PKCSTOK_MIGRATE(1) openCryptoki PKCSTOK_MIGRATE(1) NAME pkcstok_migrate - utility to migrate an ICA, CCA, Soft, or EP11 token repository to the FIPS compliant format introduced with openCryptoki 3.12. SYNOPSIS pkcstok_migrate [-h] pkcstok_migrate --slotid slot-number --datastore datastore --confdir confdir [--sopin sopin] [--userpin userpin] [--verbose level] DESCRIPTION Convert all objects inside a token repository to the new format introduced with version 3.12. All encrypted data inside the new format is stored us- ing FIPS compliant methods. The new format affects the token's master key files (MK_SO and MK_USER), the NVTOK.DAT, and the token object files in the TOK_OBJ folder. While using this tool no process using the token to be migrated must be running. Especially the pkcsslotd must be stopped before running this tool. The tool creates a backup of the token repository to be migrated, and per- forms all migration actions on this backup, leaving the original repository folder completely untouched. The backup folder is located in the same di- rectory as the original repository and is suffixed with _PKCSTOK_MI- GRATE_TMP. After a successful migration, the original repository is renamed with a suffix of _BAK and the backup folder is renamed to the original repository name, so that the migrated repository can immediately be used. The old folder may be deleted by the user manually later. After a successful migration, the tool adds parameter 'tokversion = 3.12' to the token's slot configuration in the opencryptoki.conf file. The origi- nal config file is still available as opencryptoki.conf_BAK and may be re- moved by the user manually. After an unsuccessful migration, the original repository is still available unchanged. The pkcstok_migrate utility must be run as root. OPTIONS SUMMARY --slotid -s SLOT-NUMBER specifies the token slot number of the token repository to be mi- grated --datastore -d DATASTORE specifies the directory of the token repository to be migrated. --confdir -c CONFDIR specifies the directory where the opencryptoki.conf file is lo- cated. --sopin -p SOPIN specifies the SO pin. If not specified, the SO pin is prompted. --userpin -u USERPIN specifies the user pin. If not specified, the user pin is prompted. --verbose -v LEVEL specifies the verbose level: none, error, warn, info, devel, de- bug --help -h show usage information SEE ALSO pkcsconf(1), opencryptoki(7), pkcsslotd(8). 3.19.0 June 2020 PKCSTOK_MIGRATE(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS SUMMARY | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=pkcstok_migrate&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>