Ultra Electronics AEP Networks Ltd Ultra Safe Keyper

Transcription

1 RSA Secured Implementation Guide For 3rd Party PKI Applications Last Modified: February 12 th, 2013 Partner Information Product Information Partner Name Ultra Electronics AEP Networks Ltd Web Site Product Name Version & Platform Appliance version 2 Product Description The Hardware Security Module (HSM) offers the next generation security platform for managing cryptographic keys and protecting sensitive applications. It is a hardware security module designed for managing mission critical applications that demand maximum security. It is ideally suited for companies that need secure key management for certification authorities, registration authorities, OCSP responders, smart card issuers, web servers and other applications. Keyper allows the FIPScertified Security Officer and authorized user to generate, store and use high quality keys within a tamper reactive, Ethernet-connected HSM.

2 Solution Summary Ultra Electronics AEP Networks has designed the Keyper range of HSMs to provide the ultimate level of protection for the most sensitive data and information systems. At the heart of Keyper is AEP Networks revolutionary ACCE technology. ACCE is the next generation flexible crypto platform that provides the highest level of assurance FIPS 140-2, Level 4. Based on this core technology, AEP Networks has built a product range to cater to the PKI, VPN and Internet security markets. The Keyper HSM is ideally suited to businesses deploying a cryptographic system where the protection of cryptographic keys is a priority, for example, in organizations requiring certificate signing, code or document signing, bulk generation or ciphering of keys or data. Unlike other HSMs, the AEP Networks Keyper does not require another device to be connected in order to carry out key management tasks. All management activity is carried out using the built-in LCD, keypad and smart card reader. All key management requires two security officers to be present each with their own smart card and PIN number. AEP Networks load balancing functionality allows keys to be automatically and securely distributed between Keyper s regardless of whether they are local to each other or are distributed across multiple sites, this distribution of keys is transparent to the application using the keys

3 Product Configuration Before You Begin This section provides instructions for configuring the with RSA Certificate Manager. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All Ultra Safe / AEP Networks components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. Initializing the The must be initialized before it can be used with RSA Certificate Manager. Refer to the AEP Keyper 2 with PKCS#11 Installation, Upgrade and Troubleshooting Guide, section Configuring the Keyper HSM for the First Time for details of how to install and initialize the unit; this involves creating Security Officer Smart Cards and establishing a key backup policy. Once the Ultra Safe Keyper is set running, it must be set to Operational State by Security Officers before continuing. Installing and Configuring PKCS#11 Provider To install and configure the PKCS#11 Provider following the detailed steps in the AEP Keyper 2 with PKCS#11 Installation, Upgrade and Troubleshooting Guide, section Installing the PKCS#11 Provider. Follow the steps for your current platform. The result of the installation is the shared library (e.g. pkcs11.linux_i32.so.5.01 or bp201w32hsm.dll) and utilities displaytoken and inittoken installed in /opt/keyper/pkcs11provider directory on Linux/Solaris or %USERPROFILE%\Keyper\PKCS11Provider on Windows

