红帽全球峰会6.11. 设置新密钥集
本节论述了设置令牌处理系统(TPS)和令牌密钥服务(TKS)中设置的默认密钥的替代选择。
- TKS 配置
默认密钥集使用
/var/lib/pki/ instance_name/tks/conf/CS.cfg文件中的以下选项在 TKS 中配置：tks.defKeySet._000=## tks.defKeySet._001=## Axalto default key set: tks.defKeySet._002=## tks.defKeySet._003=## tks.defKeySet.mk_mappings.#02#01=<tokenname>:<nickname> tks.defKeySet._004=## tks.defKeySet.auth_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.defKeySet.kek_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.defKeySet.mac_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.defKeySet.nistSP800-108KdfOnKeyVersion=00 tks.defKeySet.nistSP800-108KdfUseCuidAsKdd=false
tks.defKeySet._000=## tks.defKeySet._001=## Axalto default key set: tks.defKeySet._002=## tks.defKeySet._003=## tks.defKeySet.mk_mappings.#02#01=<tokenname>:<nickname> tks.defKeySet._004=## tks.defKeySet.auth_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.defKeySet.kek_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.defKeySet.mac_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.defKeySet.nistSP800-108KdfOnKeyVersion=00 tks.defKeySet.nistSP800-108KdfUseCuidAsKdd=falseCopy to Clipboard Copied! 以上配置定义了特定于某些类型或可用于 TMS 中的令牌类的设置。最重要的部分是 3 个开发人员或（开箱即用）会话密钥，用于在对称密钥切换发生前创建安全频道。其他类型的键可能具有这些键的不同默认值。
描述
nistSP800键多元方法的设置控制是否使用此方法还是标准的 Visa 方法。具体来说，tks.defKeySet.nistSP800-108KdfOnKeyVersion选项的值决定使用 NIST 版本。nistSP800-108KdfUseCuidAsKdd选项允许您在处理过程中使用 CUID 的传统密钥 ID 值。较新的 KDD 值是最常用的值，因此该选项默认为禁用(false)。这可让您配置一个新的密钥集来启用对新密钥类别的支持。例 6.2. 启用对
jForte类的支持要启用对
jForte类的支持，请设置：tks.jForte._000=## tks.jForte._001=## SAFLink's jForte default key set: tks.jForte._002=## tks.jForte._003=## tks.jForte.mk_mappings.#02#01=<tokenname>:<nickname> tks.jForte._004=## tks.jForte.auth_key=#30#31#32#33#34#35#36#37#38#39#3a#3b#3c#3d#3e#3f tks.jForte.kek_key=#50#51#52#53#54#55#56#57#58#59#5a#5b#5c#5d#5e#5f tks.jForte.mac_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.jForte.nistSP800-108KdfOnKeyVersion=00 tks.jForte.nistSP800-108KdfUseCuidAsKdd=false
tks.jForte._000=## tks.jForte._001=## SAFLink's jForte default key set: tks.jForte._002=## tks.jForte._003=## tks.jForte.mk_mappings.#02#01=<tokenname>:<nickname> tks.jForte._004=## tks.jForte.auth_key=#30#31#32#33#34#35#36#37#38#39#3a#3b#3c#3d#3e#3f tks.jForte.kek_key=#50#51#52#53#54#55#56#57#58#59#5a#5b#5c#5d#5e#5f tks.jForte.mac_key=#40#41#42#43#44#45#46#47#48#49#4a#4b#4c#4d#4e#4f tks.jForte.nistSP800-108KdfOnKeyVersion=00 tks.jForte.nistSP800-108KdfUseCuidAsKdd=falseCopy to Clipboard Copied! 请注意，与上例相比，3 静态会话键的不同。
证书系统支持 Giesecke & Devrient (G&D) Smart Cafe 6 智能卡的安全通道协议 03 (SCP03)。要在 TKS 中启用对这些智能卡的 SCP03 支持，请在
/var/lib/pki/ instance_name/tks/conf/CS.cfg文件中设置：tks.defKeySet.prot3.divers=emv tks.defKeySet.prot3.diversVer1Keys=emv tks.defKeySet.prot3.devKeyType=DES3 tks.defKeySet.prot3.masterKeyType=DES3
tks.defKeySet.prot3.divers=emv tks.defKeySet.prot3.diversVer1Keys=emv tks.defKeySet.prot3.devKeyType=DES3 tks.defKeySet.prot3.masterKeyType=DES3Copy to Clipboard Copied! - TPS 配置
当支持的客户端试图对令牌执行操作时，必须将 TPS 配置为识别新密钥集。默认
defKeySet最常使用。确定 TPS 中的
keySet的主要方法是 第 6.7 节 “映射解析器配置”。如需了解建立这个解析器机制所需的准确设置，请参阅链接部分。如果没有 KeySet Mapping Resolver，则 TPS 有几个回退方法可用于确定正确的
keySet：-
您可以将
tps.connector.tks1.keySet=defKeySet添加到 TPS 的CS.cfg配置文件中。 -
某些客户端可能会被配置为显式传递所需的
keySet值。但是，企业级安全客户端目前没有此功能。 -
当 TPS 根据所需方法计算正确的
keySet时，所有对 TKS 的请求也有助于创建安全频道通过keySet值。然后 TKS 可以使用自己的keySet配置（上面描述）来确定如何继续。
-
您可以将
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}