Guarding CTE files with CTE-U
CTE-U can read and write CTE files encrypted with a CS1 key on a local drive, (XFS or EXT 4). The kernel files contain a CTE header that is already compatible with CTE-U, however, that header is stored as an extended attribute on the file, and not as an embedded header.
Local file systems in CTE with CS1 keys also store header information in an extended attribute. When opening the file, if CTE-U does not find an embedded header, it looks for the existence of a header in the extended attributes.
Note
Thales recommends that you perform a backup in CTE and restore the backup to CTE-U. In CTE to CTE-U migration, in your policy, you must have full write permissions (permit, audit, all_ops, applykey) on the files copied from the CTE backup to the CTE-U GuardPoint.
Using Data Transformation to convert file headers
Data Transformation can convert the header files in the CTE from extended attribute files to embedded header files.
To convert the files, after applying your Data Transformation production policy to your GuardPoint, run the following command:
dataxform --scan --embed --gp <GP>
This forces the conversion of all file sizes so they display correctly.
See Rekeying with Data Transformation for more information.
