Create a new Security World

You can use the following to create Security Worlds:

When you create a Security World:

  • The HSM is erased.

  • A new HSM key for this Security World is generated.

  • A new ACS to protect this HSM key is created.

  • The Security World information, including encrypted key material and related data, is stored in either the file system of the nShield HSM operating system and on the RFS (network-attached HSMs, see RFS) or on the hard disk of the host computer (PCIe and USB HSMs).
    For multiple clients or hosts to use the same Security World, the system administrator must ensure that these files are copied to all the clients or hosts and updated when required. For more information about Security World files, see Security World Files.

    • The information is encrypted using the secrets stored on the ACS.

  • The HSM and Security World are configured for Audit Logging, if selected.

    If you want to re-use the physical cards created in a previous Security World, you must erase all Operator Cards, except for nShield Remote Administration Cards, while the previous Security World still exists. See Erasing cards and softcards.
    We recommend that you regularly back up the entire contents of the RFS. Either the %NFAST_KMDATA% directory on Windows, or the kmdata directory on Linux, is required to restore an nShield HSM or its replacement, to the current state in case of failure.
    HSMs enrolled in a Security World with audit-logging enabled (including a Common-Criteria (CMTS) compatible Security World) will continuously generate audit-logs and if these audit-logs are not transferred and removed by the nshieldauditd service, then the HSMs may run out of disk space and will not process certain commands until their audit-logs are transferred and removed. See nShield Audit Log Service
    Due to the additional primality checking required by SP800-131A, Security World generation will take longer when using the new default Ciphersuite (from v12.40 onwards) - on nShield USB-attached HSMs, this could be up to 45 minutes.

Prerequisites

  • Familiarise yourself with the Security World file structure and logic: Security World Files.

  • Decide what kind of Security World you need and the options that you want to enable on creation: Security World options.

  • Before configuring the Security World, you should know:

    • The security policy for the HSM

    • The number and quorum of Administrator Cards and Operator Cards to be used.

  • You must have enough smart cards to form the Security World’s card sets.

Create a Security World using new-world

Before you start

Before you create a Security World:

  • The HSM must be in pre-initialization mode.

  • PCIe and USB HSMs: You must be logged in to the host computer as one of the following users:

    • root (Linux).

    • A user who is permitted to create privileged connections (Windows).

    • A user in the group nfast.

  • Network-attached HSMs: You must be logged in to the computer that is running the RFS. The RFS should be a privileged client that has the client tools installed.

  • Windows: You must have set the NFAST_HOME environment variable.
    This variable is set by default during product software installation.

Linux: You must install the Security World Software in /opt/nfast/.` Installation to other locations is not generally supported nor recommended, but if the attempt is made, you must create a symbolic link from /opt/nfast/ to the directory in which the software is actually installed.

When you have finished creating a Security World, you must change the mode to "Operational" using nopclearfail -I m1 or nopclearfail -O -m1.

If you are using a PCIe or a USB-attached HSM, follow the directions in this section to create a Security World from the command line with the new-world utility.

Run the new-world command-line utility

This example creates a Security World supporting FIPS140 Level 3 with a ACS quorum of 3/5 and with audit logging enabled.

new-world --mode=fips-140-level-3 --acs-quorum=3/5 --audit-logging

Copy a Security World to a network-attached HSM and check the current version

If a Security World is created using new-world, the nethsmadmin command-line utility enables you to copy the resultant files to a nShield HSM. Run the command:

nethsmadmin --module=<MODULE> --update-world

nethsmadmin can also be used to check if the Security World files have been copied to the nShield HSM. Run the command:

nethsmadmin --module=<MODULE> --check-world

In these commands:

--module=<MODULE>

Specifies the HSM to use, by its ModuleID (default = 1).

Follow the directions in this section to create a Security World from the command line with the new-world utility.

Create a Security World using the nShield HSM front panel (network-attached HSMs)

When initiated from the nShield HSM front panel, while a Security World is being created the nShield HSM disconnects itself from the network to ensure that the operation is not interrupted. This means that the Remote Administration feature cannot be used to present cards from a remote location when creating a Security World from the front panel.

Before you start

Before you start to create a Security World:

  • The /opt/nfast/kmdata/local (Linux) or %NFAST_KMDATA%\local (Windows) directory must exist on the remote file system and be empty.

To create a Security World from the nShield HSM Front Panel:

  1. From the main menu, select Security World mgmt > Module initialization > New Security World.

  2.  Specify the Security World mode:

    1. FIPS 140 Level 3 creates a Security World compliant with FIPS 140 requirements for roles and services at Level 3.

    2. Common Criteria CMTS creates a Security World supporting Common Criteria Protection Profile EN 419 221-5.

    3. Unrestricted creates a Security World which doesn’t impose any particular conformance. With appropriate environmental constraints, an unrestricted Security World can be compliant with FIPS 140 Level 2.

  3. Select the Cipher suite for the Security World. Currently only one option is available for the Security World key, AES (SP800-131AR1).

  4. Enter the default quorum for the ACS. This consists of:

    1.  The maximum number of cards from the ACS required by default for an operation. This number must be less than or equal to the total number of cards in the set.

    2. The total number of cards to be used in the ACS. This must be a value in the range 1 – 64 except for the Common Criteria CMTS Security World mode, for which the range is 2 – 64.

