Breadcrumbs

Initialize and Authorize Key for CP5

Skip this section if you are not using CP5 HSM.

In CP5 a private key cannot be used without being authorized. For authorizing a key, you first need to initialize the private key with an authorization key then set the authorization with the AuthorizeKey command.

  1. List keys using the cxitool.

›_ Console

# cxitool dev=3001@127.0.0.1 LogonPass=USR_0000,123456 listkeys

tmp_fa6olpi.jpg

cxitool listkeys output

Note down spec id for RSA private key. In above case it is 3.

  1. Check the status of the key initialization using the cxitool.

›_ Console

# cxitool dev=3001@127.0.0.1 LogonPass=USR_0000,123456 group="SLOT_0000" spec=3 Keyinfo

tmp19uftf7q.jpg

Key initialized status

  1. The initialized status is false.
    Run the command below to generate a user authentication key file ka.key, which contains an RSA key pair of the speciied size. This authentication key will be used to initialize the DKE_Key in the next step.

›_ Console

# ./csadm genkey=ka.key,2048,"USR_0000" generating RSA key: ka.key, 2048 bits, owner: USR_0000

  1. Initialize the DKE_Key with the ka.key file using the cxitool.

›_ Console

# cxitool dev=3001@127.0.0.1 LogonPass=USR_0000,123456 group="SLOT_0000"

Spec=3 KeyFile=ka.key InitializeKey

tmpr2ou55l5.jpg

Initialize the DKE_Key with the ka.key file

  1. Authorize DKE_Key with the Authentication Key file ka.key.

›_ Console

#cxitool dev=3001@127.0.0.1 LogonPass=USR_0000,123456 group="SLOT_0000" Spec=3 KeyFile=ka.key AuthorizeKey=1000000

6. Check the initialization status of keys.

›_ Console

# cxitool dev=3001@127.0.0.1 LogonPass=USR_0000,123456 group="SLOT_0000" spec=3 Keyinfo

tmp2c9iwhef.jpg

Initialization status of keys

The initialized status is true.