86 Sun Crypto Accelerator 4000 Board Installation and User’s Guide • May 2003
Concepts and Terminology
Keystoresand users must be created for applications that communicate with the Sun
Crypto Accelerator 4000 board through a PKCS#11interface, such as the Sun ONE
WebServer.
Users, within the context of the Sun Crypto Accelerator 4000, are owners of
cryptographic keying material. Each key is owned by a single user.Each user may
own multiple keys. A user may want to own multiple keys to support different
configurations, such as a production key and a development key (to reflect the
organizations the user is supporting).
Note – The term user or user account refers to Sun Crypto Accelerator 4000 users
created in vcaadm, not traditional UNIX user accounts. There is no fixed mapping
between UNIX user names and Sun Crypto Accelerator 4000 user names.
A keystore is a repository for key material. Associated with a keystore are security
officersand users. Keystores not only provide storage, but a means for key objects to
be owned by user accounts. This allows keys to be hidden from applications that do
not authenticate as the owner.Keystores have three components:
■Key objects – Long-term keys that are stored for applications such as the Sun
ONE WebServer.
■User accounts – These accounts provide applications a means toauthenticate and
access specific keys
■Security officeraccounts – These accounts provide access to key management
functions through vcaadm.
Note – A single Sun Crypto Accelerator 4000 board must have exactly one keystore.
Multiple Sun Crypto Accelerator 4000 boards can be configuredto collectively work
with the same keystore to provide additional performance and fault-tolerance.
A typical installation contains a single keystore with a single user.For example, such
a configurationmight consist of a single keystore web_server and a single user within
that keystore, web_admin. This would allow the user web_admin to own and maintain
access control of the server keys within that single keystore.
An administrative tool, vcaadm, is used to manage Sun Crypto Accelerator 4000
keystores and users. Refer to “Managing Keystores Withvcaadm” on page 69.