NAME¶

pkcstok_migrate - utility to migrate an ICA, CCA, Soft, or EP11 token repository to the FIPS compliant format introduced with openCryptoki 3.12.

SYNOPSIS¶

pkcstok_migrate [-h]
pkcstok_migrate --slotid slot-number --datastore datastore --confdir confdir [--sopin sopin] [--userpin userpin] [--verbose level]

DESCRIPTION¶

Convert all objects inside a token repository to the new format introduced with version 3.12. All encrypted data inside the new format is stored using FIPS compliant methods. The new format affects the token's master key files (MK_SO and MK_USER), the NVTOK.DAT, and the token object files in the TOK_OBJ folder.

While using this tool no process using the token to be migrated must be running. Especially the pkcsslotd must be stopped before running this tool.

The tool creates a backup of the token repository to be migrated, and performs all migration actions on this backup, leaving the original repository folder completely untouched. The backup folder is located in the same directory as the original repository and is suffixed with _PKCSTOK_MIGRATE_TMP.

After a successful migration, the original repository is renamed with a suffix of _BAK and the backup folder is renamed to the original repository name, so that the migrated repository can immediately be used. The old folder may be deleted by the user manually later.

After a successful migration, the tool adds parameter 'tokversion = 3.12' to the token's slot configuration in the opencryptoki.conf file. The original config file is still available as opencryptoki.conf_BAK and may be removed by the user manually.

After an unsuccessful migration, the original repository is still available unchanged.

The pkcstok_migrate utility must be run as root.

OPTIONS SUMMARY¶

--slotid -s SLOT-NUMBER

specifies the token slot number of the token repository to be migrated

--datastore -d DATASTORE

specifies the directory of the token repository to be migrated.

--confdir -c CONFDIR

specifies the directory where the opencryptoki.conf file is located.

--sopin -p SOPIN

specifies the SO pin. If not specified, the SO pin is prompted.

--userpin -u USERPIN

specifies the user pin. If not specified, the user pin is prompted.

--verbose -v LEVEL

specifies the verbose level: none, error, warn, info, devel, debug

--help -h

show usage information

SEE ALSO¶

pkcsconf(1),

opencryptoki(7),

pkcsslotd(8).