Configuring IKE to Find Attached Hardware

Public key certificates can also be stored on attached hardware. The Sun Crypto Accelerator 1000 board provides storage only. The Sun Crypto Accelerator 4000 and the Sun Crypto Accelerator 6000 board provide storage, and enable public key operations to be offloaded from the system to the board.

How to Configure IKE to Find the Sun Crypto Accelerator 1000 Board

Before You Begin

The following procedure assumes that a Sun Crypto Accelerator 1000 board is attached to the system. The procedure also assumes that the software for the board has been installed and that the software has been configured. For instructions, see the Sun Crypto Accelerator 1000 Board Version 2.0 Installation and User’s Guide.

• Check that the PKCS #11 library is linked.

  Type the following command to determine whether a PKCS #11 library is linked:

  # ikeadm get stats
  Phase 1 SA counts:
  Current:   initiator:          0   responder:          0
  Total:     initiator:          0   responder:          0
  Attempted: initiator:          0   responder:          0
  Failed:    initiator:          0   responder:          0
             initiator fails include 0 time-out(s)
  PKCS#11 library linked in from /usr/lib/libpkcs11.so
  # 

How to Configure IKE to Find the Sun Crypto Accelerator 4000 Board

Before You Begin

The following procedure assumes that a Sun Crypto Accelerator 4000 board is attached to the system. The procedure also assumes that the software for the board has been installed and that the software has been configured. For instructions, see the Sun Crypto Accelerator 4000 Board Version 1.1 Installation and User’s Guide.

If you are using a Sun Crypto Accelerator 6000 board, see the Sun Crypto Accelerator 6000 Board Version 1.1 User’s Guide for instructions.

1. Check that the PKCS #11 library is linked.

   IKE uses the library's routines to handle key generation and key storage on the Sun Crypto Accelerator 4000 board. Type the following command to determine whether a PKCS #11 library has been linked:

   $ ikeadm get stats
   …
   PKCS#11 library linked in from /usr/lib/libpkcs11.so
   $

   ---

   Note - The Sun Crypto Accelerator 4000 board supports keys up to 2048 bits for RSA. For DSA, this board supports keys up to 1024 bits.

   ---

2. Find the token ID for the attached Sun Crypto Accelerator 4000 board.

   $ ikecert tokens
   Available tokens with library "/usr/lib/libpkcs11.so":
   
   "Sun Metaslot                     "

   The library returns a token ID, also called a keystore name, of 32 characters. In this example, you could use the Sun Metaslot token with the ikecert commands to store and accelerate IKE keys.

   For instructions on how to use the token, see How to Generate and Store Public Key Certificates on Hardware.

   The trailing spaces are automatically padded by the ikecert command.

Example 22-13 Finding and Using Metaslot Tokens

Tokens can be stored on disk, on an attached board, or in the softtoken keystore that the Solaris encryption framework provides. The softtoken keystore token ID might resemble the following.

$ ikecert tokens
Available tokens with library "/usr/lib/libpkcs11.so":

"Sun Metaslot                   "

To create a passphrase for the softtoken keystore, see the pktool(1) man page.

A command that resembles the following would add a certificate to the softtoken keystore. Sun.Metaslot.cert is a file that contains the CA certificate.

# ikecert certdb -a -T "Sun Metaslot" < Sun.Metaslot.cert
Enter PIN for PKCS#11 token: Type user:passphrase