Initializing the Remote PED Vector and Creating an Orange Remote PED Key
The Remote PED (via PEDserver) authenticates itself to the Luna Network HSM with a randomly-generated encrypted value stored on an orange PED key. That secret originates in an HSM, and can be carried to other HSMs via the orange key. An HSM being newly configured either
>generates its own RPV secret to imprint on an orange PED Key,
or
>accepts a pre-existing RPV from a previously imprinted orange key, at your discretion.
The orange key proves to the HSM that the Remote PED is authorized to provide authentication for HSM roles. A Luna Network HSM administrator can create this key using one of the following two methods:
>Local RPV Initialization: The RPV is initialized using a Luna PED connected to the USB port on the HSM card. This is the standard method of initializing the RPV.
>Remote RPV Initialization: The RPV is initialized using a Luna PED connected to a remote workstation running PEDserver. A one-time numeric password is used to authenticate the Remote PED to the HSM before initializing the RPV.
Continue to Installing PEDserver and Setting Up the Remote Luna PED.
NOTE Generally, the HSM SO creates an orange PED key (and backups), makes a copy for each valid Remote PED server, and distributes them to the Remote PED administrators.
Local RPV Initialization
If the HSM is already initialized, the HSM SO must log in to complete this procedure. You require:
>Luna PED with firmware 2.7.1 or newer
>USB mini-B to USB-A connector cable
>Luna PED DC power supply (if included with your Luna PED)
>Blank or reusable orange PED key (or multiple keys, if you plan to make extra copies or use an M of N security scheme). See Creating PED Keys for more information.
NOTE Orange PED Keys (RPK) for use with HSMs at firmware 7.7 or newer, with enhanced security to address modern threat environments and to comply with updated standards, have increased infrastructure onboard the key. If such an initialized RPK is overwritten to become a different role PED Key (example SO), this process that formerly would take about six seconds now takes about 36 seconds.
To initialize the RPV and create the orange PED key locally
1.If you have not already done so, set up a Local PED connection (see Local PED Setup).
2.Using a serial or SSH connection, log in to the Luna Network HSM appliance as admin.
3.If the HSM is initialized, login as HSM SO (see Logging In as HSM Security Officer). If not, skip to the next step.
lunash:> hsm login
4.Ensure that you have the orange PED key(s) ready. Initialize the RPV.
lunash:> hsm ped vector init
5.Attend to the Luna PED and respond to the on-screen prompts. See Creating PED Keys for a full description of the key-creation process.
•If you have an orange PED key with an existing RPV that you wish to use for this HSM, press Yes.
•If you are creating a new RPV, press No.
Continue following the prompts for PED PIN, M of N, and duplication options.
To continue setting up a Remote PED server, see Installing PEDserver and Setting Up the Remote Luna PED.
Remote RPV Initialization
When you initialize an RPV with the PED connected locally, you have direct physical control of the operation and its security.
When you initialize an RPV remotely, you must secure the link and the operation with a one-time password. The HSM must be uninitialized for this operation.
NOTE This feature requires minimum Luna Network HSM appliance software version 7.2.0 and Luna HSM Client 7.2.0. See Version Dependencies by Feature for more information.
Use the following procedure to initialize the RPV. You require:
> A blank or reusable orange PED key (or multiple keys, if you plan to make extra copies or use an M of N security scheme). See Creating PED Keys for more information.
>The HSM must be in a zeroized state and the RPV uninitialized.
To initialize the RPV and create the orange key remotely
1.Open an HSM-initiated Remote PED connection.
lunash:> hsm ped connect
The Remote PED connection command prepares to secure the connection and LunaSH returns the following message:
Luna PED operation required to connect to Remote PED - use orange PED key(s). Enter PED Password:
In LunaSH, when prompted to "Enter PED Password" set any 8-digit numeric one-time password that the HSM will use to identify the Remote PED server. The following message is displayed in LunaSH, and the Luna PED prompts you for the password:
Luna PED operation required to connect to remote PED - Enter PED password.
2.Enter the numeric password on the PIN pad, exactly as
3.Ensure that you have the orange PED key(s) ready. Initialize the RPV.
lunash:> hsm ped vector init
4.Attend to the Luna PED and respond to the on-screen prompts. See Creating PED Keys for a full description of the key-creation process.
When you have created the orange key, the HSM
Ped Client Version 2.0.1 (20001) Ped Client launched in "Release ID" mode. Callback Server is running.. ReleaseID command passed. "Release ID" command passed. Ped Client Version 2.0.1 (20001) Ped Client launched in "Delete ID" mode. Callback Server is running.. DeleteID command passed. "Delete ID" command passed. Command Result : 0 (Success)
You may now initialize the HSM. See Initializing the HSM for more information.
NOTE After creating the orange (Remote PED Vector) key for an HSM using the single-session, one-time password authenticated PED connection that is used to create the key, the PED prompts for the one-time password when you end the session using ped disconnect.
You can ignore the prompt. The PED session is disconnected properly by pressing the Enter key on the PED, without entering the password.
