Cloning
The simplest method of migrating key material to a new 7.x partition is slot-to-slot cloning. This procedure copies all permitted cryptographic material from a 5.x/6.x USB HSM partition to a 7.x Network HSM partition.
The new configuration's operating system must be compatible with both the new 7.x and the old 5.x/6.x hardware. Consult the 5.x/6.x CRN for a list of compatible operating systems.
To clone cryptographic keys from one HSM to another, the HSMs must share the same cloning domain. For password-authenticated HSMs, this domain should have been specified when the partition was initialized. For PED-authenticated HSMs, the red key determines the cloning domain. You will need the same red key that was imprinted during 5.x/6.x partition creation to initialize the 7.x partition (see HSM Initialization).
The 7.x client software should be installed, and the connection to both the source and destination partitions verified, before attempting this procedure (see SafeNet Luna HSM Client Software Installation for details). The source and destination partitions must both be assigned to the client machine issuing the cloning commands
If the source partition contains asymmetric keys, its security policy must allow cloning of private and secret keys. Use the command partition showpolicies in LunaCM to ensure that your source partition's security template allows this (see partition showpolicies). If the 5.x/6.x HSM's security template does not allow cloning of private/secret keys, the HSM Admin may be able to turn this feature on using partition changepolicy (see partition changepolicy).
CAUTION! Check your source partition policies and adjust them to be sure you can clone private and symmetric keys. Depending on the configuration of your partition and HSM, these policies may be destructive.
Preconditions
The following instructions assume that:
>the 7.x client software has been installed
>an uninitialized partition has been created on the 7.x Network HSM
>the destination 7.x partition must be registered with the client (visible)
>the source 5.x/6.x partition's security policy allows cloning of private and secret keys
In the following examples:
>Slot 0: the source 5.x/6.x partition
>Slot 1: the destination 7.x partition
NOTE Partition login name requirements have changed with the hardware versions. With release 7.x, you can log in using the abbreviated PO (Partition Security Officer) or CO (Crypto Officer).
To clone cryptographic keys from a 5.x/6.x partition to a 7.x partition
Follow these steps to clone all cryptographic material on a 5.x/6.x partition to a 7.x partition.
1.Run LunaCM, set the current slot to the 7.x partition, and initialize the Partition SO role.
slot list
slot set -slot 1
partition init -label <7.x_partition_label>
a.If you are cloning a PED-authenticated 5.x/6.x partition, use the 5.x/6.x partition's red key when prompted.
b.If you are cloning a password-authenticated 5.x/6.x partition, enter the same cloning domain when prompted.
2.Log in as the po (Partition Security Officer) and initialize the co (Crypto Officer) role.
role login -name po
role init -name co
If you are cloning a PED-authenticated 5.x/6.x partition, you can create an optional challenge secret for the Crypto Officer.
role createchallenge -name co -challengesecret <password>
3.Set the current slot to the source 5.x/6.x slot, log in as the Crypto Officer.
slot set -slot 0
NOTE Be mindful of whether you’re working with pre-PPSO or PPSO firmware and use the “partition login” or “role login” commands as specified below. Also, with PPSO firmware 6.22.0 and up, be careful with user names, i.e., type “Crypto Officer” in full (is case sensitive) and not "co".
a.If you are cloning a release 5.x or 6.x pre-PPSO partition (up to and including Firmware 6.21.2), use:
partition login
b.If you are cloning a release 6.x PPSO partition (Firmware 6.22.0 and up) , use:
role login -name Crypto Officer
4.Optional: To verify the objects in the 5.x/6.x partition to be cloned, issue the “partition contents” command.
partition contents
5.Clone the objects to the 7.x partition slot (see partition clone for correct syntax).
partition clone -objects 0 -slot 1
Afterward, you can set the current slot to the 7.x partition and verify that all objects have cloned successfully.
slot set -slot 1
role login -name co -password <password>
partition contents
You should see the same number of objects that existed on the 5.x/6.x HSM. You can now decommission the old 5.x/6.x HSM.
