Install and configure the Entrust nShield HSM

Install the nShield Security World Software

  1. Sign in to the Vault Server using an account with administrator privileges.

  2. Install the Security World software.
    For detailed instructions, see the nShield Security World documentation.

  3. Add the Security World utilities path to the system path.
    This path is typically C:\Program Files\nCipher\nfast\bin.

  4. Run the enquiry utility to confirm that the Security World is in operational mode.

    C:\Users\Administrator>enquiry
Server:
 enquiry reply flags  none
 enquiry reply level  Six
 serial number
 mode                 operational
 version              13.6.18

  5. Open firewall port 9004 for the Entrust nShield HSM connections.

  6. If using Remote Administration, open firewall port 9005 for the Entrust nShield Trusted Verification Device (TVD).

Install the Entrust nShield HSM

Install the nShield Connect HSM. Condensed instructions are available in the Entrust TrustedCare Portal.

For detailed instructions see the Hardware install and setup guides.

Enroll the Entrust nShield HSM

  1. Inform the HSM about the Vault Server.

    For instructions see Configuring the nShield HSM to use the client.

    If you are using a high-availability setup, repeat the client configuration for each HSM.

  2. Enroll the Vault Server as a client of the HSM.

    For instructions see Configuring client computers to use the nShield HSM.

    If you are using a high-availability setup, repeat the enrollment for each HSM.

  3. Run the enquiry utility to confirm that the HSM is in operational mode.

    C:\Users\Administrator>enquiry
Server:
 enquiry reply flags  none
 enquiry reply level  Six
 serial number        6A74-1261-7843 810B-03E0-D947
 mode                 operational
 version              13.6.18
...
Module #1:
 enquiry reply flags  UnprivOnly
 enquiry reply level  Six
 serial number        6A74-1261-7843
 mode                 operational
 version              13.4.5
 ...
Module #2:
 enquiry reply flags  UnprivOnly
 enquiry reply level  Six
 serial number        810B-03E0-D947
 mode                 operational
 version              12.72.4

Create a security world

  1. Create a new Security World, if one does not already exist, or copy an existing one.

    Follow your organization’s security policy for this. For more information see Create a new Security World.

    ACS cards cannot be duplicated after the Security World is created. You may want to create extras in case of a card failure or a lost card.

  2. Confirm the Security World is in a Usable state with the nfkminfo utility.

    C:\Users\Administrator>nfkminfo
World
 generation  2
 state       0x3737000c Initialised Usable ...
 ...
Module #1
 generation 2
 state      0x2 Usable
 ...
Module #2
 generation 2
 state      0x2 Usable

Select the protection method

OCS or Module protection can be used to authorize access to the keys protected by the HSM.

  • Operator Cards Set (OCS) are smartcards that are presented to the physical smartcard reader of an HSM. For more information on OCS use, properties, and k-of-N values, see Operator Card Sets (OCS).

  • Module protection has no passphrase.

Follow your organization’s security policy to select an authorization access method.

  1. Edit the C:\Program Files\nCipher\nfast\cknfastrc file containing the nShield PKCS #11 library environment variables per the selection above.

    • For module-protected keys:

      CKNFAST_OVERRIDE_SECURITY_ASSURANCES=none
CKNFAST_LOADSHARING=1
CKNFAST_FAKE_ACCELERATOR_LOGIN=1

    • For OCS-protected keys with K=1:

      CKNFAST_OVERRIDE_SECURITY_ASSURANCES=none
CKNFAST_LOADSHARING=1

    • For OCS-protected keys and K>1:

      CKNFAST_OVERRIDE_SECURITY_ASSURANCES=none
CKNFAST_LOADSHARING=1
NFAST_NFKM_TOKENSFILE=C:\ProgramData\nCipher\nfast-nfkm-tokensfile

  2. If using OCS protection, edit the C:\ProgramData\nCipher\Key Management Data\config\cardlist configuration file.
    Instructions are in the file itself.