Sun Oracle Crypto Accelerator 6000 Board User manual
Sun Crypto Accelerator 6000 Board Version 1.1
User’s Guide
Part No.: E39851-01
February 2013
Please
Recycle
Copyright © 2006, 2013, Oracle and/or its affiliates. All rights reserved.
This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by
intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate,
broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering,
disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.
The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us
in writing.
If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the
following notice is applicable:
U.S. GOVERNMENT END USERS. Oracle programs, including any operating system, integrated software, any programs installed on the hardware,
and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition
Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including
any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license
restrictions applicable to the programs. No other rights are granted to the U.S. Government.
This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any
inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous
applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle
Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.
Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or
registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of
Advanced Micro Devices. UNIX is a registered trademark of The Open Group.
This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle
Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and
services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party
content, products, or services.
Copyright © 2006, 2013, Oracle et/ou ses affiliés. Tous droits réservés.
Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des
restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire,
diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par
quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à
des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi.
Les informations fournies dans ce document sont susceptibles de modification sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles
soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit.
Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licencede
ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique :
U.S. GOVERNMENT END USERS. Oracle programs, including any operating system, integrated software, any programs installed on the hardware,
and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition
Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including
any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license
restrictions applicable to the programs. No other rights are granted to the U.S. Government.
Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas
conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous
utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de
sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses affiliés
déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications.
Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses affiliés.Tout autre nom mentionné peut correspondre à des marques
appartenant à d’autres propriétaires qu’Oracle.
Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des
marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques
déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group.
Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et
des services émanant de tiers. Oracle Corporation et ses affiliés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou
services émanant de tiers. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts
occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.
iii
Contents
Regulatory Compliance Statements xv
Preface xix
1. Product Overview 1
Product Features 1
New Features in the 1.1 Release 2
Key Features 2
Financial Services Support 3
Supported Applications 3
Supported Cryptographic Protocols and Algorithms 3
Diagnostic Support 4
Cryptographic Algorithm Acceleration 4
Hardware Overview 5
LED Displays 6
Direct Input Devices 7
Serial Port 7
USB Port 8
Dynamic Reconfiguration and High Availability 9
Load Sharing 9
iv Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
Hardware and Software Requirements 10
Oracle Solaris 10 OS on SPARC and x86 Platforms 10
x86 AMD Opteron Platforms Running Linux 10
Required Patches 10
2. Installing the Sun Crypto Accelerator 6000 Board 11
Handling the Board 12
Installing the Board on Oracle Solaris Platforms 12
▼Install the Hardware 12
Installing the Sun Crypto Accelerator 6000 Software With the install Script 14
▼Install the Software With the install Script 14
Directories and Files for Oracle Solaris Platforms 18
Removing the Sun Crypto Accelerator 6000 Software on Oracle Solaris Platforms
With the remove Script 19
▼Remove the Software With the remove Script on the CD-ROM 19
▼For Oracle Solaris 11, Remove the Software With the remove Script 20
Installing the Software on Oracle Solaris Platforms Without the Installation
Script 21
▼Install the Software Without the install Script 21
