Tools and utilities

Various tools and utilities are available which provide general information about EP11, which support you in migrating EP11 master keys, and which help you to manage EP11 sessions.

Obtaining information about an EP11 environment with the ep11info tool
Use the ep11info tool to obtain general information about EP11 cryptographic coprocessors and about the domains configured on the system. Especially the wrapping key identifier of the configured domains are shown.
Migrating master keys with the pkcsep11_migrate tool
There may be situations when the master key on (a domain of) a CEX*P adapter must be changed, for example, if company policies require periodic changes of all master keys. Simply changing the master keys using the TKE results in all secure keys stored in the EP11 token to become useless. Therefore all data encrypted by these keys are lost. To avoid this situation, you must accomplish a master key migration process, where activities on the TKE and on the Linux system must be interlocked.
Managing EP11 sessions with the pkcsep11_session tool
An EP11 session is a state on the EP11 cryptographic coprocessor and must not be confused with a PKCS #11 session. An EP11 session is generated by the strict session mode or the VHSM mode. They are implicitly stored and deleted by openCryptoki if the according modes are set. So under normal circumstances, you need not care about the management of these EP11 sessions. But in some cases, for example, when programs crash or when programs do not close their sessions or do not call C_Finalize before exiting, some explicit EP11 session management may be required.
Migrating to FIPS compliance using the pkcstok_migrate tool
Use the pkcstok_migrate tool to transform an EP11 token, a CCA token, an ICA token, or a Soft Token into a data format that was generated by FIPS compliant operations. You can use this tool to migrate tokens created with all versions of openCryptoki, because also for version 3.12 or later, the old non-compliant format is the default. Being FIPS compliant, the token data is stored in a format that is better protected against attacks than the previously used data format.

Parent topic: Using the Linux on Z EP11 enablement