4 After configured, execute the Keyper utility displaytoken (e.g. /opt/keyper/pkcs11provider/displaytoken). This utility should display a similar output as shown below with at least one slot available on the HSM. Display Token for Linux rev Built on Fri_Aug_24_12:25:37_BST_2012 Copyright (c) Ultra Electronics AEP Networks Ltd 2012 Loading /usr/local/lib/pkcs11.so... Failed so trying /usr/local/lib/pkcs11.linux_gcc_4_1_2_glibc_2_5_i386.so Failed so trying /opt/keyper/pkcs11provider/pkcs11.so... Shared library loaded PKCS11 API v:2.11 Manufacturer ID:Ultra Electronics AEP Networks 1 slots found The slots that are available are between 0 and 0 Enter the slot number :0 PKCS11 Slot : 0 PKCS11 Label : RCM Keyper Model : Keyper Pro 0405 Keyper Serial : Kxxxx50 Keyper version : 2.0 App : 020 ABL : 029 AL : 02 Important: Do not continue with the RSA Certificate Manager installation until the displaytoken utility is showing at least 1 selectable slot available. For more information, please consult the documentation. RSA Certificate Manager Installation The RSA Certificate Manager Server must be installed on the same computer as the PKCS#11 Provider. The crypto provider is added to RSA Certificate Manager after installation is complete. Important: RSA Certificate Manager will not install properly if trying to add the Ultra Safe AEP Keyper PKCS#11 crypto provider during the installation. 1. Install RSA Certificate Manager to the same machine that contains the Ultra Safe AEP Keyper PKCS#11 Provider. Follow instructions as described in the RSA Certificate Manager Installation Guide. 2. Once installed and configured, stop the RSA Certificate Manager services. 3. Modify the existing line in the /<installed-dir>/xudad/conf/xudad.conf file to specify the location of the Ultra Safe AEP Keyper library. on Windows: crypto_providers pkcs11v2,c:\windows\system32\bp201w32hsm.dll on Solaris / Linux: crypto_providers pkcs11v2,/opt/keyper/pkcs11provider/pkcs11.so - 4 -

5 4. Modify the existing line in the /<installed-dir>/ WebServer/conf/server.conf file to specify the location of the AEP Keyper library. on Windows: crypto_providers = pkcs11v2,c:\windows\system32\bp201w32hsm.dll on Solaris / Linux: crypto_providers = pkcs11v2,/opt/keyper/pkcs11provider/pkcs11.so 5. Start the RSA Certificate Manager Services and enter the passphrase for the Ultra Safe AEP Keyper so that RSA Certificate Manager can access the HSM. When creating a new CA within the RSA Certificate Manager, select the Ultra Electronics AEP Networks Signing Algorithm and Key Size. Selecting one of the radio buttons for Ultra Electronics AEP Networks will configure RSA Certificate Manager to use the HSM as its cryptographic provider

6 After selecting the Ultra Electronics AEP Networks Signing Algorithm and Key Size, select the appropriate slot number for storing keys. Important: When selecting the Slot number to use for the CA, increment the slot number you want to use by +1. For example, during the configuration in this guide, Slot 0 was initialized on the Ultra Safe AEP Keyper HSM. Therefore, enter 1 in the Hardware Key Generation Slot number box as shown below

7 Certification Checklist for 3 rd Party Applications Date Tested: February 12 th, 2013 Certification Environment Product Version Information Operating System RSA Certificate Manager 6.9 (Build 554) Redhat Linux Enterprise Appliance 2r0 Appliance PKCS#11 Library 5.1 Redhat Linux Enterprise 5.5 Test Case Result Certificate Authorities (CAs) Create Self-Signed CA Create Sub CA Create RSA-SHA1 CAs with different key sizes (1024, 2048, 4096) / / Create RSA-SHA256 CAs with different key sizes (1024, 2048, 4096) / / Create RSA-SHA384 CAs with different key sizes (1024, 2048, 4096) / / Create RSA-SHA512 CAs with different key sizes (1024, 2048, 4096) / / Create DSA-SHA1 CAs with different key sizes (512, 1024, 2048) / / Create RSAPSS-SHA1 CAs with different key sizes (1024, 2048, 4096) / / Create ECCP-SHA1 CAs with different key sizes (256, 384, 521) N/A* Create ECCP-SHA256 CAs with different key sizes (256, 384, 521) N/A* Create ECCP-SHA384 CAs with different key sizes (256, 384, 521) N/A* Create ECCP-SHA512 CAs with different key sizes (256, 384, 521) N/A* PIN Prompt Modes Enter PIN at startup Do not enter PIN at startup setpin directive in xudad.conf Token Operations Verify CA Key Test JJO / PAR = Pass = Fail N/A = Non-Available Function *ECCP is not supported on the 9720 Appliance - 7 -

8 Known Issues Creating a CA with a DSA-SHA1 key size of 512 will fail with the following error message: The HSM only supports a DSA-SHA1 key size of 1024 or