Removing the Software on Oracle Solaris Platforms Without the remove Script
23
▼Delete Existing Keystores 23
▼Remove the Software Without the remove Script 24
Installing the Sun Crypto Accelerator 6000 Board on Linux Platforms 24
▼Install the Sun Crypto Accelerator 6000 Hardware on Linux Platforms 25
▼Install the Sun Crypto Accelerator 6000 Software on Linux Platforms With
the install Script 25
Installing the Sun Crypto Accelerator 6000 Software on Linux Platforms
Without the install Script 26
▼Install the Software Without the install Script 26
Directories and Files for Linux Platforms 27
Contents v
Removing the Sun Crypto Accelerator 6000 Software on Linux Platforms 28
Removing the Sun Crypto Accelerator 6000 Software With the remove
Script 28
▼Remove the Software With the remove Script 29
▼Remove the Software Without the remove Script 29
Migrating Back to Version 1.0 From 1.1 30
▼Back Up the 1.0 Keystore 30
▼Restore the 1.0 Software and Firmware: 30
3. Administering the Sun Crypto Accelerator 6000 Board 33
Using the scamgr Utility 34
Device and Keystore Security Officers 34
scamgr Syntax 35
scamgr Options 35
Modes of Operation 36
Interactive Mode 37
Single-Command Mode 37
File Mode 37
scamgr Secure Communication 38
Initializing the Board With scamgr 38
Board Initialization 39
▼Perform a Board Initialization 39
Keystore Initialization 40
▼Perform a Keystore Initialization and Create a New Keystore 40
Performing a Keystore Initialization to Use an Existing Keystore 41
▼Perform a Keystore Initialization and Use an Existing Keystore 42
Authentication and Logging In and Out With scamgr 43
scamgr Prompt 43
▼Log In To a Board With scamgr 44
vi Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
▼Log In To a New Board 44
▼Log In To a Board With a Changed Remote Access Key 45
▼Log Out Of a Board With scamgr 46
▼Log In To Another Board 47
Quitting the scamgr Utility 48
▼Quit the scamgr Utility 48
Entering Commands With scamgr 48
Entering scamgr Commands 48
scamgr Commands 49
Getting Help for Commands 56
Managing Keystores With scamgr 57
Multiple Keystore Support 57
Naming Requirements 58
Password Requirements 59
▼Set the Password Requirements 59
▼Change Password Requirements 59
▼Change Passwords 60
Managing Security Officers and Users 60
▼Populate a Keystore With Security Officers 60
▼Populate a Keystore With Users 61
▼List Users 62
▼List Security Officers 62
▼Disable Users 63
▼Enable Users 63
▼Delete Users 63
▼Delete Security Officers 64
Backing Up Configuration and Keystore Data 64
▼Back Up a Device Configuration 64
Contents vii
▼Back Up a Master Key 65
▼Backup A Keystore 66
Locking Keystores to Restrict Access 67
▼Lock a Master Key to Prevent Backups 67
▼Lock a Keystore To Restrict Access 68
▼Enable a Locked Keystore To Enable Access 68
▼Disable a Locked Keystore To Prevent Access 69
Multi-Admin Authentication 69
Managing Multi-Admin Mode With scamgr 70
▼Assign Security Officers the Multi-Admin Role 70
▼Remove a Security Officer From the Multi-Admin Role 70
▼Set the Minimum Number of Security Officers Required to
Authenticate Multi-Admin Commands 71
▼Set a Multi-Admin Command Timeout 71
▼Enable Multi-Admin Mode 72
▼Disable Multi-Admin Mode 72
▼Add Additional Security Officers to the Multi-Admin Role 73
▼Cancel a Multi-Admin Command Originated by the Initiating
Security Officer 74
▼Allow a Multi-Admin Command to Time Out 75
▼Log In to a Board During a Multi-Admin Command as a Security
Officer Not in the Multi-Admin Role 76
▼Attempt to Execute a Multi-Admin Command Without Multi-Admin
Role Permissions 76
Managing Boards With scamgr 77
▼Set the Auto-Logout Time 77
▼Display Board Status 77
▼Load New Firmware 78
▼Reset the Board 79
▼Rekey the Board 79
viii Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
▼Perform a Software Zeroize on the Board 81
▼Use the scamgr diagnostics Command 81
Direct Board Administration 82
USB Backup Support 83
Using the scadiag Utility 85
scadiag Options 86
scadiag Option Examples 87
Managing Services for Oracle Solaris Platforms 90
▼Start and Stop the Services 90
Service Configuration Parameters 91
▼List Service Configuration Parameters 92
▼Modify Service Configuration Parameters 93
Enabling Optional Cryptographic Algorithms 93
▼Enable the SHA-512 Algorithm 93
▼Enable the RC2 CBC Algorithm 94
▼Enable the Multi-part MD5 Algorithm 94
▼Enable the Multi-part SHA1 Algorithm 94
▼Enable the Multi-part SHA512 Algorithm 94
▼Enable the HMAC (MD5 or SHA1) Algorithm 94
Additional Instructions for Administering the Board on Linux Platforms 94
scamgr Program 95
▼Stop the Board on a Linux Platform 95
▼Start the Board on a Linux Platform 95
scadiag Program 95
4. Configuring Centralized Keystores 97
Centralized Keystore Overview 97
Keystore Virtualization 98
Configuring Centralized Keystores 99
Contents ix
Configuring the Directory Server With the scakscfg Utility 99
Configuring the scakiod Service to Use CKS 101
scakiod Service Configuration Options 102
▼Configure the scakiod Service to Use CKS (Oracle Solaris) 104
▼Configure the scakiod Service to Use CKS (Linux) 105
Configuring the scakiod Service to Use SSL With Simple Authentication
