Administration & Maintenance - Managing PED Keys
These options, to create group PED Keys and duplicate PED Keys, can introduce complexity and another kind of risk to the management of PED Keys, especially when the options are combined. In many establishments, security policy demands that passwords be changed on a regular basis. Naturally, passwords/PINs on HSMs, Partitions and tokens and PED Keys can be changed as needed.
However, what might be a simple procedure for a single key (Change PIN) can quickly take on new dimensions when there might also be a backup PED Key in off-site safe storage, and there might be several working copies of the PED Key in the hands of Owners, alternate/backup Owners, and alternate/backup HSM Admins. Additionally, there might be several tokens, Partitions, or HSM Servers that are unlocked by any of the PED Keys (if you chose the group PED Key option when creating any of those).
The issue is that when authentication data is changed on a PED Key, it must be changed on the associated HSM or Backup Token at the same time; otherwise the two no longer match and the PED Key can no longer unlock the HSM (or Partition) or the token. The changePw procedure does take care of this for the HSM (or Partition) or token and for the blue (or black, as appropriate) PED Key that is in the Luna PED slot when the change command is issued. There is also provision (explained in following pages) for having other accessible PED Keys updated, during the procedure, to maintain synchronization with the HSM (or Partition) or Backup Token.
But, what about the set of backup PED Keys that you have sensibly stored off-site? If they are not brought in and updated during the same update procedure, they are no longer backups. Your security and maintenance procedures must address this situation.
To ease the task of updating multiple PED Keys,without a complicated dance involving all sets during the same update event, the PED provides a method of stand-alone, "raw" key duplication.
[ < ] to exit Local PED mode to the main PED menu
[ 4 ] to enter Admin mode
[ 1 ] to enter PED Key mode
[ 1 ] again to bypass key login, which is not applicable to the iKey 1000 model in current use
and then
[ 7 ] to duplicate whichever key is presented next.
This is applicable to all imprinted PED Keys except the purple SRK (excluded for security reasons).
Because the above is a "raw" duplication, there is no opportunity to modify any PED PIN that is already associated with the presented source key. Duplicates by this method are exact.
Once you have updated any or all members of a working set of PED Keys, you can take one of those keys and a PED to any other location where duplicate sets were maintained (onsite backup, offsite backup, etc.) and update your backups without any need to involve the HSM. Always be aware of the location and state of any Luna PED key, and keep scrupulous records of all changes and hand-offs. Your security auditors will thank you.
.