Version 8 of the IBM Global Security Toolkit (GSKit) component can integrate with and exploit hardware cryptographic devices that support the PKCS#11 industry standard.
Hardware PKCS#11 devices offer a variety of features across operating system platforms. Please refer to the PKCS#11 device vendor for specific details of their offering. Some of the most common features include:
- More secure key storage and protected usage (some with tamper detection).
- Offloading of CPU intensive operations to device hardware. For example, most devices support asymmetric key operations.
- Some devices are capable of load sharing when more than one of them is installed.
GSKit's use of PKCS#11 is limited to those functions (where available) required for secure communication via SSL:
- Asymmetric key generation and secure storage
- Certificate storage
- Asymmetric key operations (Sign & Verify, and Decryption during SSL key-exchange)
- Random number generation
- Hash functions (i.e. digest calculation)
- Symmetric key operations
Trust Anchor Certificates (Root Certificates) should only be stored on the device where the device offers Certificate modification/replacement protection via the setting of the PKCS#11 CKA_TRUSTED attribute. The support and setting of this attribute is vendor-specific. If in doubt, do not use the PKCS#11 device for Trust Anchor Certificate storage but rather use a GSKit key store.
The GSKit component team performs interoperability testing on specific hardware, firmware, and driver levels for each device. IBM product teams typically test on a subset of these devices. If an integration problem is found, the IBM product team, IBM GSKit component team, and the PKCS#11 device vendor will work together on defect resolution. All IBM product defects should be reported through the standard IBM product support channels.
Operating system platforms
This article does not cover z/OS® or OS/400® variants of GSKit. In general, the list of platforms an IBM product integrates with a PKCS#11 device is the intersection of the IBM product's supported platforms and the PKCS#11 device's supported platforms. Known exceptions are noted below in the section “Card observations” or in IBM product documentation.
Hardware cryptographic devices tested with GSKit, Version 8
Refer issues regarding installation and configuration of these cards and software to the device vendor.
- PSG PCI HSM 600
- LunaSA HSM
- The on-chip cryptography within the Sun Ultra-SPARC T1 and T2 CMT processor (Solaris 10 on Sparc)
- nShield 6000e F2 PCI-Express (Solo)
- nShield Edge
- nShield Connect
- IBM Crypto Express3 (CEX3)
Observations on specific cards
nShield 6000e F2 PCI-Express (Solo) and nShield Edge
- Set the environment variable CKNFAST_OVERRIDE_SECURITY_ASSURANCES to "import;silent". This setting is required when using an nCipher device for symmetric key operations when enabled with GSKit. In this mode of operation, GSKit directly creates the SSL Session Key as a PKCS#11 Session Object during the SSL handshake. Despite the security override being required, no security issue is caused as the SSL Session Key is created by GSKit as part of the SSL handshake. nCipher devices do not provide Symmetric Key acceleration and as such, GSKit should not be enabled for the mode of operation when using nCipher devices unless absolutely required.
- The GSKit testing statement is restricted to Linux on zSeries and GSKit 126.96.36.199 or later must be used. Please refer to SystemSSL documentation for z/OS crypto device information.
- There currently exists an issue with this device and GSKit FIPS mode of operation. Until the next FIPS certification round (i.e. until gsk8ver indicates that both of the ICC instances within GSKit are higher than version 8.0.n.n) GSKit v8 cannot be operated in FIPS mode with this device, and the FIPS ICC support that resides in the lib/C or lib64/C directory of the GSKit install must be removed or renamed.
- The GSKit testing statement is restricted to cipher suites that include the RSA algorithm and 188.8.131.52 or later must be used.