Multitoken

Multitoken is a simple demonstration tool that allows you to perform basic cryptographic functions on a SafeNet HSM. The utility allows you to specify an operation, and one or more “slots” or HSM Partitions on which to perform that operation. The multitoken utility runs the operations and returns a summary, or progress report, of the results.

CAUTION:  To achieve maximum performance with SafeNet Network HSM 5.x and 6.x, client applications must spawn 30+ threads. The 10 threads indicated for legacy SafeNet Network HSM 4.x is not sufficient to stress the current product.

Syntax

multitoken-mode <mode> -slots <slot list> [-nodestroy] [-key <key size>] [-curve <curve num>] [-blob <blob count>] [-packet <packet size>] [-logfile <logfile name>] [-force] [-help] [-symm] [-password <password>] [-timed <fixed time>] [-nodec] [-parmfile <param file>] [-noverifyr] [-multipartsignatures] [-subprime <subprime size>] [-noverify] [-nslots] [-keychoice <key index>] [-kdfchoice <kdf index>] [-kdfscnt [counter index>] [-sharefile <data file>] [-noenc] [-nosign] [-verbose] [-alarm <secs>] [-template]

Operating Modes

The following table lists the available operating modes for the multitoken utility. The operating mode is specified using the -mode parameter.

Notes

1.If you are performing RSA operations, you have the option of specifying a key size (512, 1024, 2048, 4096, 8192). If no key size is specified, the default key size of 1024 will be used. For example:

multitoken -mode rsasigver -key 512 -slots 1

2.If you are performing wrapunwrap operation, it will perform the following operations:

–Generate RSA key pair and a symmetric DES key.

–Wrap DES key with RSA public key.

–Unwrap wrapped key above with RSA private key.

– Verify the unwrapped key.

3.If you are performing a Multisign operation, you have the option of specifying a key size (512, 1024, 2048, 4096, 8192). If no key size is specified, the default key size of 1024 will be used. You must also specify a blob count, indicating the number of data blobs to be signed during each multisign operation. For example:

multitoken -mode multisignvalue -key 512 -blob 10 -s 1,1,2,2,2 
multitoken -mode multisignvalue -blob 10 -s 1,1,2,2,2,2

4.A thread will be spawned to perform tests on each slot specified. A slot can be specified multiple times, in which
case multiple threads will be created for the slot.

5.Options for the followiong modes can be used with the default 1024 bit key size only:

–sha256rsasign - SHA256 with RSA

–sha384rsasign - SHA384 with RSA

–sha512rsasign - SHA512 with RSA

If you specify a keysize on the command line (any of 1024, 2048 or 4096), the result is the 1024 bit benchmark speed, and a file called "1024" or "2048" or "4096" is created - that is the keysize parameter is parsed as a filename to which results are saved.

Named and User-defined Curves

The SafeNet HSMs employ named and user-defined curves.Multitoken supports this option, as illustrated in the following example:

C:\Program Files\SafeNet\LunaClient>multitoken -mode ecdsasigver -s 1,1,1,1,1,1,1,1

Prime field curves:

[0]secp112r1  
[1]secp112r2
[2]secp128r1 
[3]secp128r2
[4]secp160k1  
[5]secp160r1 
[6]secp160r2  
[7]secp192k1
[8]secp224k1 
[9]secp224r1 
[10]secp256k1 
[11]secp384r1
[12]secp521r1
[13]X9_62_prime192v1 
[14]X9_62_prime192v2 
[15]X9_62_prime192v3
[16]X9_62_prime239v1 
[17]X9_62_prime239v2 
[18]X9_62_prime239v3
[19]X9_62_prime256v1

Characteristic two field curves:

[20]sect113r1 
[21]sect113r2 
[22]sect131r1 
[23]sect131r2
[24]sect163k1 
[25]sect163r1 
[26]sect163r2 
[27]sect193r1
[28]sect193r2 
[29]sect233k1 
[30]sect233r1 
[31]sect239k1
[32]sect283k1 
[33]sect283r1 
[34]sect409k1 
[35]sect409r1
[36]sect571k1 
[37]sect571r1
[38]X9_62_c2pnb163v1 
[39]X9_62_c2pnb163v2 
[40]X9_62_c2pnb163v3

[41]X9_62_c2pnb176v1 
[42]X9_62_c2tnb191v1 
[43]X9_62_c2tnb191v2
[44]X9_62_c2tnb191v3 
[45]X9_62_c2pnb208w1 
[46]X9_62_c2tnb239v1
[47]X9_62_c2tnb239v2
[48]X9_62_c2tnb239v3 
[49]X9_62_c2pnb272w1
[50]X9_62_c2pnb304w1 
[51]X9_62_c2tnb359v1 
[52]X9_62_c2pnb368w1
[53]X9_62_c2tnb431r1
[54]Brainpool_P160r1 
[55]Brainpool_P160t1 
[56]Brainpool_P192r1
[57]Brainpool_P192t1 
[58]Brainpool_P224r1 
[59]Brainpool_P224t1
[60]Brainpool_P256r1 
[61]Brainpool_P256t1 
[62]Brainpool_P320r1
[63]Brainpool_P320t1 
[64]Brainpool_P384r1 
[65]Brainpool_P384t1
[66]Brainpool_P512r1 
[67]Brainpool_P512t1

Please pick a curve (0-67) or enter (99) for a user defined curve:99

Please enter the filename for the EC parameters:

Here, you would provide the filepath to the file specifying the Elliptical Curve parameters. The format and content of the parameter file follow industry standards, and are discussed in more detail in Named Curves and User-Defined Parameters in the SDK Reference Guide.

SafeNet PCIe HSM 6.3 Product Documentation
007-011329-012 Rev. A 14 July 2017 Copyright 2001-2017 Gemalto All rights reserved.