User manual QUANTUM QUANTUM ENCRYPTION KEY MANAGER REV A01

[. . . ] Quantum Encryption Key Manager User's Guide, 6-01847-01, Rev A01, November 2007. Quantum Corporation provides this publication "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. Quantum Corporation may revise this publication from time to time without notice. COPYRIGHT STATEMENT Copyright 2007 by Quantum Corporation. [. . . ] Setup of the new server includes copying the three files listed above onto the new server. Considerations for Sharing Encrypted LTO-4 Tapes Offsite Note: Sharing keys between keystores is not supported at initial launch. It is common practice to share tapes with other organizations (that are not using the same Q-EKM server/keystore for encryption) for data transfer, joint development, contracting services, or other purposes. Q-EKM creates unique key aliases across all Q-EKM installations worldwide. This ensures that you can safely share Q-EKM-encrypted tapes with other sites or companies. Quantum Encryption Key Manager User's Guide 13 Chapter 2 Planning Your Q-EKM Environment Considerations for Sharing Encrypted LTO-4 Tapes Offsite Note: It is important to verify the validity of any certificate received from a business partner by checking the chain of trust of such a certificate back to the Certificate Authority that ultimately signed it. If you trust the Certificate Authority, then you can trust that certificate. Alternately, the validity of a certificate can be verified if it was securely guarded in transit. Failure to verify a certificate's validity in one of these ways may open the door to a "Man-in-the-Middle" attack. In order to share encrypted data on an IBM LTO-4 tape, a copy of the symmetric key used to encrypt the data on the tape must be made available to the other organization to enable them to read the tape. In order for the symmetric key to be shared, the other organization must share their public key with you. This public key will be used to wrap the symmetric key when it is exported from the Q-EKM keystore (see Export Keys on page 19). When the other organization imports the symmetric key into their Q-EKM keystore, it will be unwrapped using their corresponding private key (see Import Keys on page 19). This ensures that the symmetric key will be safe in transit since only the holder of the private key will be able to unwrap the symmetric key. With the symmetric key that was used to encrypt the data in their Q-EKM keystore, the other organization will then be able to read the data on the tape. Quantum Encryption Key Manager User's Guide 14 3Passwords and Commands Chapter 3 This chapter provides information about the passwords and commands used on Q-EKM. Passwords There are two different passwords you need to use with Q-EKM. They are: · Command Password · Keystore Password Command Password 3 You use the command password when issuing commands via the command line. Every time you issue a command to Q-EKM, you must enter the command password. The default command password is changeME. You can change this password using the chgpwdQEKMServer command (see Change Command Password on page 17). The command password is case sensitive, can contain a maximum of 24 characters, and can contain any combination of letters, numbers, and special characters (for example, !@#$%^&*) . Quantum Encryption Key Manager User's Guide 15 Chapter 3 Passwords and Commands Commands Keystore Password 3 The keystore password allows you to add, import, and export keys or certificates to the keystore (EKMkeys. jck). Quantum Global Services sets up your keystore password at the initial Q-EKM server installation. The keystore password is case sensitive, must contain a minimum of 6 characters and a maximum of 24 characters, and can contain any combination of letters, numbers, and special characters (for example, !@#$%^&*) . Encryption and decryption of tapes will still occur if you forget the password, but if you want to read encrypted tapes provided by another organization or company, of if you want to enable other organizations or companies to read your encrypted tapes, you will need to import and export keystore information, which you cannot do without the keystore password. If you forget the keystore password, there is no way to recover it. Caution: It is CRITICAL that you remember the keystore password!If you forget the password, neither you nor Quantum will be able to recover it. [. . . ] Try to re-create the problem and gather debug logs. When finished collecting data, turn Debug off. If the problem persists, contact Quantum Global Call Center. Quantum Encryption Key Manager User's Guide 30 ASetting the System Path Variable in Windows Appendix A You may wish to update your system Path environment variable to include the path to the QEKM folder. This allows you to enter Q-EKM commands on any command line rather than having to change the directory to the QEKM directory each time. [. . . ]