Manage the Cryptography Keys

The ActivID AS keys are managed in coherent key set of five keys for the following key roles:

• AUDIT – Audit signature
• CREDS – User credentials encryption
• DSIGN – Database row integrity signature
• SESSION – Sessions (ALSI) encryption
• SYS – System credentials (adapter parameters) encryption

The following naming convention is used for the key aliases:

<PREFIX>.<Key Role Type>.<Security Domain>.<version>

Where:

• <PREFIX> – to make sure that the names remain unique, a specific prefix 'HID-IA-4T’ is used for all the ActivID AS key aliases. This prefix is not configurable.
• <Key Role Type> – is mandatory and is part of the key set (see previous list).
• <Security Domain> – is optional, defines a security domain-specific key. If you do not define a security domain, the key will be shared by all the domains.
• <Version> – number version of the key (incremented with renewal).

Based on this convention, the default key set (shared by all domains) created during the ActivID AS configuration is:

You are not required to create the domain-specific keys before ActivID AS installation. You can create the domain-specific keys if you want to add more security/separation across domains, and they can be created at any time, using the following conventions (for example, where the domain is ONLINEBANK):

The ActivID AS key life-cycle management allows you to:

• Manage the keys in a coherent key set composed of the five keys, where each key alias follows a pre-defined template.
• Have a default key set that can be shared by all domains.
• Have a specific key set per security domain (not mandatory).
• Renew all the keys in a key set (shared and domain-specific).
• Keep track of the key alias used for an encryption or signature operation in the database so that the corresponding key is used later when a decryption or signature verification is needed.
• Support migration from previous versions of ActivID AS transparently.
• When an update operation is performed on an item (such as a credential or configuration element), the signature or encryption is performed using the current version of the key associated to that operation.

As ftadmin, use the createSoftKeySet.sh script to generate (or create the first version) of the keys. Command usage is:

<ACTIVID_HOME>/ActivID_AS/bin/createSoftKeySet.sh [-a | -d <domain1,domain2,…>]

Where the options are:

• -a – generate a shared key set
• -d – generate domain key sets for the specified security domains

To generate the ActivID AS shared keys:

1. Run the command:

Copy

su ftadmin -c "<ACTIVID_HOME>/ActivID_AS/bin/createSoftKeySet.sh -a"
Working in SOFT mode.
 
No domain is specified, new default keys will be generated
Do you really want to generate new keys (y/n)? [n]: y

2. Enter y to confirm and press Enter.

Copy

hid-ia-4t.audit.2 key has been generated.
hid-ia-4t.dsign.2 key has been generated.
hid-ia-4t.sys.2 key has been generated.
hid-ia-4t.creds.2 key has been generated.
hid-ia-4t.session.2 key has been generated

This script checks the highest version of a shared key in the configuration set and then creates a new version of all keys inside a key set after incrementing the version number.

For example, if the highest shared key set index is 5, then a new key set is created with index 6.

3. You can then update your system with the new key set.

To generate the keys for a specific security domain (for example, ONLINEBANK):

1. Run the command:

Copy

su ftadmin -c "<ACTIVID_HOME>/ActivID_AS/bin/createSoftKeySet.sh -d ONLINEBANK"
Working in SOFT mode.
 
Validate the specified domains:
--> Keys will be generated for ONLINEBANK
Do you really want to generate new keys (y/n)? [n]: y

2. Enter y to confirm and press Enter.

As there was no previous key set for ONLINEBANK, a first version of the key set is created (hid-ia-4t.<key role type>.onlinebank.1).

Copy

hid-ia-4t.audit.onlinebank.1 key has been generated.
hid-ia-4t.dsign.onlinebank.1 key has been generated.
hid-ia-4t.sys.onlinebank.1 key has been generated.
hid-ia-4t.creds.onlinebank.1 key has been generated.
hid-ia-4t.session.onlinebank.1 key has been generated.

3. You can then update your system with the new key set.

To generate the keys for more than one security domain (for example, ONLINEBANK and ENTERPRISE):

1. Run the command:

Copy

su ftadmin -c "<ACTIVID_HOME>/ActivID_AS/bin/createSoftKeySet.sh -d ONLINEBANK,ENTERPRISE"
Working in SOFT mode.
 
Validate the specified domains:
--> Keys will be generated for ONLINEBANK
--> Keys will be generated for ENTERPRISE
Do you really want to generate new keys (y/n)? [n]: y

2. Enter y to confirm and press Enter.

3. You can then update your system with the new key set.

For an HSM deployments, a dedicated process for creating or renewing the keys should be applied manually depending on the HSM type using the HSM-based tools:

• ksafe or generatekey for nShield
• kmu or ctkmu for SafeNet

Using the HSM-based key management tools, you need to:

1. Verify the current set of HSM keys (if applicable).
2. Create a new set of keys that meet the naming conventions.
Important: The keys should be created as the AES-256 type and ActivID AS will access the keys through the HSM PKCS#11 interface.
3. Verify that the new set of keys is correct.
4. You can then update your system with the new key set.

For further information about these tools, refer to the technical documentation provided with your HSM.