HSM initialization

The initialization of the HSM aims to prepare and customize it for operation in the operating environment. The basic aim is to generate the master key or Server Master Key on smart cards with an M of N secret sharing scheme and to establish a logical and unique relationship between this key and the HSM; this is what will enable the HSM to be activated and users to access the objects kept encrypted in their partitions.

The HSM leaves the factory in a state where it can be initialized and activated by any valid set of cards. The initialization process must ensure that the smart cards are saved with a Server Master Key known only to the administrator(s) and also that the HSM can only be activated from then on with these smart cards.

The Server Master Key is generated directly from the output of the HSM's Authorized DRBG (Deterministic Random Bit Generator).

Adopting an M-of-N scheme allows for the separation of responsibility during the activation process in a way that is both powerful and flexible. In a secret-sharing scheme, reconstructing the Server Master Key requires the set of smart cards (rather than being stored on a single card). The scheme is defined by first selecting the total number N of cards to be generated and distributed, and then selecting the number of cards M from the total set that must be presented during the authentication phase of HSM activation. The minimum set consists of two (2) smart cards. The cards within the generated set are idempotent; that is, they carry the same weight and contribute equally to the reconstruction of the Server Master Key. Therefore, there is no priority or preferred order during authentication, and any of the generated cards may be presented in any order (the order followed during generation is irrelevant). The HSM will request only the minimum set M sufficient to recover the Server Master Key. In any of the local console administration options where authentication is required, the set must be presented. The specific values of M and N are determined at the time the Server Master Key is generated. The HSM works with groups of N up to 16; for example, schemes such as 2 out of 4, 3 out of 8, 2 out of 11, and 5 out of 15 can be defined, among others. More sophisticated schemes can be adopted; for example, generating four cards in a 3-of-4 scheme, giving two cards to one person and one card each to two other people. Thus, to activate and operate the HSM, the person with two cards must be present, along with one of the two people who received one card each. The two people who each received one card—even when together—cannot retrieve the Server Master Key to operate the HSM, nor can the person with two cards alone.

---
title: Geração da Server Master Key
---

flowchart TD
    drbg[\Deterministic<br>Random Bit<br>Generator/]
    op((Operador))
    svmk([Server Master Key])
    split[esquema<br>M de N]
    card1(smart card 1)
    card2(smart card 2)
    cardn(smart card N)

    op --> drbg
    drbg --> svmk
    svmk --> split
    split -.-> card1
    split -.-> card2
    split -.-> cardn

After the first activation with the smart cards, a relationship is established between the HSM and the Server Master Key, and from then on only these Smart Cards (or a set of copies of them, created with the same seed) can be used for activation and management in the HSM. This relationship is persistently registered in the HSM and can only be removed by re-initializing the HSM database.

Attention

If the entire set or a subset M or greater of smart cards is lost and there is no copy of the set, the objects created under the Server Master Key contained in the set cannot be recovered and will be irretrievably lost. The smart card has a limit of six PIN attempts. On the seventh attempt, if the PIN is incorrect, the card will be PERMANENTLY locked and can no longer be used. When the correct PIN is entered, the incorrect attempt counter is reset to zero.

The initialization process is all done via the local console, using the smart cards. See the Local Console item for settings for the HSM's local console.

In summary, the necessary steps for initialization are as follows:

  1. Define the parameters of the M-of-N scheme (choose how many cards will be used);
  2. Generate the Server Master Key;
  3. Make the first activation of the HSM.

Attention

The HSM is delivered with 02 (two) smart cards. If you decide to use an M of N scheme with more than two cards, please contact your supplier to purchase more smart cards.

If the Server Master Key generation process is interrupted, the HSM will display a message stating that the material for generation is invalid or incomplete, in which case the smart cards will not be able to activate the HSM.