Security Policy, version 1.0 January 31, 2008
HP StorageWorks Secure Key Manager
Page 21 of 26
© 2008 Hewlett-Packard Company
This document may be freely reproduced in its original entirety.
3 Secure Operation
The HP StorageWorks Secure Key Manager meets Level 2 requirements for FIPS 140-2. The sections below
describe how to place and keep the module in the FIPS mode of operation.
3.1 Initial Setup
The device should be unpacked and inspected according to the User Guide. The User Guide also contains
installation and configuration instructions, maintenance information, safety tips, and other information. The device
itself must be affixed with tamper-evident labels that are included in the packaging. See Figure 8 – Tamper-
Evidence Labels for locations of tamper-evidence labels.
3.2 Initialization and Configuration
3.2.1 First-Time Initialization
When the module is turned on for the first time, it will prompt the operator for a password for a default Crypto
Officer. The module cannot proceed to the next state until the operator provides a password that conforms to the
password policy described in Section 2.7.1. The default username associated with the entered password is “admin”.
During the first-time initialization, the operator must configure minimum settings for the module to operate
correctly. The operator will be prompted to configure the following settings via the serial interface:
• Date, Time, Time zone
• IP Address/Netmask
• Hostname
• Gateway
• Management Port
3.2.2 FIPS Mode Configuration
In order to comply with FIPS 140-2 Level 2 requirements, the following functionality must be disabled on the SKM:
• Global keys
• File Transfer Protocol (FTP) for importing certificates and downloading and restoring backup files
• Lightweight Directory Access Protocol (LDAP) authentication
• Use of the following algorithms: RC4, MD5, DES, RSA-512, RSA-768
• SSL 3.0
• Hot-swappable drive capability
• RSA encryption and decryption operations (note, however, that RSA encryption and decryption associated
with TLS handshakes and Sign and Sign Verify are permitted)
These functions need not be disabled individually. There are two approaches to configuring the module such that it
works in the Approved FIPS mode of operation:
Through a command line interface, such as SSH or serial console, the Crypto Officer should use the fips
compliant command to enable the FIPS mode of operation. This will alter various server settings as described
above. See Figure 6 – FIPS Compliance in CLI. The fips server command is used for the FIPS status server
configuration. The show fips status command returns the current FIPS mode configuration.
