense Solutions
Revision 6.0
Key.............................................This term is used in the context of the RMC module, referring to
the DEK and PSK or EDEK and MAC. The singular form key
applies to all keys required by the RMC module.
DEK ........................................... Data Encryption Key in plain text.
EDEK......................................... Encrypted DEK is a DEK that is encrypted or wrapped.
PSK............................................ Pre-Shared Key is a common key between the user workstation
and the DTS1 crypto module, allowing each to read the
encryption of the other.
KEK............................................ Key Encryption Key is the key used to create the EDEK.
MAC........................................... Message Authentication Code is a value used to validate
messages carrying a key.
CM .............................................Crypto Module is the circuitry in the DTS1 that manages
encryption keys and uses them to encrypt/decrypt data.
Install ......................................... Sending the key from the user’s workstation to the encryption
chip serving a specified RMC module slot.
Save........................................... Store a key to the CM memory.
Load........................................... Move (copy) the saved key from the CM memory to the
encryption chip serving a specified RMC module slot.
Unload ....................................... Removal of the key from the CM encryption chip.
Delete ........................................Removal of the key from the CM memory.
5.3 Hardware Layer Encryption
5.3.1 Initialize / Login - Crypto Module
NOTE
[
username
] and [
password
] are selected and entered by the user.
• User name (-u) requirement is 1-15 characters in length.
• Password (-p) requirement: see paragraph 5.1.1
Hardware Layer Passwords
for
requirements.
1. Obtain user token.
Command:
cmlogin -u
[username]
-p - I
Example
NOTE
Decrypting the user token requires a 3rd-party AES256 key-unwrapping algorithm and the PSK.
2. Decrypt user token.
3. Generate challenge.
Command:
cmlogin -u
[username]
-p -L
cw_dts>
cmlogin
-u [username] -p -I
[cmlogin]
Please enter password:
[password]
Please verify password:
[password]
CMLOGIN: action=init status=OK
USER_TOKEN=[Generated random string 80 characters (40 bytes Hex) long]
TOKEN_HMAC=[Generated random string 96 characters (48 bytes Hex) long]
PSK=[Curtiss-Wright provided. 64 f’s will be shown in place of the actual PSK]
[!cmlogin] OK