Initializing the Remote PED Vector and Creating an Orange Remote PED Key
The Remote PED (via PEDserver) authenticates itself to the Luna PCIe HSM with a randomly-generated encrypted value stored on an orange PED key. That secret originates in an HSM, and can be carried to other HSMs via the orange key. An HSM being newly configured either
>generates its own RPV secret to imprint on an orange PED Key,
or
>accepts a pre-existing RPV from a previously imprinted orange key, at your discretion.
The orange key proves to the HSM that the Remote PED is authorized to provide authentication for HSM roles. A Luna PCIe HSM administrator can create this key using one of the following two methods:
>Local RPV Initialization: The RPV is initialized using a Luna PED connected to the USB port on the HSM card. This is the standard method of initializing the RPV.
>Remote RPV Initialization: The RPV is initialized using a Luna PED connected to a remote workstation running PEDserver. A one-time numeric password is used to authenticate the Remote PED to the HSM before initializing the RPV. It is available only if the HSM is in a zeroized state (uninitialized) and your firewall settings allow an HSM-initiated Remote PED connection. If you choose this method, you will set up Remote PED before initializing the RPV (Remote RPV Initialization).
Continue to Installing PEDserver and Setting Up the Remote Luna PED.
NOTE Generally, the HSM SO creates an orange PED key (and backups), makes a copy for each valid Remote PED server, and distributes them to the Remote PED administrators.
Local RPV Initialization
If the HSM is already initialized, the HSM SO must log in to complete this procedure. You require:
>Luna PED with firmware 2.7.1 or newer
>USB mini-B to USB-A connector cable
>Luna PED DC power supply (if included with your Luna PED)
>Blank or reusable orange PED key (or multiple keys, if you plan to make extra copies or use an M of N security scheme). See Creating PED Keys for more information.
NOTE Orange PED Keys (RPK) for use with HSMs at firmware 7.7 or newer, with enhanced security to address modern threat environments and to comply with updated standards, have increased infrastructure onboard the key. If such an initialized RPK is overwritten to become a different role PED Key (example SO), this process that formerly would take about six seconds now takes about 36 seconds.
To initialize the RPV and create the orange PED key locally
1.If you have not already done so, set up a Local PED connection (see Local PED Setup).
2.Launch LunaCM on the Luna PCIe HSM host workstation.
3.If the HSM is initialized, login as HSM SO (see Logging In as HSM Security Officer). If not, skip to the next step.
lunacm:> role login -name so
4.Ensure that you have the orange PED key(s) ready. Initialize the RPV.
lunacm:> ped vector
5.Attend to the Luna PED and respond to the on-screen prompts. See Creating PED Keys for a full description of the key-creation process.
•If you have an orange PED key with an existing RPV that you wish to use for this HSM, press Yes.
•If you are creating a new RPV, press No.
Continue following the prompts for PED PIN, M of N, and duplication options.
To continue setting up a Remote PED server, see Installing PEDserver and Setting Up the Remote Luna PED.
Remote RPV Initialization
When you initialize an RPV with the PED connected locally, you have direct physical control of the operation and its security.
When you initialize an RPV remotely, you must secure the link and the operation with a one-time password. The HSM must be uninitialized for this operation.
NOTE This feature requires minimum Luna HSM firmware 7.7.0 and Luna HSM Client 10.3.0. See Version Dependencies by Feature for more information.
Use the following procedure to initialize the RPV. You require:
> A blank or reusable orange PED key (or multiple keys, if you plan to make extra copies or use an M of N security scheme). See Creating PED Keys for more information.
>The HSM must be in a zeroized state and the RPV uninitialized.
To initialize the RPV and create the orange key remotely
1.Open an HSM-initiated Remote PED connection.
lunacm:> ped connect
The Remote PED connection command prepares to secure the connection and LunaCM presents a randomly-generated 8-digit numeric one-time password that the HSM will use to identify the Remote PED server.
Please attend to the PED and enter following password: 18246843 Command Result : No Error
The remote Luna PED prompts you for the one-time password:
2.Enter the numeric password on the PIN pad, exactly as
3.Set the active slot to the Luna PCIe HSM admin partition.
4.Ensure that you have the orange PED key(s) ready. Initialize the RPV.
lunacm:> ped vector init
5.Attend to the Luna PED and respond to the on-screen prompts. See Creating PED Keys for a full description of the key-creation process.
When you have created the orange key, the HSM establishes a Remote PED connection using the newly-created RPV.
You may now initialize the HSM. See Initializing the HSM for more information.
NOTE After creating the orange (Remote PED Vector) key for an HSM using the single-session, one-time password authenticated PED connection that is used to create the key, the PED prompts for the one-time password when you end the session using ped disconnect.
You can ignore the prompt. The PED session is disconnected properly by pressing the Enter key on the PED, without entering the password.
