CHAPTER 3 HSM Initialization
2.
You cannot place the HSM in Secure Transport Mode (a form of controlled, intentional tamper).
You have the option to move one of the recovery pieces of the Master Tamper Key off-board, in the form of the Secure
Recovery Vector which gets imprinted on a purple Secure Recovery Key or SRK). If you choose to generate the SRK,
then:
3.
The HSM retains only one piece of the recovery data and does not recover the MTK automatically following a
tamper event, even after restart, until you provide the external piece (the purple key). This gives you control and
oversight over tamper events. Your personnel must be aware and must respond before the HSM is allowed to
recover from a tamper.
4.
With one of the pieces stored externally, you can set the HSM into Secure Transport Mode, and it can recover from
STM only when that purple PED Key is presented - this is what we do at the factory if you request that we ship in
STM. Then we ship you the purple key by a separate channel.
Before you can begin configuring and using the HSM, you must recover the SRK.
The SRK external secret is held on the purple SRK PED Key(s), shipped to you separately from the HSM.
With the Luna SA powered and connected to a Luna PED, and also connected to a computer having the Luna Client
software installed (using local serial connection, or ssh session over the network), log in as appliance 'admin'. Verify
that the HSM is in "Hardware tampered" or "Transport mode" state.
lunash:> hsm srk show
Secure Recovery State flags:
===============================
External split enabled: yes
SRK
resplit
1
required: no
Hardware tampered:
no
Transport mode: yes
Command Result : No Error
lunash:>
Recover the srk with the command
lunash:> hsm srk transportMode recover
Refer to the Luna PED and follow the prompts to insert the purple PED Key, enter responses on the PED keypad, etc.
During the process, a validation string is shown. You should have received your HSM's validation string by separate
mail. Compare that to the string that you see during SRK recovery. They should match. If so, acknowledge the match
when requested, and the recovery process concludes with the SRK recreated on the HSM.
When the SRK has been used to recover the MTK on the HSM, the HSM is still in zeroized state, but you can now
continue to the next configuration step, initializing the HSM.
Urgent SRK Action
As long as the SRK (purple PED Key) remains valid, it is tied to that HSM and there is risk if it is mishandled or lost. If
you do not need to have an external split (the SRV) of the MTK recovery key component, you should immediately
perform an
srk disable
operation to bring the external split back into the HSM. Do not overwrite (or lose) the purple
PED Key while it contains a valid SRV, unless you have copies.
Some security regimes require that the SRV remains external to the HSM, on an SRK (purple PED Key) to enforce
1
[ or "re-split" ] split the MTK secret into a new internal and external recovery vectors, and install the new external portion [the
Secure Recovery Vector or SRV] on a new purple PED Key - renders the previous SRV, and any external split of the previous
SRV on a purple (SRK) PED Key useless.
Luna SA Configuration Guide
Release 5.4.1 007-011136-007 Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
47
Содержание Luna SA
Страница 1: ...Luna SA Configuration Guide ...