105
▼Configure scakiod for Simple Authentication Over SSL 105
Configuring the scakiod Service to Use SSL With Client Certificate
Authentication 107
▼Configure the scakiod Service to Use SSL With Client Certificate
Authentication 107
Adding the Certificate to the Agent Entry in the Directory Server 110
▼Add the Certificate to the Agent Entry in the DS 110
Configuring the Board to Join a Centralized Keystore 112
▼Join a Previously Configured Board to a Centralized Keystore 112
▼Join an Unconfigured Board to a Centralized Keystore 112
Troubleshooting CKS Issues 114
Cannot Contact Server 117
Initial Keystore Search Failed 117
Failed Binding to Server 117
Failed Binding to Server 118
Client Authentication Initialization Failed 118
5. Developing and Administering Financial Services 119
Financial Service Components Overview 120
Financial Services Library Initialization 121
Library Open Function fs_lib_open() 122
Library Shutdown Function fs_lib_close() 122
Session Establishment Function fs_session_open() 123
xSun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
Session Shutdown Function fs_session_close() 124
Financial Services Data Types 124
Key Management Overview 125
Key Separation and Compartmentalization of Risk 125
Permitted Key Forms 126
Direct Key Loading 126
▼Load the MFK 126
▼Enable the MFK 126
▼Load the KEKs 127
▼Change the MFK 127
Key Management Functions 127
Generate Key Function fs_generate_key() 128
Import Key Function fs_import_key() 129
Export Key Function fs_export_key() 130
Translate Key Function fs_translate_key() 131
Retrieve Object Function fs_retrieve_object() 132
Status Function fs_status() 133
PIN Processing Functions 133
PIN Block Formats 134
ANSI/ISO Format 0 134
ISO Format 1 135
PIN Calculation Methods 135
Visa PVV Method 135
IBM-3624 Method 136
Personal Account Number 136
PIN 136
PVKI 137
PIN Verify Function fs_pin_verify() 137
Contents xi
PIN Translate Function fs_pin_translate() 138
Credit Card Processing Overview 140
Financial Services Library Function fs_card_verify(3) 140
Enabling the Financial Services Feature 141
▼Enable Financial Services 141
Administering Financial Services 142
Financial Services Security Officers 142
Direct Input Device 142
Setting Financial Services Mode 142
Administrative Commands 142
6. Developing PKCS#11 Applications for Use With the Sun Crypto Accelerator
6000 Board 145
Board Administration 146
Slot Descriptions 147
Keystore Slot 147
Sun Metaslot 148
Configuring Sun Metaslot to Use the Sun Crypto Accelerator 6000
Keystore 148
Configuring Secure Failover for Sun Metaslot 149
Hardware Slot 150
PKCS#11 and FIPS Mode 151
Developing Applications to Use PKCS#11 152
Sun Crypto Accelerator 6000 PKCS#11 Implementation Specifics 152
Token Objects 152
Supported and Unsupported Functions 153
Random Number Generator 153
Software Attributes 154
Software Error Codes 155
Token Object Handles 156
xii Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
Developing PKCS#11 Applications for Use With the Sun Crypto Accelerator 6000
Board on Linux Platforms 156
7. Installing and Configuring Sun Java System Server Software 157
Administering Security for Sun Java System Web Servers 158
Web Server Concepts and Terminology 158
Users 158
Keystores 159
Slots and Tokens 160
Preparing to Configure Sun Java System Web Servers 161
Populating a Keystore 162
▼Populate a Keystore 162
Installing and Configuring Sun Java System Web Server 6.1 163
▼Install Sun Java System Web Server 6.1 164
▼Create a Trust Database 165
▼Register the Board With the Web Server 166
▼Generate a Server Certificate 167
▼Install the Server Certificate 170
▼Enable the Web Server for SSL 171
Installing and Configuring Sun Java System Web Server 7.0 Update 1 173
▼Install Sun Java System Web Server 7.0 174
▼Register the Board With the Web Server 174
▼Start the Sun Java System Web Server Administration Server 175
▼Manage the Tokens 176
▼Disable Unused Tokens 176
▼Pre-Set the Password for Tokens 176
▼Generate a Server Certificate 177
▼Install the Server Certificate 178
▼Deploy the Change 180
Contents xiii
▼Enable the Web Server for SSL 181
▼Start the Web Server 184
Installing and Configuring Sun Java System Web Server on Linux Platforms 184
Configuring Sun Java System Web Servers to Start Up Without User Interaction
on Reboot 186
▼Create an Encrypted Key for Automatic Startup of Sun Java System Web
Servers on Reboot 186
8. Installing and Configuring Apache Web Server Software 189
Installing and Configuring Apache Web Server on Oracle Solaris Platforms 189
▼Create a Private Key and Certificate 189
▼Enable Apache Web Server 191
Installing and Configuring Apache Web Server on Linux Platforms 192
▼Prepare OpenSSL Libraries 193
▼Compile Apache Web Server 194
▼Configure and Start Apache Web Server 194
9. Diagnostics and Troubleshooting 197
Diagnostic Software 197
Performing SunVTS Diagnostics 197
Performing scamgr Diagnostics 198
Performing scadiag Diagnostics 198
Disabling Crypto Traffic on Other Hardware Providers in Your System 198
▼Disable Other Hardware Providers 199
▼Reenable Other Hardware Providers 199
Examining and Reporting Kernel Statistics 199