      We recommend that you do not create an ACS for which the required number of cards is equal to the total number of cards because you cannot replace such an ACS if even a single card is lost or damaged.

  5. If you answer the question Specify all quorums? by selecting:

    1. no - all operations and features (with the exception of passphrase recovery) will be enabled and require the maximum number of cards

    2. yes - you can specify which operations and features you want to enable (including passphrase recovery) and what the required number of cards for each of these will be.

  6. If you chose to disable individual features or require a lower number of cards required for an operation, specify these parameters now. You can select a different number of Administrator Cards (K) to be required for each operation. You can also disable recovery and replacement operations and choose to use KNSO to authorize SEE (Secure Execution Engine) operations. The options for which you can specify a separate value of K are as follows:

    Operation Action allowed on HSM

    Module reprogramming

    Initializing an HSM into a Security World. You must specify a value of K for this operation.

    passphrase replacement

    Replacement of passphrases from backup files when recovering an OCS. You can disable this operation, see Passphrase replacement. This operation is disabled in Common Criteria CMTS mode and cannot be enabled.

    OCS/softcard replacement

    Recovery of keys from backup files when replacing an OCS. You can disable this operation if you are using the nShield HSM, see OCS and softcard replacement.

    NVRAM access

    Reading from and writing to the NVRAM. You can choose to authorize this operation with KNSO, see Nonvolatile memory (NVRAM) options.

    RTC access

    Updating the real time clock. This is not applicable for nShield 5c. You can choose to authorize this operation with KNSO, see Real-time clock (RTC) options.

    SEE debugging

    Viewing full SEE debug information. You can specify a value of K for this operation, all it for all users or authorize it with KNSO, see SEE debugging. This operation is disabled in Common Criteria CMTS mode.

    FTO

    Use of an Foreign Token Open (FTO) Delegate Key (ISO Smart Card Support). You can specify a value of K for this operation or authorize it with KNSO. This operation is disabled in Common Criteria CMTS mode.

  7. Specify if audit logging should be enabled.

    In Common Criteria CMTS mode, audit logging is automatically enabled and cannot be disabled.

  8. Specify whether the HSM is a valid target for remote shares (that is, whether it can import slots), see Remote Operator. This option is disabled for Common Criteria CMTS mode.

  9. For Common Criteria CMTS mode only, choose whether to specify the maximum number of times an Assigned key can be used since it was authorized. A use limit compatible with the specified maximum will be imposed at key creation time and can be verified for Assigned keys. If you choose to specify a maximum key usage limit:

    1. Enter the key usages allowed, up to a maximum of 9999.

  10. For Common Criteria CMTS mode only, choose whether to specify a maximum timeout for Assigned keys since key authorization. A time limit compatible with the specified maximum will be imposed when the key is created, and can be verified for Assigned keys. If you choose to specify a key timeout:

    1. Select the units from Seconds, Minutes, Hours, or Days.

    2. Enter a value up to a maximum of 9999 in your selected unit.

  11. Format a card for the ACS as follows:

    1. Insert a card for the ACS and confirm that you want to use it.

    2. If the card is not blank, choose whether to overwrite it or to use a different card.

    3. Choose whether to specify a passphrase for the card. If you choose to specify a passphrase:

      1. Enter the passphrase.

      2. Enter the passphrase again to confirm it. If the two passphrases do not match, you must enter the correct passphrase twice.

    4. When prompted, remove the card.

  12. Repeat the previous step to format additional cards for the ACS, setting their passphrases as described, until the ACS is complete. Each prompt screen shows how many cards are required and how many have been used.

  13. At completion, a message confirms that the Security World has been created.

After you have created a Security World

If you enrolled a network-attached HSM into a security world, propagate the world and module files to client machines, then run hsc_configurepoolmodule -mN on each machine enrolled as a client (N is the module number of the newly enrolled HSM). If there is more than one module to configure and the Security World software version is v13.6 or later, you can run hsc_configurepoolmodule without any parameters to add all eligible modules to the pool.

Store the ACS in a safe place.

If you lose more than N minus K of these Administrator Cards you cannot restore the Security World or lost Operator Cards. For example, if you have a 2/3 ACS and you lose more than one card, you cannot restore the Security World. If you have created an Administrator card set where K = N, then the loss of one card stops you from being able to restore the Security World.

To prevent this situation from occurring, replace lost or damaged cards from the ACS as soon as you discover the loss or damage. For more information, see Replacing the Administrator Card Set.

The security of the keys that you create within this Security World is wholly dependent on the security of these smart cards.

In Network-attached HSMs, the Security World data is stored on the HSM and on the RFS. For more information see Security World Files.

In PCIe and USB HSMs, the Security World host data is stored in the directory to which the NFAST_KMLOCAL environment variable points (see Security World Files). The data in this directory is encrypted. You should:

  • Ensure that this directory is backed up regularly.

  • Check the file permissions for this directory.

    • Ensure that the nFast Administrator role, and any user that you want to be able to create Operator Cards or keys, have write permission for this directory.

    • All other valid users must have read permission.

      Installation of Security World Software must be performed by a user with Administrator rights that allow read and write operations, and applications to be started and stopped.

The HSM can now be used to create Operator Cards and keys for the new Security World.

If you need to migrate existing keys into the Security World, see nShield Security World v13.6.5 Key Management Guide.