Initialize the Crypto User Role on a PED-Authenticated Partition
These instructions assume:
>A PED-authenticated SafeNet Luna PCIe HSM has been initialized
>An application partition has been created
>A Crypto Officer has been created for the partition
>The Crypto Officer PED key has been conveyed to the person responsible for the Crypto Officer role. See Initialize the Partition SO and Crypto Officer Roles on a PED-Auth Partition.
As Crypto Officer, you can:
>Create a Crypto User (limited access user) for the application partition.
>Create, delete, change and manipulate cryptographic objects on the application partition, either for your own use or for use by the Crypto User.
>Activate the partition for use by applications.
To create a Crypto User for the partition, you will need:
>Luna PED and the black Crypto Officer PED key(s) assigned to you by the SO.
>Blank PED key(s) with labels for the Crypto User that you are about to create.
>A local PED connection.
These instructions assume that you have already made your decisions whether to use all-new, blank PED keys, or to re-use any existing, imprinted PED keys for any of the steps.
To create the Crypto User role on a PED-authenticated application partition:
1.Set the active slot to the desired application partition, where the Crypto Officer was just created.
lunacm:> slot set -slot <slotnum>
lunacm:> slot set -slot 0
Current Slot Id: 0 (Luna User Slot 7.0.0 (PED) Signing With Cloning Mode)
Command Result : No Error
2.Log in as the Crypto Officer. You can also use the shortcut co.
lunacm:>role login -name Crypto Officer
lunacm:>role login -name co
Please attend to the PED.
Respond to Luna PED prompts...
Command Result : No Error
NOTE The black Crypto Officer PED key is valid for the initial login only. You must change the initial credential on the key using the command role changepw during the initial login session, or a subsequent login. Failing to change the credential will result in a CKR_PIN_EXPIRED error when you perform role-dependent actions.
3.If you have not already done so, change the initial credential set by the Partition SO.
lunacm:>role changepw -name Crypto Officer
lunacm:>role changepw -name co
Please attend to the PED.
Respond to Luna PED prompts. You must first present the black Crypto Officer key and PIN created by the Partition SO. When you are prompted to present a new black CO key, you can create a new key, or overwrite the original PED key by:
a.Replying No to "Would you like to reuse an existing keyset?"
b.Pressing Enter (without removing the key) when prompted to present a new black PED key
c.Replying Yes when asked if you want to overwrite the original key.
Command Result : No Error
4.Create the Crypto User. You can also use the shortcut cu. Have a gray Crypto User PED key ready.
role init -name Crypto User
lunacm:> role init -name Crypto User Please attend to the PED.
Respond to Luna PED prompts...
Command Result : No Error
NOTE The gray Crypto User PED key is valid for the initial login only. The CU must change the initial credential on the key using the command role changepw during the initial login session, or a subsequent login. Failing to change the credential will result in a CKR_PIN_EXPIRED error when they perform role-dependent actions.
The Crypto User can now log in to use applications to perform cryptographic operations using keys and objects created in the partition by the Crypto Officer.
Crypto Officer or Crypto User Must Remain Logged In
At this point, the Crypto User, or an application using the CU's challenge secret/password can perform cryptographic operations in the partition, as soon as the Crypto User logs in with role login -name cu. However, any event that causes that session to close, including action by the application, requires that the CU must log in again (with the gray PED key) before the application partition can be used again. For an application that maintains an open session, that is not a handicap. For an application that opens a session for each action, performs the cryptographic action, then closes the session, the CU must be constantly logging in and using the PED and PED key.
To bypass this limitation, use the Activation feature. See Activate a PED-Authenticated Partition.