▼Determine Cryptographic Activity With the kstat Utility 200
Determining Cryptographic Activity on Linux Platforms 201
▼Determine Cryptographic Activity on Linux Platforms 201
A. Sun Crypto Accelerator 6000 Board Specifications 203
xiv Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
Connectors 203
Physical Dimensions 204
Power Requirements 205
Environmental Specifications 205
B. Installing and Configuring openCryptoki Software for Linux 207
Overview 207
Installing openCryptoki Software 208
▼Install openCryptoki Software on RHEL5 208
▼Build and Install openCryptoki on RHEL4 Updates 208
▼Build and Install openCryptoki Software on SUSE10 SP1 Platforms 209
C. Software Licenses 211
Third Party License Terms 216
D. Manual Pages 221
E. Zeroizing the Hardware 223
Zeroizing the Sun Crypto Accelerator 6000 Hardware to the Factory State 223
▼Zeroize the Sun Crypto Accelerator 6000 Board With a Hardware
Jumper 224
F. Financial Services Header File 227
G. Supported PKCS#11 Mechanisms 235
Index 239
xv
Regulatory Compliance Statements
Your Sun product is marked to indicate its compliance class:
■Federal Communications Commission (FCC) — USA
■Industry Canada Equipment Standard for Digital Equipment (ICES-003) — Canada
■Voluntary Control Council for Interference (VCCI) — Japan
■Bureau of Standards Metrology and Inspection (BSMI) — Taiwan
Please read the appropriate section that corresponds to the marking on your Sun product before attempting to install
the product.
FCC Class B Notice
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:
1. This device may not cause harmful interference.
2. This device must accept any interference received, including interference that may cause undesired operation.
Note: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in
a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio communications. However,
there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful
interference to radio or television reception, which can be determined by turning the equipment off and on, the user
is encouraged to try to correct the interference by one or more of the following measures:
■Reorient or relocate the receiving antenna.
■Increase the separation between the equipment and receiver.
■Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
■Consult the dealer or an experienced radio/television technician for help.
Shielded Cables: Connections between the workstation and peripherals must be made using shielded cables in
order to maintain compliance with FCC radio frequency emission limits. Networking connections can be made using
unshielded twisted pair (UTP) cables.
Modifications: Any modifications made to this device that are not approved by Sun Microsystems, Inc. may void
the authority granted to the user by the FCC to operate this equipment.
ICES-003 Class B Notice - Avis NMB-003, Classe B
This Class B digital apparatus complies with Canadian ICES-003.
Cet appareil numérique de la classe B est conforme à la norme NMB-003 du Canada.
xvi Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
xvii
BSMI Class A Notice
The following statement is applicable to products shipped to Taiwan and marked as Class A on the product
compliance
label.
xviii Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
xix
Preface
This guide lists the features, protocols, and interfaces of the Sun Crypto Accelerator
6000 Board from Oracle and describes how to install, configure, and manage the
board in your system.
This guide assumes that you are a network administrator with experience
configuring one or more of the following
■Oracle Solaris Operating System (OS)
■Sun platforms with PCI I/O cards
■Sun Java Web System Servers and Apache Web Servers
■IPsec
■SunVTS software
■certification authority acquisitions.
Note – In this document these x86 related terms mean the following:
– “x86” refers to the larger family of 64-bit and 32-bit x86 compatible products.
– “x64” points out specific 64-bit information about AMD64 or EM64T systems.
– “32-bit x86” points out specific 32-bit information about x86 base systems. For
supported systems, see “Hardware and Software Requirements” on page 10.
Product Notes
For late-breaking information and known issues about this product, refer to the
products notes at:
http://docs.oracle.com/cd/E19321-01/index.html
xx Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 • February 2013
Related Documentation
Feedback
Provide feedback about this documentation at:
http://www.oracle.com/goto/docfeedback
Access to Oracle Support (R)
Oracle customers have access to electronic support through My Oracle Support. For
information visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=
info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs
if you are hearing impaired.
Documentation Link
All Oracle products http://www.oracle.com/documentation
Sun Crypto Accelerator 6000
Board
http://docs.oracle.com/cd/E19321-01/index.html
Sun Crypto Accelerator 4000 PCI
Card
http://docs.oracle.com/cd/E19877-01/index.html
Oracle Solaris OS and systems
software library
http://www.oracle.com/technetwork/indexes/documentation/
index.html#sys_sw
Table of contents
