W dniu 2013-05-15 17:55, Frank Swarbrick pisze:
"MK Ceremony". I like that. :-) Definitely what we'll have to do,
as I'm pretty sure we're not going to remove one of our cryptocards
and transport it to DR just for this. Interesting idea, though! Is
there a way to copy the master keys from one co-processor to
another?
IMHO You cannot copy master key, because you cannot read it. Of course
you can enter MK to many cards at the time.
BTW: "MK Ceremony" is more ceremony or black magice than real security
need. Imagine following scenario: simple PC with fresh-installed system
+ 3270 emulator connected even without SSL to the OSA card, using 5 ft
cable - all visible to the personnel involved. Now you can have several
persons responsible for key parts and one standing behind the display to
audit/manage the process. Don't forget about video surveillance -
cameras cannot see the display. As last part of the ceremony is to wipe
out the PC HDD (or destroy it if you want). Q: isn't it less secure than
using TKE? In what aspect?
Disclaimers:
1. I'm NOT talking about official certifications, regulations, but about
real things.
2. TKE can be used for other activities, not only MK Ceremony.
3. Preparation of the above scenario could be considered cumbersome, but
pay me half of the TKE price, I will do it for you! ;-) Last, but not
least: MK Ceremony is not everyday processs.
Regards
--
Radoslaw Skorupka
Lodz, Poland
--
Tre tej wiadomoci moe zawiera informacje prawnie chronione Banku
przeznaczone wycznie do uytku subowego adresata. Odbiorc moe by jedynie
jej adresat z wyczeniem dostpu osób trzecich. Jeeli nie jeste adresatem
niniejszej wiadomoci lub pracownikiem upowanionym do jej przekazania
adresatowi, informujemy, e jej rozpowszechnianie, kopiowanie, rozprowadzanie
lub inne dziaanie o podobnym charakterze jest prawnie zabronione i moe by
karalne. Jeeli otrzymae t wiadomo omykowo, prosimy niezwocznie
zawiadomi nadawc wysyajc odpowied oraz trwale usun t wiadomo
wczajc w to wszelkie jej kopie wydrukowane lub zapisane na dysku.
This e-mail may contain legally privileged information of the Bank and is intended solely for business use of the addressee. This e-mail may only be received by the addressee and may not be disclosed to any third parties. If you are not the intended addressee of this e-mail or the employee authorised to forward it to the addressee, be advised that any dissemination, copying, distribution or any other similar activity is legally prohibited and may be punishable. If you received this e-mail by mistake please advise the sender immediately by using the reply facility in your e-mail software and delete permanently this e-mail including any copies of it either printed or saved to hard drive.
BRE Bank SA, 00-950 Warszawa, ul. Senatorska 18, tel. +48 (22) 829 00 00, fax
+48 (22) 829 00 33, www.brebank.pl, e-mail: [email protected]
Sd Rejonowy dla m. st. Warszawy XII Wydzia Gospodarczy Krajowego Rejestru Sdowego, nr rejestru przedsibiorców KRS 0000025237, NIP: 526-021-50-88.
Wedug stanu na dzie 01.01.2013 r. kapita zakadowy BRE Banku SA (w caoci wpacony) wynosi 168.555.904 zotych.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
