IBM PCI Cryptographic Coprocessor Guide

PCI Cryptographic Coprocessor
Installation and Using Guide
SA23-1235-01

Second Edition (October 2002)
Before using this information and the product it supports, read the information in “Safety Information” on page v and
Appendix B, “Notices” on page 23.
©International Business Machines Corporation, 2000, 2002. All rights reserved.
Note to U.S. Government Users Restricted Rights--Use, duplication or disclosure restricted by GSA ADP Schedule
Contract with IBM Corp.
Note
Before you install this product and use this information, be sure to read the product warranties and
notices information included with the system unit into which you are installing the product.

Contents
Safety Information.......................v
LithiumBatterySafety......................v
Handling Static-Sensitive Devices ..................vi
About This Book .......................vii
ISO 9000 ..........................vii
RelatedPublications......................vii
Trademarks .........................vii
Chapter 1. Description and Requirements ..............1
Contents of the Coprocessor Package ................1
Special Considerations for Handling and Storage .............1
Requirements and Specifications ..................3
Chapter 2. Installing the Device Driver Software ............5
Chapter 3. Installing the Device Driver on the RS/6000 SP System ......7
Checking System Prerequisites ...................7
Installing Software on the Control Workstation .............10
Installing Device Drivers on the SP Nodes...............11
Chapter 4. Installing the PCI Cryptographic Coprocessor ........13
Installing the Coprocessor ....................13
Verifying Coprocessor Hardware Installation ..............14
Verifying AIX Software Installation .................15
Running Coprocessor Diagnostics .................15
Chapter 5. Replacing Coprocessor Batteries .............17
Replacing the Batteries .....................17
Appendix A. Communications Statements ..............19
Federal Communications Commission (FCC) Statement ..........19
European Union (EU) Statement ..................20
International Electrotechnical Commission (IEC) Statement .........20
United Kingdom Telecommunications Safety Requirements .........20
Avis de conformitéaux normes du ministère des Communications du Canada . . . 20
Canadian Department of Communications Compliance Statement .......20
VCCI Statement .......................21
Radio Protection for Germany ...................21
Appendix B. Notices .....................23
iii

iv PCI Cryptographic Coprocessor Installation and Using Guide

Safety Information
DANGER
An electrical outlet that is not correctly wired could place hazardous voltage
on metal parts of the system or the devices that attach to the system. It is the
responsibility of the customer to ensure that the outlet is correctly wired and
grounded to prevent an electrical shock.
Before installing or removing signal cables, ensure that the power cables for
the system unit and all attached devices are unplugged.
When adding or removing any additional devices to or from the system,
ensure that the power cables for those devices are unplugged before the
signal cables are connected. If possible, disconnect all power cables from the
existing system before you add a device.
Use one hand, when possible, to connect or disconnect signal cables to
prevent a possible shock from touching two surfaces with different electrical
potentials.
During an electrical storm, do not connect cables for display stations, printers,
telephones, or station protectors for communication lines.
Lithium Battery Safety
CAUTION:
A lithium battery can cause a fire, an explosion, or a severe burn. Do not
recharge, disassemble, heat above 100 degrees C (212 degrees F), solder directly
to the cell, incinerate, or expose the cell contents to water.
Keep away from children.
Replace only with the part number specified for this product. Use of a different
battery may present the risk of fire or explosion. The battery connector is
polarized: do not attempt to reverse the polarity.
Dispose of the battery according to local regulations.
v

