HSM Encryption Settings

CA RiskMinder Windows Installation Guide › Configuration Files and Options › INI Files › arcotcommon.ini › HSM Encryption Settings

HSM Encryption Settings

The arcotcommon.ini file enables you to specify the configurations for your Hardware Security Module (HSM). As a result, you can store the Private Keys that are used for RiskMinder in an encrypted format. The following HSMs are supported:

Chrysalis-ITS Luna SA
Thales nFast (nCipher netHSM)

The following table lists the common configurations for secure storage, as specified in the [arcot/crypto/device] section.

Parameter	Default	Description
HSMDevice	S/W	The mode that sets whether the RiskMinder information must be encrypted with a key stored in database or with the one in stored the HSM. Supported values are: S/W: Indicates that the data is encrypted with the key label that is stored in database. chrysalis: Indicates that the Chrysalis (Luna) HSM is used to encrypt the data. nfast: Indicates nFast (nCipher netHSM) is used to encrypt the data.

Parameter

Default

Description

HSMDevice

S/W

The mode that sets whether the RiskMinder information must be encrypted with a key stored in database or with the one in stored the HSM.

Supported values are:

S/W: Indicates that the data is encrypted with the key label that is stored in database.
chrysalis: Indicates that the Chrysalis (Luna) HSM is used to encrypt the data.
nfast: Indicates nFast (nCipher netHSM) is used to encrypt the data.

The following table lists the configuration parameters for Chrysalis-ITS Luna SA, as specified in the [crypto/pkcs11modules/chrysalis] section.

Parameter	Default	Description
sharedLibrary	<location/to/cryptoki.dll>	The absolute path to the PKCS#11 shared library corresponding to the HSM. The default value for Chrysalis (Luna) is: C:\Program Files\LunaSA\cryptoki.dll
storageSlot	0	The HSM slot where the encryption keys (symmetric as well as asymmetric) are present.
accelSlot	0	The slot for internal use by CA.
sessionCount	20	The maximum number of sessions that can be established with the HSM device.

The following table lists the configuration parameters for nCipher netHSM, as specified in the [crypto/pkcs11modules/nfast] section.

Parameter	Default	Description
sharedLibrary	<location/to/ccknfast.dll>	The absolute path to the PKCS#11 shared library corresponding to the HSM. The default value for nFast (nCipher netHSM) is: C:\nfast\bin\cknfast.dll
storageSlot	1	The HSM slot where the encryption keys (symmetric as well as asymmetric) are present.
accelSlot	0	The slot for internal use by CA.
sessionCount	200	The maximum number of sessions that can be established with the HSM device.