Create an Operator Service Key Store in an HSM
This section shows how to configure vSEC:CMS to use the HSM for the Operator Service Key Store (OSKS). This process also migrates the master key stored on the System Owner (SO) token to the HSM.
Perform the following tasks on the Operator Console:
Start the vSEC:CMS Admin application.
When prompted, insert your System Owner (SO) hardware credential.
Enter the operator passcode for the System Owner and select [ Authenticate ].
If the authentication succeeds, the Admin application starts and logs you into the Operator Console.
In the navigation menu, select Options > Operators.
Select [ Add service key store ].
In the Add Service Key Store (HSM) dialog, select the PKCS #11 library in the Key store drop-down list, specify a Store name, and select [ Add ].
Enter the operator passcode for the System Owner, and select [ OK ].
Upon success, the system creates the new service key store, and the master keys will be stored on the HSM. You should see the message shown below, confirming that the operation was successful:
Now, all administration key operations performed with the vSEC:CMS, such as registering a smart card token or PIN unblock operations, use the master keys stored on the HSM.
To view the keys that vSEC:CMS created on the HSM, perform the following task on the PKCS11Manager utility packaged with the PKCS #11 module:
In Windows File Explorer, go to the PKCS #11 installation directory and run the PKCS11Manager.exe file.
This action displays the following menu:
Enter 8 to log in and select the Enter key.
Enter 1 to select the Text password input mode and select the Enter key.
Enter the password of the identity defined in the FXPKCS11 configuration file and select the Enter key.
If successful, you receive confirmation that you are logged in.
Enter 3 to Find Objects and select the Enter key.
Enter 1 to find All objects and select the Enter key.
Upon success, you see information similar to the following example for all keys that the connecting identity has permission to access:
vSEC:CMS creates four objects on the HSM:
- Two 3DES symmetric encryption keys, which are the master keys used by the vSEC:CMS application. These keys have the CMS MK0 and CMS MK1 PKCS #11 labels.
- Two public RSA asymmetric keys that are used to wrap the master keys.