15.4.3 Keyset File
(Ask a Question)The keyset file is used in the HSM flow only. It contains U-HSM generated keys encrypted with the Master Key of the U-HSM. New keyset files can be generated randomly by the HSM, derived from the existing keyset files, or created from the imported plain text values.
Keyset files are stored in the keyset repository, and can be shared among different Job Manager projects. The repository is configured through HSM parameters (refer to the FlashPro Express User Guide ).
Keyset files contain the following keys:
- Ticket Key that encrypts all keys in
the keyset file.
- Ticket Key is protected by the HSM Master Key.
- Keyset file contains HSM Master Key UUID to help identify the origin of the file.
- Encryption keys: UEK1, UEK2, UEK3
- Pass keys: UPK1, UPK2, DPK
- Base keys for deriving per-device key values for UEK1/UEK2/UEK3/UPK1/UPK2/DPK
For more information about SPPS key management, refer to the Secure Production Programming Solution (SPPS) User Guide .
A keyset file is generated outside the Job Manager project and is associated upon creation of a new Programming Data entry (refer to the User HSM Installation and Setup User Guide ).
The create_keyset Tcl command is used to manage keyset files. See 15.4.8 Tcl Interface for more
information and keyset generation scenarios.