YubiHSM 2 User Guide
Contents
- Introduction
- YubiHSM 2 Device Specifications
- YubiHSM 2 Software Development Kit (SDK)
- Quick Start Tutorial
- YubiHSM 2 SDK Tools And Libraries
- YubiHSM 2: Backup and Restore
- Initial Provisioning and Deployment Guide
- FIPS Mode Support Guide
- Using Key Storage Provider (KSP) – Windows Only
- PKCS#11 with YubiHSM 2
- Configuration
- Logging In
- PKCS#11 on Windows
- Note for Developers
- PKCS#11 with JAVA
- Software Operations
- PKCS#11 Attributes
- Capabilities and Domains
- PKCS#11 Objects
- PKCS#11 Functions
- PKCS#11 Vendor Definitions
- Configuration File Sample
- INIT_ARGS Sample
- PKCS#11 Tool Compatibility, Interoperability and Known Restrictions
- Resetting Device to Factory Settings
- EJBCA Installation and Configuration Guide
- Using OpenSSH Certificates for Host Login
- OpenSSL with libp11 for Signing, Verifying and Encrypting, Decrypting
- OpenSSL with YubiHSM 2 via engine_pkcs11 and yubihsm_pkcs11
- Example: Creating an Alias
- Example: Generating a Key in the Device
- Example: Certificate Request
- Example: Retrieve 64 Bytes of Data
- Example: Adding req entries
- Example: Requesting certificate existing RSA key
- Example: Self-Signed Certificate Existing RSA Key
- Example: s_server with RSA Key and Certificate
- Example: s_server with ECDSA Key and Certificate
- Using OpenSC pkcs11-tool
- YubiHSM and OpenSSL on Windows
- Configuring YubiHSM 2 for Java Code Signing
- Prerequisites
- Basic Configuration of YubiHSM 2
- Configuration File for YubiHSM 2 PKCS #11
- Configuration File of Sun JCE PKCS #11 Provider with YubiHSM 2
- Environment Variables
- Java Keystore
- Linux Bash Script for Generating Keys and Certificates
- Example of How to Execute the Bash Script
- List the Objects on YubiHSM 2
- Using YubiHSM 2 with Java Signing Applications
- Signing XML files using YubiHSM 2
- Example Java code using YubiHSM 2
- Deploying YubiHSM 2 with Active Directory Certificate Services
- Installing the YubiHSM 2 Tools and Software
- Verifying the Default Configuration of the YubiHSM 2
- Configuring the Primary YubiHSM 2 Device
- Configure the YubiHSM 2 Software on Windows
- Alternative Scenarios with CA Root Key or Subordinate CAs
- Backup and Restore Key Material
- Deploying YubiHSM 2 for Microsoft Host Guardian Service (HGS) Guide
- YubiHSM 2 for Microsoft SQL Server Deployment Guide
- YubiHSM 2 for Microsoft SQL Server Guide
- Introduction to Always Encrypted
- Prerequisites and Preparations
- Basic Setup of YubiHSM 2 and SQL Server
- Use SSMS to Generate the CMK and CEK
- Validate Generation of the CMK
- Use PowerShell Script to Generate the CMK and CEK
- Encrypt Database Columns
- Configure SSMS for Database Encryption
- YubiHSM 2 with Key Storage Provider for Windows Server
- Key Splitting and Key Custodians
- Core Concepts
- YubiHSM Command Reference
- OPEN SESSION Command
- AUTHENTICATE SESSION Command
- OPEN SESSION ASYMMETRIC Command
- BLINK DEVICE Command
- CHANGE ASYMMETRIC AUTHENTICATION KEY Command
- CHANGE AUTHENTICATION KEY Command
- CLOSE SESSION Command
- CREATE OTP AEAD Command
- CREATE SESSION Command
- DECRYPT CBC Command
- DECRYPT ECB Command
- DECRYPT OAEP Command
- DECRYPT OTP Command
- DECRYPT PKCS1 Command
- DELETE OBJECT Command
- DERIVE ECDH Command
- DEVICE INFO Command
- ECHO Command
- ENCRYPT CBC Command
- ENCRYPT ECB Command
- EXPORT WRAPPED Command
- EXPORT RSA WRAPPED Command
- EXPORT RSA WRAPPED KEY Command
- GENERATE ASYMMETRIC KEY Command
- GENERATE HMAC KEY Command
- GENERATE OTP AEAD KEY Command
- GENERATE SYMMETRIC KEY Command
- GENERATE WRAP KEY Command
- GET DEVICE PUBLIC KEY Command
- GET LOG ENTRIES Command
- GET OBJECT INFO Command
- GET OPAQUE Command
- GET OPTION Command
- GET PSEUDO RANDOM Command
- GET PUBLIC KEY Command
- GET STORAGE INFO Command
- GET TEMPLATE Command
- IMPORT WRAPPED Command
- IMPORT RSA WRAPPED Command
- IMPORT RSA WRAPPED KEY Command
- LIST OBJECTS Command
- PUT ASYMMETRIC KEY Command
- PUT ASYMMETRIC AUTHENTICATION KEY Command
- PUT AUTHENTICATION KEY Command
- PUT HMAC KEY Command
- PUT OPAQUE Command
- PUT OTP AEAD KEY Command
- PUT SYMMETRIC KEY Command
- PUT TEMPLATE Command
- PUT WRAP KEY Command
- PUT PUBLIC WRAP KEY Command
- RANDOMIZE OTP AEAD Command
- RESET DEVICE Command
- REWRAP OTP AEAD Command
- SESSION MESSAGE Command
- SET INFORMAT Command
- SET LOG INDEX Command
- SET OPTION Command
- SET OUTFORMAT Command
- SIGN ATTESTATION CERTIFICATE Command
- SIGN ECDSA Command
- SIGN EDDSA Command
- SIGN HMAC Command
- SIGN PKCS1 Command
- SIGN PSS Command
- SIGN SSH CERTIFICATE Command
- UNWRAP DATA Command
- VERIFY HMAC Command
- WRAP DATA Command
- Glossary
- Copyright