nshield HSM On-Premise Key Generation for Microsoft RMS

Transcription

1 Thales e-security nshield HSM On-Premise Key Generation for Microsoft RMS Integration Guide for Windows Server 2008 R2 and 2012

2 Version: 1.1 Date: 14 October 2013 Copyright 2013 Thales e-security Limited. All rights reserved. Copyright in this document is the property of Thales e-security Limited. It is not to be reproduced, modified, adapted, published, translated in any material form (including storage in any medium by electronic means whether or not transiently or incidentally) in whole or in part nor disclosed to any third party without the prior written permission of Thales e-security Limited neither shall it be used otherwise than for the purpose for which it is supplied. Words and logos marked with or are trademarks of Thales e-security Limited or its affiliates in the EU and other countries. Information in this document is subject to change without notice. Thales e-security Limited makes no warranty of any kind with regard to this information, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Thales e-security Limited shall not be liable for errors contained herein or for incidental or consequential damages concerned with the furnishing, performance or use of this material. nshield HSM On-Premise Key Generation for Microsoft RMS 2

3 Contents Contents 3 Chapter 1: Introduction 4 Product configurations 4 Supported HSM functionality 5 Requirements 5 Chapter 2: Procedures 6 Installing the HSM 6 Installing the Security World Software and creating the Security World 6 Generating the tenant key 7 Transferring keys to Azure RMS 8 Internet addresses 9 nshield HSM On-Premise Key Generation for Microsoft RMS 3

4 Chapter 1: Introduction This guide describes how to use an on-premise (local) Thales nshield Hardware Security Module (HSM) to generate cryptographic keys, known as tenant keys, for use by Microsoft Rights Management services within Windows Azure (Windows Azure RMS). The instructions provide a step-by-step description on generating a tenant key on-premise, in line with your IT policies, which is then securely transferred to the cloud-based Thales nshield HSM hosted by Microsoft. The on-premise tenant key generation and subsequent online transfer process is known as RMS Bring Your Own Key (BYOK). This guide focuses exclusively on the on-premise key generation capability for Azure RMS. A companion Thales nshield HSM Microsoft AD RMS Integration Guide is also available from Thales. The guide describes how to set up and troubleshoot the Thales nshield HSM in an onpremise Active Directory Rights Management services (AD RMS) environment. After the on-premise Thales nshield HSM generates the tenant key, you use a Microsoft BYOK utility to create an upload package. A tenant administrator can then take that package and securely transfer the tenant key to Azure RMS. For more information, see the Microsoft RMS Tenant Key Lifecycle Management Guide. This guide assumes that you have read and are familiar with the Thales nshield documentation and setup. In support of Azure RMS, Thales nshield HSMs are used to: Generate and protect tenant keys within a FIPS compliant environment Enforce quorum control of administrator and operator access to the HSM Ensure that tenant keys are never exposed outside a trusted HSM boundary and cannot be exported when provided to Azure RMS Note: Throughout this guide, the term HSM refers to the Thales nshield Solo, nshield Connect, and nshield Edge products. Product configurations The integration between the Thales HSM and Azure RMS has been tested in the following configurations. Operating system Windows Server 2008 R2 Windows Server 2012 Security World Software version nshield Solo support nshield Connect support Yes Yes Yes Yes Yes Yes nshield Edge support For more information about OS compatibility, contact your Microsoft Sales representative or regional Thales Support representative. For Thales contact information, refer to the end of this guide. Additional documentation produced to support your Thales HSM is in the document directory of the CD-ROM or DVD-ROM included with the HSM. nshield HSM On-Premise Key Generation for Microsoft RMS 4

5 Chapter 1: Introduction Supported HSM functionality For the purpose of supporting the Microsoft BYOK utility, the following HSM functionality has been validated: Key generation Key ACL policy Module-only key K-of-N Operator Card Set (OCS) Key recovery Requirements Before beginning the key generation process familiarize yourself with the documentation and setup process for the Microsoft BYOK utility and the Thales HSM. For the HSM, you should clearly define and understand your organization s policies for: The number and quorum of trusted HSM administrative personnel The number and quorum of cards in the HSM Administrator Card Set (ACS) The number and quorum of cards in the OCS, if applicable Methods for securely storing and managing cards and pass phrases for the foreseeable future HSM Security World configuration and compliance, including FIPS and any other applicable standards Note: You can only recover an OCS-protected tenant key if both: Key recovery is enabled during initialization of the Security World A configured quorum of the ACS is available Therefore, it is important for your security policy to consider the safe storage and use of the ACS. nshield HSM On-Premise Key Generation for Microsoft RMS 5

6 Chapter 2: Procedures The installation and configuration procedures are: 1. Install the HSM. 2. Install the Security World Software and create the Security World. 3. Generate the tenant key. This chapter describes these procedures and provides examples for generating keys that are compliant with the Microsoft BYOK utility used by Azure RMS. Installing the HSM Install the Thales HSM using the instructions in the Quick Start Guide for the HSM. We recommend that you install the HSM before configuring the Security World Software. Installing the Security World Software and creating the Security World To install the Security World Software and create the Security World: 1. Install the latest version of the Security World Software as described in the User Guide for the HSM. Note: We recommend that you always uninstall any existing Security World Software before installing the new Security World Software. Thales provides a Cryptographic Service Provider (CSP) installation wizard that creates (initializes) a new Security World, loads an existing Security World, or sets up the modexp offload DLL. The CSP installation wizard also generates new OCSs and the setup parameters of the CSP. However, the installation wizard is not suitable for complex Security World setups. If you require more flexibility than the CSP installation wizard provides, use the new-world and createocs command-line utilities, or KeySafe, to create your Security World. For information on using these utilities, see the User Guide for the HSM. For example, to create a Security World using the new-world utility: a. Depending on your HSM, set it to the initialization or pre-initialization state. b. From the %NFAST_HOME%\bin folder, enter: new-world.exe --initialize --cipher-suite=dlf3072s256mrijndael -- module=1 --acs-quorum=k/n Where K/N is your required quorum (K) and number of cards (N) for the ACS. Security World files are created in the %NFAST_KMDATA%\local folder. 2. From the Start menu, run the CNG Configuration wizard. The ncipher CNG Providers Configuration Wizard appears. 3. Click Next. nshield HSM On-Premise Key Generation for Microsoft RMS 6

