Install and configure the Entrust nShield HSM

Select the protection method

OCS, Softcard, or Module protection can be used to authorize access to the keys protected by the HSM. When selecting your protection method take into consideration:

  • Your organization’s security policy.

  • Unattended startup requirements.

The OCS or Softcard needs to the presented initially when configuring the Entrust Certificate Authority. In production, unattended startup is possible in some scenarios.

Install the HSM

Install the nShield Connect HSM locally, remotely, or remotely via the serial console. See the following nShield Support articles and the Installation Guide for the HSM:

Access to the Entrust nShield Support Portal is available to customers under maintenance. To request an account, contact nshield.support@entrust.com.

Install the nShield Security World Software and create the Security World

To install the nShield Security World Software and create the Security World:

  1. Install the Security World software as described in Installation Guide and the User Guide for the HSM. This is supplied on the installation disc.

  2. Add the Security World utilities path /opt/nfast/bin to the system path.

  3. Open the firewall port 9004 for the HSM connections.

  4. Open a command window and confirm the HSM is operational:

    # enquiry
Server:
 enquiry reply flags  none
 enquiry reply level  Six
 serial number        530E-02E0-D947 7724-8509-81E3 09AF-0BE9-53AA 9E10-03E0-D947
 mode                 operational
...
Module #1:
 enquiry reply flags  none
 enquiry reply level  Six
 serial number        530E-02E0-D947
 mode                 operational
 ...

  5. Create your Security World if one does not already exist, or copy an existing one. Follow your organization’s security policy for this. Create extra ACS cards as spares in case of a card failure or a lost card.

    ACS cards cannot be duplicated after the Security World is created.

  6. Confirm the Security World is usable:

    # nfkminfo
World
 generation  2
 state       0x37270008 Initialised Usable ...
 ...
Module #1
 generation 2
 state      0x2 Usable
 ...

Create the OCS or Softcard in the CA server

The OCS or Softcard and associated passphrase will be used to authorize access to the keys protected by the HSM. Typically, one or the other will be used, but rarely both.

Create the OCS

To create the OCS:

  1. Ensure file /opt/nfast/kmdata/config/cardlist contains the serial number of the card(s) to be presented, or the wildcard "*".

  2. Open a command window as an administrator.

  3. Run the createocs command as described below, entering a passphrase or password at the prompt.

    Create one card for each person with access privilege, plus the spares. In this guide, the quorum K equal and total numbers of cards N is set to 1 for simplicity.

    The --persist option allows for removal of the OCS for save storage. Otherwise, the authentication provided by the OCS is only available while the OCS card is inserted in the HSM front panel slot, or the TVD. Notice slot 2, remote via a Trusted Verification Device (TVD), is used to present the card.

    After an Operator Card Set has been created, the cards cannot be duplicated. 
    # createocs -m1 -s2 -N testOCS -Q 1/1 --persist

FIPS 140-2 level 3 auth obtained.

Creating Cardset:
 Module 1: 0 cards of 1 written
 Module 1 slot 0: Admin Card #5
 Module 1 slot 2: blank card
 Module 1 slot 3: empty
 Module 1 slot 4: empty
 Module 1 slot 5: empty
 Module 1 slot 2:- passphrase specified - writing card
Card writing complete.

cardset created; hkltu = edb3d45a28e5a6b22b033684ce589d9e198272c2

  4. Verify the OCS was created:

    # nfkminfo -c
Cardset list - 2 cardsets:  (P)ersistent/(N)ot, (R)emoteable/(L)ocal-only
 Operator logical token hash               k/n timeout  name
 edb3d45a28e5a6b22b033684ce589d9e198272c2  1/5  none-NL testOCS

    The rocs utility also shows the OCS was created:

    # rocs
`rocs' key recovery tool
Useful commands: `help', `help intro', `quit'.
rocs> list cardset
No. Name                     Keys (recov) Sharing
   1 testOCS                  0 (0)        1 of 5; persistent
rocs> quit

Create a Softcard

To create a Softcard:

  1. Run the following command and enter a passphrase or password at the prompt:

    # ppmk -n testSC

Enter new pass phrase:
Enter new pass phrase again:
New softcard created: HKLTU 925f67e72ea3c354cae4e6797bde3753d24e7744

  2. Verify the Softcard was created:

    # nfkminfo -s
SoftCard summary - 1 softcards:
 Operator logical token hash               name
 925f67e72ea3c354cae4e6797bde3753d24e7744  testSC

    The rocs utility also shows that the OCS and Softcard were created:

    # rocs
`rocs' key recovery tool
Useful commands: `help', `help intro', `quit'.
rocs> list cardset
No. Name                     Keys (recov) Sharing
  1 testOCS                  0 (0)        1 of 1; persistent
  2 testSC                   0 (0)        (softcard)
rocs>