Handling Static-Sensitive Devices
Attention: Static electricity can damage this device and your system unit. To avoid
damage, keep this device in its anti-static protective bag until you are ready to install it.
To reduce the possibility of electrostatic discharge, follow the precautions listed below:
vLimit your movement. Movement can cause static electricity to build up around you.
vHandle the device carefully, holding it by its edges or its frame.
vDo not touch solder joints, pins, or other printed circuitry.
vDo not leave the device where others can handle and possibly damage the device.
vWhile the device is still in its anti-static package, touch it to an unpainted metal part
of the system unit for at least two seconds. (This drains static electricity from the
package and from your body).
vRemove the device from its package and install it directly into your system unit
without setting it down. If it is necessary to set the device down, place it on its
static-protective package. (If your device is an adapter, place it component-side up).
Do not place the device on your system unit cover or on a metal table.
vTake additional care when handling devices during cold weather, as heating reduces
indoor humidity and increases static electricity.
vi PCI Cryptographic Coprocessor Installation and Using Guide

About This Book
This book provides information about the PCI Cryptographic Coprocessor, how to install
the coprocessor hardware, how to install the device drivers, and how to replace the
batteries. Use this book together with your specific system unit and operating system
documentation.
ISO 9000
ISO 9000 registered quality systems were used in the development and manufacturing
of this product.
Related Publications
The following publications contain related information:
vSystem unit documentation for information specific to your hardware configuration.
vOperating system documentation for information specific to your software
configuration.
vPCI Adapter Placement Reference Guide (for the latest version, you may need to
contact your marketing representative)
vThe Web site at http://www.ibm.com/security/cryptocards
Trademarks
The following are trademarks of International Business Machines Corporation in the
United States, other countries, or both:
vAIX
vIBM
vRS/6000
vSP
Other company, product, and service names may be trademarks or service marks of
others.
vii

viii PCI Cryptographic Coprocessor Installation and Using Guide

Chapter 1. Description and Requirements
The PCI Cryptographic Coprocessor uses dedicated hardware to process cryptographic
keys, certificates, and bulk data. These cryptographic functions are performed within a
tamper-resistant module that is designed to meet the FIPS PUB 140-1 specification for
detecting attacks through temperature, radiation, voltage, and physical penetration.
You can install the PCI Cryptographic Coprocessor in a PCI card slot.
Contents of the Coprocessor Package
Your package includes the following items:
vThe PCI Cryptographic Coprocessor
vThe Installation and Using Guide (this manual)
If any item is missing or damaged, contact your sales representative.
Special Considerations for Handling and Storage
Each PCI Cryptographic Coprocessor is shipped from the factory with a certified device
key. This electronic key is digitally stored in the coprocessor’s battery-powered
protected memory. The information from this key signs status messages to confirm that
the coprocessor is genuine and that no tampering has occurred.
Note: If any of the secure module’s tamper sensors are triggered by tampering or
accident, the coprocessor erases all data in the protected memory, including the
certified device key. The coprocessor cannot operate without the certified device
key.
To protect the certified device key, follow these guidelines:
Temperature Do not expose the coprocessor to temperatures below
-15 degrees C (+5 degrees F) or temperatures above 60 degrees C
(+140 degrees F).
Observe the high and low temperature limits. Exceeding the limits
triggers a Tamper Event. Any Tamper Event renders the coprocessor
permanently inoperable, there is no recovery procedure.
Batteries Do not remove the coprocessor’s batteries. Data in the protected
memory is lost when battery power is removed. For information about
replacing the batteries without erasing the protected memory, see
Chapter 5, “Replacing Coprocessor Batteries”on page 17.
1

Handling
While installing the coprocessor, be aware that:
vThe coprocessor is always powered by the batteries, even when it
is not installed in the system.
vThe battery power is necessary to keep the coprocessor
operational.
vThe loss of battery power or a voltage drop triggers a Tamper
Event and permanently renders the coprocessor inoperable.
vAny short on the battery power distribution circuits causes a
voltage drop and a Tamper Event.
While handling the coprocessor, observe the following precautions:
vDo not lay the coprocessor on or cause the coprocessor to come in
contact with any conductive surface.
vDo not touch the coprocessor circuits with metal or conductive
tools.
vUse static-protective measures at all times when handling the
coprocessor.
2PCI Cryptographic Coprocessor Installation and Using Guide