-
To connect to the YubiHSM, at the yubihsm prompt, type connect
and press Enter. A message verifying that you have a successful connection is displayed.
-
To open a session with the YubiHSM 2, type session open 3
and press Enter.
-
Type in the password for the application authentication key.
-
You will receive a confirmation message that the session has been set up successfully.
-
If you already know the object ID of the root CA, you can skip this step. If you need to identify the root CA, you can list the objects available. To list the objects, type list objects 0
(where 0 is the session number) and press Enter. You will receive a list of the objects on the device that application authentication key with ID 3 has access to, which will include the CA root key. Identify its ID.
-
To export the CA root key under wrap from the primary device to the local file system, in the YubiHSM Shell program, run
yubihsm> get wrapped 0 2 asymmetric {rootkeyID} rootkey.yhw
-
Verify that all the keys that were exported under wrap to file reside in the same directory as the YubiHSM Setup program. The tool looks for files with the .yhw file extension in the current working directory and attempts to read and import them into the device. The wrap key will be imported as a result of providing the wrap key shares to the tool. Given the example object IDs in this guide, the following files should be present:
-
0x0003.yhw
(Application authentication key under wrap)
-
0x0004.yhw
(Audit key under wrap)
-
rootkey.yhw
(CA root key under wrap)
-
To begin the process of restoring the data onto the secondary YubiHSM 2, if the primary YubiHSM 2 device is inserted into your computer, remove it and insert the secondary device. Restoring a
device must be performed in an air-gapped environment in order to guarantee integrity.
-
In your command line application (where $ is the prompt), run YubiHSM Setup with the argument restore
. To do this, launch your command line application, navigate to the directory containing the YubiHSM Setup program, run the following command, and press Enter.
-
To start the YubiHSM Setup process, type the default authentication key password: password
and press Enter. A confirmation message is displayed that the default authentication key was used and that you successfully have authenticated to the device:
Using authentication key 0x0001
You will now start the restore procedure, which involves providing the number of wrap keyshares required by the privacy threshold defined when setting up the primary device.
-
When prompted, type the number of shares required by the privacy threshold and press enter. In this guide, we have specified that 2 shares are required to be rejoined. These must be present in
order to proceed.
-
When prompted, for share number 1, the wrap key custodian holding the first share inputs this information and presses Enter. A message is displayed that the share is received:
-
Received share 2-1
WWmTQj5PHGJQ4H9Y2ouURm8m75QkDOeYzFzOX1VyMpAOeF3YKYZyAVdM0WY4GErclVuAC
-
Continue to have each wrap key custodian enter the share information for each of the wrap key shares required to rejoin the key share. Once the sufficient number of wrap key shares have been inserted by the wrap key custodians, a final message is displayed:
-
Stored wrap key with ID 0x0002 on the device
-
Note that the ID of the wrap key on the secondary device is the same as that for the primary device. Once the wrap key has been stored on the secondary device, the YubiHSM Setup program reads the files containing the application authentication key, the CA root key, and, if applicable, the audit key that were saved to file under wrap during the configuration of the primary device.