mkfm

Synopsis

mkfm -f <filename> -k <key> -o <filename> [-c][-b][-e <PED> | -p <password>] [-u <user>]   

Description

The mkfm utility is used to time-stamp, hash, and sign an FM binary image.

NOTE   At time of initial release for use with Luna HSMs, MKFM supports only RSA private keys that reside on a Luna token. The signing mechanism uses RSA-SHA512.  

Options

The following options are supported:

Parameter	Shortcut	Description
--input-file=<filename>	-f<filename>	Specifies the relative, or full, path to the FM binary image.
--signer-key=<key>	-k<key>	This is the name of the private key that is going to be used to sign the FM image. The format of the key is <TokenName (PIN) /KeyName>, or <TokenName/KeyName>. TokenName is the label of the token or you can use SLOTID=x, where x is the slot id number.
--output-file=<filename>	-o<filename>	This specifies the relative or full path to the loadable FM image.
--password=<Password>	-p<password>	Optional parameter to specify user password when performing ctfm operations in batch mode.
--user=<user>	-u <user>	Optional parameter to specify which user role to login as default CO User : slot user role name. Default is USER Role: •'ad' on Admin partition •'co' on User partition •'cu' (specify slot number in key spec and use -u? to get a list)
--no-banner	-b	Do not show program banner during startup
--ped=<PED>	-e<PED>	Remote PED ID. Default is 0 (zero). Check lunacm to find the value (usually 100) to insert here.
--compat	-c	Compatibility mode – inhibit the use of Luna custom extension functions that would stop the tool from working with a standard Cryptoki provider. If the tool displays error messages referring to missing functions then these may be suppressed by adding FunctionBindLevel=2 to the misc section of /etc/Chrystoki.conf

NOTE   The long forms require two leading dashes for each option. The short forms take a single leading dash, and an optional space.