7 Chapter 2: Procedures 4. If no Security World exists: a. Select Create a new security world and click Next. b. Select the K-of-N for the ACS and the type of Security World. NIST recommends the use of SP a compliant AES. Choose a value for K and N that is appropriate for your organization s security policy. Choose whether you want to have a FIPS Level 3 Security World. If you do not select this option, the wizard creates a FIPS Level 2 Security World. For information on FIPS 140-2, see the User Guide for the HSM. c. Click Next. d. Leave the check box clear and click Next. Several wizard panels guide you through writing the ACS. e. When prompted, insert the blank smart cards into the HSM card reader and provide unique pass phrases for each card. We recommend you do not leave the pass phrases blank. f. Return the HSM to the operational state. g. Use the enquiry command-line utility to confirm the status of the HSM and Security World. Example output of the enquiry utility: Module #1: enquiry reply flags none enquiry reply level Six serial number XXXX-XXXX-XXXX mode operational version speed index 440 rec. queue level one flags Hardware HasTokens version string cam18 built on Sep :40:16 You have now completed initialization of the Security World. Note: It may take 1 2 minutes for the wizard to detect the HSM state change. h. Click Next. The Key Protection Setup panel appears. 5. Choose Module protection or Operator Card Set protection with K/N quorum with no pass phrase, and click Next. The CSP installation wizard appears. 6. Leave the checkbox blank and click Next. 7. Back up the Security World files located in the %NFAST_KMDATA%\local folder, and store the files, the ACS, and the ACS pass phrases securely. Ensure that no single person has access to more than one ACS card and pass phrase. You are now ready to use the Security World to generate the tenant key. Generating the tenant key To generate the tenant key, you can use either: The Security World Software command-line utilities. See the procedure below. The Microsoft BYOK utility. See the BYOK utility documentation. To generate a CNG tenant key using the Security World Software utilities: 1. Depending on the type of key, enter the following commands: nshield HSM On-Premise Key Generation for Microsoft RMS 7

8 Transferring keys to Azure RMS To generate a module-protected key, enter: generatekey --generate simple type=rsa size=2048 protect=module ident=contosokey plainname=contosokey nvram=no pubexp= cngimport --import M --key=contosokey --appname=simple contosokey To generate an OCS-protected key, enter: createocs -m 1 -Q K/N -N ocsname generatekey --generate simple type=rsa size=2048 protect=token cardset=ocsname ident=contosokey plainname=contosokey nvram=no pubexp= recovery=yes Where contosokey is your name for the key. Note: We recommend that you use 2048-bit RSA keys (RMS Cryptographic Mode 2). We do support 1024-bit RSA keys for existing AD RMS deployments where customers are migrating to Azure RMS. When migrating to Azure RMS, you must import the existing keys from AD RMS if you want Azure RMS to serve licenses for your existing content. You can also create a new key that is used to protect all future content. The length of the new key has no relation to the previous keys. We recommend 2048-bit keys for all new keys. A key token file is created in the %NFAST_KMDATA%\local folder with a name starting with key_caping_ followed by an SID, for example: key_caping_s c1a878c925fd9df4d62ba001b94701c039e2fb. This file contains an encrypted key. 2. Back up the key token file to a safe location. Transferring keys to Azure RMS The implementation of RMS BYOK can be carried out in two ways. You can transfer the keys to the Azure RMS HSM in person, during a key transfer ceremony, using the Thales key-xfer-im utility in Redmond, Washington, USA. Or you can transfer your key using a more convenient remote RMS BYOK mechanism, which will be available soon. The Security World technology of Thales HSMs enables a key to be securely transferred from one FIPS140-2 Security World to another FIPS140-2 Security World in Azure RMS. This requires the ACS from both Security Worlds. If you choose to do the key transfer in person, Azure RMS operators will meet your personnel in a Microsoft office in Redmond. For more information, see the Microsoft RMS Tenant Key Lifecycle Management Guide. In the near future, you will be able to perform the key transfer remotely. nshield HSM On-Premise Key Generation for Microsoft RMS 8

9 Internet addresses Web site: Support: Online documentation: International sales offices: Addresses and contact information for the main Thales e-security sales offices are provided at the bottom of the following page. nshield HSM On-Premise Key Generation for Microsoft RMS 9

10 About Thales e-security Thales e-security is a leading global provider of data encryption and cyber security solutions to the financial services, high technology manufacturing, government and technology sectors. With a 40-year track record of protecting corporate and government information, Thales solutions are used by four of the five largest energy and aerospace companies, 22 NATO countries, and they secure more than 80 percent of worldwide payment transactions. Thales e-security has offices in Australia, France, Hong Kong, Norway, United Kingdom and United States. For more information, visit Follow us on: