Nortel Networks NN46120-104 manual Epk, Dpk

9.0 Roles and Services 245

Service	FIPS140-1 Level 3 Mode			Non- FIPS140-1 Mode
	Not auth	User	SO Role	Not auth	User	SO Role	SRDIs Access
	enticated	Role		enticated	Role		ed
Generate and Store RSA	NO	YES	YES	NO	YES	YES	PRNGKey
Key Pair							(create and
							destroy), and
							create either
							or both of the
							following pairs:
							(SPK, VPK) or
							(EPK, DPK)
Store Public Object (Public	NO	YES	YES	NO	YES	YES	Enter and store:
RSA Key, user data object)							EPK or VPK
Store Vendor-Defined Data	YES	YES	YES	YES	YES	YES	None
Object
Store Private Object (Private	NO	NO	NO	NO	YES	YES	Enter and
RSA Key) (note 4)							Store: SPK or
							DPK
Get Public Object (RSA	NO	YES	YES	NO	YES	YES	Read: SPK or
public key, user-defined data							DPK
object)
Get Vendor-Defined Data	YES	YES	YES	YES	YES	YES	None
Object
Get Object Information by	YES	YES	YES	YES	YES	YES	None
Object ID
Get Object Count	YES	YES	YES	YES	YES	YES	None

Note 1 = The key for these commands is input through the PCI bus (data input interface)

Note 2 = This is a PKCS 12 method for deriving a 3DES key from a password, salt and iteration count.

Note 3 = The Exponentiation Using CRT and Exponentiation functions are generic math functions; all parameters are input through the PCI interface (data input interface).

Note 4 = When operating in the FIPS140-1 mode, it is not possible for secret keys, private keys or critical security parameters to cross the PCI bus without being wrapped (encrypted) using the Key-Wrapping Key.

Note 5 = User Login is the process that takes the board from an unauthenticated state to the authenticated state. Only one user may be authenticated at a particular time. Consequently, the User Login process cannot be started from the authenticated state. Nonetheless, the User Login process cannot be completed successfully without authentication.

Note 6 = This command is used for generating the key-wrapping-key.

Note 7 = When the board is in the zeroized state, it is possible to for an unauthenticated user to uninitialize the board.

Note 8 = These operations must access stored cryptographic keys. The keys may not be input through the PCI interface.

Nortel VPN Gateway

User Guide

NN46120-104 02.01 Standard

14 April 2008

Copyright © 2007-2008 Nortel Networks