CHAPTER 1 Planning Your Configuration
being prompted to insert a key. If you say "Yes" to overwrite what the PED just told you is on this inserted key, the PED
gives you
another
chance to reconsider: "WARNING*** Are you sure...". The PED is very thorough about making sure
that you do not accidentally overwrite a useful authentication secret.
PED PIN
- At the point where it has been decided that you are not reusing key content, and you are or are not splitting
the new secret across multiple keys, and that you are absolutely certain that you wish to write a new secret on the
inserted key, the PED prompts you to type a PED PIN. The PED is about to write onto the key a secret that was just
generated by the HSM. If you simply press [Enter] on the PED keypad, without typing any digits, you are providing no
PED PIN, and the secret that goes onto the key is the secret as provided by the HSM. If you type any digits, before
pressing [Enter] (minimum of 4 digits), then the typed digits (the new PED PIN) are XOR'd with the secret from the
HSM, before the combined secret goes onto the PED Key. This means that the secret on the PED Key is not identical
to the secret from the HSM, so in future you must always type those PED PIN digits to reverse the XOR and present
the HSM with the secret it is expecting. With a PED PIN applied, the secret for that role is now two-factor - something
you have (the version of the secret that is imprinted on the key) and something you know (the secret that you type in, to
be XOR'd with the contained secret), to make the final secret that unlocks the HSM.
At this point, the key is imprinted. Now the PED inquires if you wish to duplicate the key you just made.
Duplicate
- in general, you should always have duplicate keys for each role (or duplicate M of N sets, per role, if you
chose to invoke the M of N split), so that you can have at least one off-site backup, and probably an on-site standby or
backup set as well. Your security and operational policies will dictate how many sets you need. When the PED prompts
to inquire if you wish to duplicate the current PED Key, you should be ready with the knowledge if you already have
enough copies of that secret or if you need to make more. The more you make, the more you must track. But you must
have enough to satisfy your organization's operational and security protocols.
The above paragraphs explain the meanings of each of the prompts that you would see from Luna PED while
performing an action (like initialization) that imprints PED Keys with secrets. The following sections discuss some
implications of the above choices for specific roles (PED Key colors).
HSM Initialization and the Blue SO PED Key
The first action that invokes Luna PED (which must be connected, as described in the Luna PED option section of the
hardware setup chapter) is HSM initialization.
When you initialize, you are creating an SO (security officer) identity and space on the HSM. In most cases, this is an
administrative position and the only keys or objects that are ever stored there are system keys, not user keys. The SO
sets policy for the overall HSM, and creates partitions.
When creating an access secret for the SO, you are creating a secret for an administrator who sets up the HSM and
then rarely is needed thereafter. You might have a single person who has the job of overseeing several HSMs, in which
case, only the first HSM creates a secret to imprint on a blue PED Key. The second, and all future HSMs to be
administered by that person (or role/job in your organization) would accept that secret from a provided blue PED Key,
rather than creating their own unique SO PED Keys. In that situation, you would choose to "Reuse an existing keyset"
when initializing every HSM after the first one.
Alternatively, you might have a very compartmentalized organization where a separate individual must have
administrative authority over each HSM, so in that case you would use blank blue keys each time you initialized a new
HSM, and each HSM would imprint its own uniquely generated SO secret onto a unique blue key. As well, you would
have the opportunity to apply PED PINs to any or all of the unique SO PED Keys.
Each person who is to act as SO for an HSM must be able to access the appropriate blue PED Key when needed.
Either they carry it with them, or they sign it out when they are using it and sign it back into a secure lockup. If PED
Luna SA Configuration Guide
Release 5.4.1 007-011136-007 Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
17
Содержание Luna SA
Страница 1: ...Luna SA Configuration Guide ...
