Configuring IKE to Find Attached Hardware
Public key certificates can also be stored on attached hardware, the Sun Crypto
Accelerator 1000 board and the Sun Crypto Accelerator 4000 board. With the
Sun Crypto Accelerator 4000 board, public key operations can also be offloaded from
the system to the board.
How to Configure IKE to Find the Sun Crypto Accelerator 1000 Board
Before You Begin
The following procedure assumes that a Sun Crypto Accelerator 1000 board is
attached to the system. The procedure also assumes that the software for the
board has been installed and that the software has been configured. For instructions,
see the Sun Crypto Accelerator 1000 Board Version 1.1 Installation and User's Guide.
- On the system console, assume the Primary Administrator role or become superuser.
The Primary Administrator role includes the Primary Administrator profile. To create the role
and assign the role to a user, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.
Note - Logging in remotely exposes security-critical traffic to eavesdropping. Even if you somehow protect
the remote login, the security of the system is reduced to the security
of the remote login session.
- Check that the library is linked.
Type the following command to determine whether a PKCS #11 library is linked:
# ikeadm get stats
Phase 1 SA counts:
Current: initiator: 0 responder: 0
Total: initiator: 0 responder: 0
Attempted: initiator: 0 responder: 0
Failed: initiator: 0 responder: 0
initiator fails include 0 time-out(s)
PKCS#11 library linked in from /usr/lib/libpkcs11.so
#
- Solaris 10 1/06: In this release, you can store keys in the
softtoken keystore.
For information on the keystore that is provided by the Solaris cryptographic framework,
see the cryptoadm(1M) man page. For an example of using the keystore, see
Example 23-9.
How to Configure IKE to Find the Sun Crypto Accelerator 4000 Board
Before You Begin
The following procedure assumes that a Sun Crypto Accelerator 4000 board is
attached to the system. The procedure also assumes that the software for the
board has been installed and that the software has been configured. For instructions,
see the Sun Crypto Accelerator 4000 Board Installation and User's Guide. The guide is available from the https://www.sun.com/products-n-solutions/hardware/docs web site, under Network
and Security Products.
- On the system console, assume the Primary Administrator role or become superuser.
The Primary Administrator role includes the Primary Administrator profile. To create the role
and assign the role to a user, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.
Note - Logging in remotely exposes security-critical traffic to eavesdropping. Even if you somehow protect
the remote login, the security of the system is reduced to the security
of the remote login session.
- Check that the PKCS #11 library is linked.
IKE uses the library's routines to handle key generation and key storage on
the Sun Crypto Accelerator 4000 board. Type the following command to determine
whether a PKCS #11 library has been linked:
$ ikeadm get stats
…
PKCS#11 library linked in from /usr/lib/libpkcs11.so
$
Note - The Sun Crypto Accelerator 4000 board supports keys up to 2048 bits
for RSA. For DSA, this board supports keys up to 1024 bits.
- Find the token ID for the attached Sun Crypto Accelerator 4000 board.
$ ikecert tokens
Available tokens with library "/usr/lib/libpkcs11.so":
"Sun Metaslot "
The library returns a token ID, also called a keystore name, of 32
characters. In this example, you could use the Sun Metaslot token with the ikecert commands
to store and to accelerate IKE keys.
For instructions on how to use the token, see How to Generate and Store Public Key Certificates on Hardware.
The trailing spaces are automatically padded by the ikecert command.
Example 23-9 Finding and Using Metaslot Tokens
Tokens can be stored on disk, on an attached board, or in
the softtoken keystore that the Solaris encryption framework provides. The softtoken keystore token ID
might resemble the following.
$ ikecert tokens
Available tokens with library "/usr/lib/libpkcs11.so":
"Sun Metaslot "
To create a passphrase for the softtoken keystore, see the pktool(1) man
page.
A command that resembles the following would add a certificate to the softtoken
keystore. Sun.Metaslot.cert is a file that contains the CA certificate:
# ikecert certdb -a -T "Sun Metaslot" < Sun.Metaslot.cert
Enter PIN for PKCS#11 token: Type user:passphrase
