Sun Oracle Crypto Accelerator 6000 Board, Руководство пользователя

Страница: 106 / 266

84 Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
Each security officer must authenticate to the system with a user name and
password before entering a component. To ensure accuracy, each key component
must be entered twice. The UWK is an AES key and can be either 128, 192, or 256
bits in length. The length of the key is determined by the length of the first
component entered. Once the UWK is entered, it is used to wrap all subsequent USB
backup files.
The UWK is not required when not in FIPS mode, however, it can be always be
entered for added security. A new UWK can be entered at any time regardless of the
FIPS mode setting.
When restoring a card using a USB backup file for which a UWK was used, the
security officers are presented with a series of prompts that enable them to reenter
the required UWK components. Since the board is in an uninitialized state, each
security officer need not authenticate to the board before entering a component. The
following example shows the initialization of a board using the local interface and a
USB backup file for which the UWK was used.
Press <ENTER> to start
Initialization Options:
1. New keystore
2. Existing keystore
Selection (0 to exit)-> 2
Backup file: keystore
Wrapping key required
Number of components: 2
Component number 1:
Enter UWK component:
11111111111111111111111111111111
Verify UWK component:
11111111111111111111111111111111
Component number 2:
Enter UWK component:
22222222222222222222222222222222
Verify UWK component:
22222222222222222222222222222222
Password:
Board Restore:
-------------------------
File: /usb0/keystore
Keystore: ks.600002
Multi-Admin: No
-------------------------
Correct? (Y/N) [No]: y
Restoring data to crypto accelerator board.
Please be patient.
Initialization complete.
Key Fingerprint: c421-2fe8-00ff-1d03-97cf-9ff7-c7ff-d370-d074-
fd4a
Security Officer Login: