IBM PCI Cryptographic Coprocessor Guide

PCI Cryptographic Coprocessor
Installation and Using Guide
SA23-1235-01

Second Edition (October 2002)
Before using this information and the product it supports, read the information in “Safety Information” on page v and
Appendix B, “Notices” on page 23.
©International Business Machines Corporation, 2000, 2002. All rights reserved.
Note to U.S. Government Users Restricted Rights--Use, duplication or disclosure restricted by GSA ADP Schedule
Contract with IBM Corp.
Note
Before you install this product and use this information, be sure to read the product warranties and
notices information included with the system unit into which you are installing the product.

Contents
Safety Information.......................v
LithiumBatterySafety......................v
Handling Static-Sensitive Devices ..................vi
About This Book .......................vii
ISO 9000 ..........................vii
RelatedPublications......................vii
Trademarks .........................vii
Chapter 1. Description and Requirements ..............1
Contents of the Coprocessor Package ................1
Special Considerations for Handling and Storage .............1
Requirements and Specifications ..................3
Chapter 2. Installing the Device Driver Software ............5
Chapter 3. Installing the Device Driver on the RS/6000 SP System ......7
Checking System Prerequisites ...................7
Installing Software on the Control Workstation .............10
Installing Device Drivers on the SP Nodes...............11
Chapter 4. Installing the PCI Cryptographic Coprocessor ........13
Installing the Coprocessor ....................13
Verifying Coprocessor Hardware Installation ..............14
Verifying AIX Software Installation .................15
Running Coprocessor Diagnostics .................15
Chapter 5. Replacing Coprocessor Batteries .............17
Replacing the Batteries .....................17
Appendix A. Communications Statements ..............19
Federal Communications Commission (FCC) Statement ..........19
European Union (EU) Statement ..................20
International Electrotechnical Commission (IEC) Statement .........20
United Kingdom Telecommunications Safety Requirements .........20
Avis de conformitéaux normes du ministère des Communications du Canada . . . 20
Canadian Department of Communications Compliance Statement .......20
VCCI Statement .......................21
Radio Protection for Germany ...................21
Appendix B. Notices .....................23
iii

iv PCI Cryptographic Coprocessor Installation and Using Guide

Safety Information
DANGER
An electrical outlet that is not correctly wired could place hazardous voltage
on metal parts of the system or the devices that attach to the system. It is the
responsibility of the customer to ensure that the outlet is correctly wired and
grounded to prevent an electrical shock.
Before installing or removing signal cables, ensure that the power cables for
the system unit and all attached devices are unplugged.
When adding or removing any additional devices to or from the system,
ensure that the power cables for those devices are unplugged before the
signal cables are connected. If possible, disconnect all power cables from the
existing system before you add a device.
Use one hand, when possible, to connect or disconnect signal cables to
prevent a possible shock from touching two surfaces with different electrical
potentials.
During an electrical storm, do not connect cables for display stations, printers,
telephones, or station protectors for communication lines.
Lithium Battery Safety
CAUTION:
A lithium battery can cause a fire, an explosion, or a severe burn. Do not
recharge, disassemble, heat above 100 degrees C (212 degrees F), solder directly
to the cell, incinerate, or expose the cell contents to water.
Keep away from children.
Replace only with the part number specified for this product. Use of a different
battery may present the risk of fire or explosion. The battery connector is
polarized: do not attempt to reverse the polarity.
Dispose of the battery according to local regulations.
v

Handling Static-Sensitive Devices
Attention: Static electricity can damage this device and your system unit. To avoid
damage, keep this device in its anti-static protective bag until you are ready to install it.
To reduce the possibility of electrostatic discharge, follow the precautions listed below:
vLimit your movement. Movement can cause static electricity to build up around you.
vHandle the device carefully, holding it by its edges or its frame.
vDo not touch solder joints, pins, or other printed circuitry.
vDo not leave the device where others can handle and possibly damage the device.
vWhile the device is still in its anti-static package, touch it to an unpainted metal part
of the system unit for at least two seconds. (This drains static electricity from the
package and from your body).
vRemove the device from its package and install it directly into your system unit
without setting it down. If it is necessary to set the device down, place it on its
static-protective package. (If your device is an adapter, place it component-side up).
Do not place the device on your system unit cover or on a metal table.
vTake additional care when handling devices during cold weather, as heating reduces
indoor humidity and increases static electricity.
vi PCI Cryptographic Coprocessor Installation and Using Guide

About This Book
This book provides information about the PCI Cryptographic Coprocessor, how to install
the coprocessor hardware, how to install the device drivers, and how to replace the
batteries. Use this book together with your specific system unit and operating system
documentation.
ISO 9000
ISO 9000 registered quality systems were used in the development and manufacturing
of this product.
Related Publications
The following publications contain related information:
vSystem unit documentation for information specific to your hardware configuration.
vOperating system documentation for information specific to your software
configuration.
vPCI Adapter Placement Reference Guide (for the latest version, you may need to
contact your marketing representative)
vThe Web site at http://www.ibm.com/security/cryptocards
Trademarks
The following are trademarks of International Business Machines Corporation in the
United States, other countries, or both:
vAIX
vIBM
vRS/6000
vSP
Other company, product, and service names may be trademarks or service marks of
others.
vii

viii PCI Cryptographic Coprocessor Installation and Using Guide

Chapter 1. Description and Requirements
The PCI Cryptographic Coprocessor uses dedicated hardware to process cryptographic
keys, certificates, and bulk data. These cryptographic functions are performed within a
tamper-resistant module that is designed to meet the FIPS PUB 140-1 specification for
detecting attacks through temperature, radiation, voltage, and physical penetration.
You can install the PCI Cryptographic Coprocessor in a PCI card slot.
Contents of the Coprocessor Package
Your package includes the following items:
vThe PCI Cryptographic Coprocessor
vThe Installation and Using Guide (this manual)
If any item is missing or damaged, contact your sales representative.
Special Considerations for Handling and Storage
Each PCI Cryptographic Coprocessor is shipped from the factory with a certified device
key. This electronic key is digitally stored in the coprocessor’s battery-powered
protected memory. The information from this key signs status messages to confirm that
the coprocessor is genuine and that no tampering has occurred.
Note: If any of the secure module’s tamper sensors are triggered by tampering or
accident, the coprocessor erases all data in the protected memory, including the
certified device key. The coprocessor cannot operate without the certified device
key.
To protect the certified device key, follow these guidelines:
Temperature Do not expose the coprocessor to temperatures below
-15 degrees C (+5 degrees F) or temperatures above 60 degrees C
(+140 degrees F).
Observe the high and low temperature limits. Exceeding the limits
triggers a Tamper Event. Any Tamper Event renders the coprocessor
permanently inoperable, there is no recovery procedure.
Batteries Do not remove the coprocessor’s batteries. Data in the protected
memory is lost when battery power is removed. For information about
replacing the batteries without erasing the protected memory, see
Chapter 5, “Replacing Coprocessor Batteries”on page 17.
1

Handling
While installing the coprocessor, be aware that:
vThe coprocessor is always powered by the batteries, even when it
is not installed in the system.
vThe battery power is necessary to keep the coprocessor
operational.
vThe loss of battery power or a voltage drop triggers a Tamper
Event and permanently renders the coprocessor inoperable.
vAny short on the battery power distribution circuits causes a
voltage drop and a Tamper Event.
While handling the coprocessor, observe the following precautions:
vDo not lay the coprocessor on or cause the coprocessor to come in
contact with any conductive surface.
vDo not touch the coprocessor circuits with metal or conductive
tools.
vUse static-protective measures at all times when handling the
coprocessor.
2PCI Cryptographic Coprocessor Installation and Using Guide

Requirements and Specifications
The following items are requirements and specifications for the coprocessor.
Hardware A personal computer, workstation, server, or
communication device with a PCI version 2.1 bus
slot available. No additional hardware or cabling is
required.
Software The coprocessor requires support software for both
the host system and for its internal firmware. AIX
operating system Version 4.3.3.25 or later is
required. See Chapter 2, “Installing the Device
Driver Software”on page 5 or Chapter 3, “Installing
the Device Driver on the RS/6000 SP System”on
page 7 for device-driver installation instructions. For
additional information, see the cryptographic
security Web site at:
http://www.ibm.com/security/cryptocards
Power Consumption Typical, 7.2 watts
Voltage +5.0 V dc and +12.0 V dc at ±5 percent
Temperature Operating, +10 to +40 degrees C (50 to 104
degrees F)
Storage, -15 to +60 degrees C (5 to 140 degrees F)
Relative Humidity 8 to 80 percent
Physical Dimensions 4.2 inches by 6.9 inches (106 mm by 175 mm)
Chapter 1. Description and Requirements 3

4PCI Cryptographic Coprocessor Installation and Using Guide

Chapter 2. Installing the Device Driver Software
This chapter is for non-SP RS/6000 systems. For RS/6000 SP systems, use Chapter 3,
“Installing the Device Driver on the RS/6000 SP System”on page 7.
This chapter explains how to install device driver software. The device driver is provided
for the AIX operating system. However, to be sure that you have the latest version of
the device driver, check the cryptographic Web site at
http://www.ibm.com/security/cryptocards
Be sure you have read Chapter 1, “Description and Requirements”on page 1.
Before you begin the installation of the PCI Cryptographic Coprocessor device driver,
you must determine whether to:
vInstall the device driver software first
vInstall your coprocessor hardware first
Note: If the AIX operating system is not installed on your system unit, install the PCI
Cryptographic Coprocessor before you install the AIX operating system. See
Chapter 4, “Installing the PCI Cryptographic Coprocessor”on page 13.
If the AIX operating system is installed on your system, install the PCI
Cryptographic Coprocessor device driver before you install the adapter. Use this
chapter.
If your installed AIX operating system supports the PCI Cryptographic Coprocessor and
you have had a PCI Cryptographic Coprocessor installed previously, the device driver
may be already installed on this AIX operating system, and you can go to Chapter 4,
“Installing the PCI Cryptographic Coprocessor”on page 13 for instructions.
Otherwise, do the following to install the device driver:
1. Turn on the system unit power.
2. Log in as root user.
3. Insert the media containing the device driver software (for example; CD-ROM) into
the appropriate media device.
4. Type the following System Management Interface Tool (SMIT) fast path:
smitty devinst
5. Press Enter. The Install Additional Device Software screen highlights the INPUT
device/directory for software option.
5

6. Select or type your input device:
vPress F4 to display the input device list. Select the name of the device (for
example; CD-ROM) that you are using and press Enter.
OR
vIn the entry field, type the name of the input device you are using and press
Enter.
The Install Additional Device Software window highlights the SOFTWARE to
Install option.
7. Press F4 to display the SOFTWARE to Install window.
8. Type the following to display the Find window:
/
9. Type the following:
devices.pci.14109f00
10. Press Enter. The system finds and highlights this device driver software.
11. Press F7 to select the highlighted device driver software.
12. Press Enter.
13. The INSTALL ADDITIONAL DEVICE SOFTWARE screen displays. The entry fields
are automatically updated. Press Enter to accept the information.
14. The ARE YOU SURE window displays. Press Enter to accept the information.
15. The COMMAND STATUS screen displays.
vThe term RUNNING is highlighted to indicate that the installation and configuration
command is in progress.
vWhen RUNNING changes to OK, scroll to the bottom of the page and locate the
Installation Summary.
vAfter a successful installation, SUCCESS displays in the Result column of the
Installation Summary at the bottom of the page.
16. Remove the installation media from the drive.
17. Press F10 to exit SMIT.
18. Go to Chapter 4, “Installing the PCI Cryptographic Coprocessor”on page 13.
6PCI Cryptographic Coprocessor Installation and Using Guide

Chapter 3. Installing the Device Driver on the RS/6000 SP System
For an RS/6000 SP system, the installation tasks must be performed on each node.
You must make the installation files available and then install them on all the relevant
nodes. This chapter discusses the following tasks to enable you to install the device
driver on the RS/6000 SP system:
vChecking System Prerequisites
vInstalling Software on the Control Workstation (if the device driver is not in the
lppsource directory)
vInstalling Device Drivers on the SP Nodes (if the device driver and additional
software are not already installed)
Perform the following tasks on the Control Workstation. If you are unfamiliar with the
dsh command, refer to one of the following Parallel System Support Program (PSSP)
publications:
vParallel System Support Program for AIX: Administration Guide
vParallel System Support Program for AIX: Command and Technical Reference
If you cannot use the dsh command because of the setup at your site, then use the
telnet command to each node. Then perform the steps below, beginning with step 5,
and omitting the dsh prefix.
Checking System Prerequisites
Do the following to check system prerequisites:
__ 1. Log in to the Control Workstation as a root user.
__ 2. Go to a temporary directory by typing the following at the system prompt:
cd /tmp
Press Enter.
__ 3. Make a working collective file containing a list of the relevant nodes on which
you want to perform the update. Type the following, pressing Enter after each
line:
cat > roup1
nodename1
nodename2
nodename3......
CTRL-D
export WCOLL=/tmp/ roup1
__ 4. Test the working collective file by typing the following:
dsh date
7

Press Enter. The results should look similar to the following:
nodename1: Wed Apr 10 10:37:46 EDT 1999
nodename2: Wed Apr 10 10:37:46 EDT 1999
nodename3: Wed Apr 10 10:37:47 EDT 1999
nodename4: Wed Apr 10 10:37:48 EDT 1999
If not, examine your nodelist file /tmp/group1 to ensure that the node names
are correct. Also ensure that the Kerberos ticket is current to permit rsh to be
performed. If not, you may need to refresh it. Contact your system administrator
for assistance with Kerberos initialization. If the system administrator is unable
to help you, consult your support center.
An alternative way to specify a working collective is by using the -w flag with
the dsh command. If you need to install only a few nodes, use the dsh -w
host1, host2, host3... command format to explicitly reference groups of nodes.
__ 5. Determine if the AIX operating system on each relevant node is at the required
level by typing the following at the AIX operating system prompt:
dsh oslevel
OR
dsh -w <host1,host2> oslevel
Press Enter. <host1,host2> is a list of the host names for the nodes on which
the adapter will be installed. The required AIX level is: 4.3.3 or later.
If the nodes are not at a supported AIX level, upgrade the AIX level on the
nodes. Contact the system administrator for assistance.
__ 6. Determine if the PSSP level on each node is at the required level by typing the
following:
/usr/lpp/ssp/bin/splstdata -G -b
Press Enter. The results display for all nodes and are in a form similar to the
following:
node# hostname hdw_enet_addr srvr response install_disk
last_install_ima e last_install_time next_install_ima e lppsource_name
pssp_ver
------------------------------------------------------------------------
1 eion01.ppd.pok.i 08005A75A6D4 0 disk hdisk0
default Thu_Dec__4_09:07:23 default <lppsource>
<pssp level>
<lppsource> is the lppsource name for the node. <pssp level> is the PSSP
level installed on the node. The required PSSP level is 3.1 or later.
If the nodes are not at a supported PSSP level, upgrade the PSSP level on the
nodes. Contact the system administrator for assistance.
8PCI Cryptographic Coprocessor Installation and Using Guide

__ 7. Record the name that appears below lppsource_name for each node on which
the adapters are being installed. You will use this information later.
__ 8. Verify that the device driver is installed in the lppsource directory by typing the
following at the system prompt:
cd spdata/sys1/install/<lppsource_name>/lppsource
<lppsource_name> was recorded in the previous step. Once you are in this
directory, verify that the fileset is in the lppsource directory by typing the
following at the prompt:
ls devices.pci.14109f00*
If the device driver is not in the lppsource directory, proceed to section
“Installing Software on the Control Workstation”on page 10 to install the
software.
__ 9. Update the SPOT (Shared Product Object Tree) by doing the following:
__ a. Type the following at the system prompt:
smitty nim_res_op
The Resource Name screen displays with the following highlighted:
boot resources boot
__ b. Move the cursor down until the SPOT resource is highlighted. The SPOT
resource should look similar to:
spot_AIX421 resources spot
The format of the spot name is: spot_<lppsource_name>.
<lppsource_name> was the name you recorded in a previous step.
__ c. When the SPOT resource is highlighted, press Enter to select this option.
The Network Install Operation to Perform screen displays with the reset
option highlighted for selection.
__ d. Move the cursor until the cust option is highlighted and press Enter to
select this option. The Customize a SPOT screen displays with the
Source of Install Images highlighted for selection.
__ e. Press F4 to display the list of installation images and select the
appropriate lppsource.
__ f. Move the cursor until the appropriate lppsource is displayed. For
example:
lppsource_AIX421 resources lpp_source
Press Enter.
__ g. Move the cursor until Fileset Names is highlighted. Type the following
fileset name:
devices.pci.14109f00
__ h. Press Enter to start the SPOT update. This operation can take up to 15
minutes.
Chapter 3. Installing the Device Driver on the RS/6000 SP System 9

__ 10. Verify that the device driver is already installed by typing the following at the
system prompt:
dsh "lslpp -l devices.pci.14109f00* 2>&1" |more
__ 11. If the device driver is already installed on the node, contact your service
provider to have the adapter installed.
OR
If the device driver is not installed on the node, proceed to section “Installing
Device Drivers on the SP Nodes”on page 11.
Installing Software on the Control Workstation
Note: If your system is partitioned; that is, there is more than one operating system
among the nodes, you can install this adapter only in nodes that have AIX 4.3.3
or later.
__ 1. If you are not logged in to the Control Workstation as a root user, log in now. You
may also need to export the working collective. Refer to “Checking System
Prerequisites”on page 7.
__ 2. Select the appropriate CD-ROM for the operating system, as follows:
vAIX 4.3.x - Additional Device Software
__ 3. Insert the installation media into the drive of the Control Workstation.
__ 4. Transfer the files to the Control Workstation’s lppsource, as follows:
a. Type the following, and then press Enter.
smitty bffcreate
b. Select the input device/directory. Press F4. Then move the cursor to the
appropriate input device and press Enter.
c. Move the cursor to the SOFTWARE Package to Copy option and press F4 to
select the software to be installed. Use the F7 key to select the following
device driver(s) at the system prompt:
devices.pci.14109f00
Press Enter.
d. Move the cursor down to DIRECTORY for Storing Software Package and
enter the appropriate lppsource destination directory:
/spdata/sys1/install/<lppsource_name>/lppsource
Use the <lppsource_name> you recorded earlier.
e. Press Enter to begin copying the files.
Note: This step may take several minutes while the directory table of
contents is updated.
10 PCI Cryptographic Coprocessor Installation and Using Guide

__ 5. Update the SPOT (Shared Product Object Tree) by doing the following:
a. Type the following at the system prompt:
smitty nim_res_op
The Resource Name screen displays with the following highlighted:
boot resources boot
b. Move the cursor down until the SPOT resource is highlighted. The SPOT
resource should look similar to:
spot_AIX421 resources spot
The format of the spot name is: spot_<lppsource_name>. <lppsource_name>
was the name that you recorded in a previous step.
c. When the SPOT resource is highlighted, press Enter to select this option.
The Network Install Operation to Perform screen displays with the reset
option highlighted for selection.
d. Move the cursor until the cust option is highlighted, and press Enter to select
this option. The Customize a SPOT screen displays with the Source of
Install Images highlighted for selection.
e. Press F4 to display the list of install images and select the appropriate
lppsource.
f. Move the cursor until the appropriate lppsource is displayed. For example:
lppsource_AIX421 resources lpp_source
Press Enter.
g. Move the cursor down until fileset names is highlighted. Type the following
fileset name:
devices.pci.14109f00
h. Press Enter to start the SPOT update. This operation can take up to 15
minutes.
__ 6. Proceed to step 9 under “Checking System Prerequisites”on page 7.
Installing Device Drivers on the SP Nodes
Do the following to install device drivers on the SP nodes:
__ 1. Make sure that the lppsource directory is exported to the nodes by typing the
following at the system prompt:
showmount -e
If the directory is exported to the nodes, the result should look similar to the
following:
/spdata/sys1/install/AIX421/lppsource (everyone)
__ 2. If the directory is not exported, you may temporarily export the directory by
typing the following:
exportfs -i /spdata/sys1/install/<lppsource_name>/lppsource
Chapter 3. Installing the Device Driver on the RS/6000 SP System 11

__ 3. Perform an NFS mount of the lppsource directory by typing the following:
dsh mount <controlwks>:
/spdata/sys1/install/<lppsource_name>/lppsource /mnt
<controlwks> is the name of the Control Workstation recognized by the nodes.
<lppsource_name> is the name you recorded earlier in “Checking System
Prerequisites”on page 7.
__ 4. Perform a preview of the files to be installed on the nodes by typing the following
at the system prompt:
dsh "installp -p -acqXd /mnt device driver 2>&1" | more
device driver is the fileset that must be installed for the adapter. The list includes:
vdevices.pci.14109f00
__ 5. Install the device driver by typing the following at the system prompt:
dsh "installp -acqXd /mnt device driver 2>&1" | more
device driver is defined in the previous step.
After the device driver is installed on the node, contact your service provider to
have the adapter installed.
12 PCI Cryptographic Coprocessor Installation and Using Guide