Changing the Cryptoki provider
This section applies to the ProtectToolkit(PTK)-C SDK package only and describes how to change the Cryptoki provider.
Different ProtectToolkit-C Cryptoki provider files are required, depending on whether you are using ProtectToolkit-C SDK with a ProtectServer 3 HSM (PCI or Network operating mode) or without a ProtectServer 3 HSM (Software Emulator operating mode). For more information about operating modes, refer to Operating modes.
Both Cryptoki provider files are installed with the ProtectToolkit-C SDK package. On Windows systems, you are prompted during installation to choose which Cryptoki provider file is made active. On Linux systems, the Software Emulator Cryptoki provider file is made active by default. In both cases, you can change the Cryptoki provider after installing the ProtectToolkit-C SDK and configuring Cryptoki.
Caution
Software Emulator mode is not secure because cryptographic material is stored on the host system.
On Windows systems, you can change the Cryptoki provider by doing one of the following:
-
Using the SetHsmMode.ps1 PowerShell script (ProtectToolkit 7.2.0 and newer only)
Modifying the ProtectToolkit Windows installation
You can use the Windows client installer to change the Cryptoki provider. For more information, refer to Modifying the ProtectToolkit Windows installation.
Using the SetHsmMode.ps1 Windows PowerShell script
Thales provides a PowerShell script (SetHsmMode.ps1) with ProtectToolkit 7.2.0 and newer that you can use to change the Cryptoki provider.
To change the Cryptoki provider using SetHsmMode.ps1
-
Open PowerShell as administrator.
-
Change directory to C:\Program Files\Safenet\ProtectToolkit 7\C SDK\bin.
-
Run the SetHsmMode.ps1 script by running the following command:
.\SetHsmMode.ps1
You are then prompted to select an operating mode.
CRYPTOKI Mode Selector ---------------------- [SW] Software Emulator Library [HW] Runtime (HW) Library Select from above options (SW/HW): -
Enter SW or HW.
A prompt appears confirming the newly selected operating mode. For example, the following prompt appears if HW is selected:
SFNT_CRYPT path set to HW Cryptoki path set to HW
After receiving the prompt shown above, you have successfully changed the Cryptoki provider.
On Linux systems, you can change the Cryptoki provider by doing one of the following:
Changing the Cryptoki provider with the Unix Installation Utility
You can use the Unix Installation Utility to change the Cryptoki provider.
To change the Cryptoki provider with the Unix Installation Utility
-
From the main menu, select Set the default cryptoki and/or HSM link.
The Cryptoki Selection screen is displayed.
Gemalto Unix Installation Utility: Hostname: 66 (Linux 2.6.32-504.16.2.el6.i686) Main Menu >> Check/Set Default Cryptoki & HSM Menu -------------------- Cryptoki Selection -------------------- 1 SafeNet ProtectToolkit C SDK Software (emulator) 2 * SafeNet ProtectToolkit C SDK Runtime (hardware) 3 * SafeNet Network HSM Access Provider b back q quit the utility Choice (1 2 3 b q) [Redraw]: -
Select SafeNet ProtectToolkit C SDK Runtime (hardware) and confirm your selection.
Changing the Cryptoki provider manually
You can change the Cryptoki provider manually.
To change the Cryptoki provider manually
-
Remove the soft-link.
/opt/safenet/protecttoolkit7/ptk/lib/libcryptoki.so -
Recreate the soft-link to point to the SafeNet HSM Cryptoki provider. For example:
The following shell commands are used to enable the HSM (executed as the super-user):
# cd /opt/safenet/protecttoolkit7/ptk/lib # rm libcryptoki.so # ln -s libcthsm.so libcryptoki.soThe following shell commands are used to enable the software emulation (executed as the super-user):
# cd /opt/safenet/protecttoolkit7/ptk/lib # rm libcryptoki.so # ln -s libctsw.so libcryptoki.so
