This document discusses IBM's Global Security Kit (GSKit), which provides cryptographic functionality for IBM middleware applications. GSKit implements SSL/TLS for secure communication and uses standardized algorithms and key formats that are FIPS certified. It supports a variety of IBM products running on different platforms and operating systems. The document describes GSKit components, commands, application programming interfaces, certificate formats, and key store formats like CMS, PKCS#12, and PKCS#11.

1. © 2015 IBM Corporation1
IBM Systems - Middleware
IBM Global Security Kit as a
Cryptographic layer for IBM middleware
Troubleshooting, compliance and other security implications
Oktawian Powązka

2. © 2015 IBM Corporation2
IBM Systems - Middleware
GSKit intro
 GSKit is a component...not a stand-alone product,
 Shared by IBM products to facilitate SSL/TLS communication and secure
messaging,
 GSKit is Common Criteria and FIPS certified,
 Offered on wide spectrum of host platforms and operating systems,
 Delivered for IBM internal use in two different formats:
 Isolated ICC component (Lotus Notes),
 The whole GSKit package.
 Global vs Local install fluctuations

3. © 2015 IBM Corporation3
IBM Systems - Middleware
Applications
 NETCOOL/OMNIBUS,
 Informix,
 WAS/IHS,
 Tivoli security family: TAMeB/TAMBI/TIM, ...
 <SecureWay / Tivoli / Security> Directory Server,
 TLM,
 TSM,
 ITCAM,
 WebSphere MQ,
 Lotus Notes/Domino,
 CMOD
 DB2

4. © 2015 IBM Corporation4
IBM Systems - Middleware
 Native:
gsk<x>capicmd / runmqakm
 Ikeyman from command line:
Ikeycmd / gsk<x>cmd / runmqckm / nc_gskcmd / mqiptKeycmd
 Ikeyman GUI:
Ikeyman / gsk<x>ikm / strmqikm / nc_ikeyman / mqiptKeyman / pcsikm /
ikmguiw
 Two shapes of Ikeyman :
- Java launcher (doesn’t forward arguments ‘-D’ to JVM !!!)
- Java wrapper
GSKit Commands family

5. © 2015 IBM Corporation5
IBM Systems - Middleware
GSKit API
Formal ways to access GSKit interfaces are:
 SSL Toolkit / Secure Sockets API / SSL for C (using gsk<x>ssl library) provides
SSL/TLS,
 IDUP-GSS API (using gsk<x>acmeidup library) provides Signed/Enveloped Data
protection accordingly to RFC 2479.
 ICC stub (using gsk<x>iccs library) provides GSKit Crypto module based on
OpenSSL
 Key Management for C (using gsk<x>km library) provides keys and certificates
management functionality

6. © 2015 IBM Corporation6
IBM Systems - Middleware
Rules of GSKit
engagement
Time to Look at some Myths and Facts
 No customized/extra features per specific product,
 No such thing as dedicated Java/JVM installation for IKeyman,
 GSKit inherits the process space of the calling program, including privileges and
access permissions,
 No distinction in keys/certs or any crypto formats between 32 / 64 bit systems,
 BSafe as a GSKit Crypto provider was always supported although not
recommended,
Facts
Myths

7. © 2015 IBM Corporation7
IBM Systems - Middleware
GSKit Crypto
providers
ICC stub (gsk<x>iccs.<dll/so>)
IBM OpenSSL wrapper (icclib.<dll/so>)
OpenSSL SSLeay package (libeay32<x>.dll/libcrypto.so)
GSKit Crypto utility (gsk<x>cms.<dll/so>)
GSKit User interface (gsk<x>capicmd)
RSA BSAFE (gsk<x>krsw.<dll/so>)
SSL Toolkit (gsk<x>ssl.<dll/so>)
WMQ MCA (amqrmppa)

8. © 2015 IBM Corporation8
IBM Systems - Middleware
ICC - IBM Crypto for
C
 IBM ICC is a cryptographic module dedicated for IBM products,
 It act as a ‘compliancy’ wrapper (icclib) around the OpenSSL SSLeay package,
 ICC exports only a subset of the OpenSSL crypto library,
 Native OpenSSL data types are not directly exposed due to ‘name mangling’
(Lotus Notes case),
 Strict rules for ICC modules integrity check (amended by 8.x),
 In 8.x the FIPS mode is implicit using certified ICC module
(un-certified ICC version can be accessed explicitly),
 ICC initialization can be controlled by Environment Variables,
 Initialization process does impact performance.

9. © 2015 IBM Corporation9
IBM Systems - Middleware
Certificate
formats
X.509 ASN.1 DER encoded Certificate
 .der
The DER format as a binary representation of a certificate,
 .arm / .pem / .cer / .crt - typical extensions for Base64 encoded certificates
‘-----BEGIN CERTIFICATE-----
...’
 .p7b / .p7 / .smime / .eml (PKCS#7) - Base64 or binary format
‘-----BEGIN PKCS7----
...’

10. © 2015 IBM Corporation10
IBM Systems - Middleware
X.509 Certificate
structure
0000: 30 82 01 4e ; SEQUENCE (14e Bytes)
...
0015: 06 08 ; OBJECT_ID (8 Bytes)
0017: 2a 86 48 ce 3d 04 03 04 ; 1.2.840.10045.4.3.4 sha512ECDSA
0000: 30 82 01 4e ; SEQUENCE (14e Bytes)
...
0015: 06 08 ; OBJECT_ID (8 Bytes)
0017: 2a 86 48 ce 3d 04 03 04 ; 1.2.840.10045.4.3.4 sha512ECDSA
00: 30 82 01 4e 30 82 01 02 a0 03 02 01 02 02 04 55 ...N0..........U
10: 29 2d c4 30 0c 06 08 2a 86 48 ce 3d 04 03 04 05 )-.0...*.H.=....
00: 30 82 01 4e 30 82 01 02 a0 03 02 01 02 02 04 55 ...N0..........U
10: 29 2d c4 30 0c 06 08 2a 86 48 ce 3d 04 03 04 05 )-.0...*.H.=....
-----BEGIN CERTIFICATE-----
MIIFKzCCBBOgAwIBAgIQNmWFB3qIZ6tY9KCU+BA3MzANBgkqhkiG9w0BAQUFADCB
yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
-----BEGIN CERTIFICATE-----
MIIFKzCCBBOgAwIBAgIQNmWFB3qIZ6tY9KCU+BA3MzANBgkqhkiG9w0BAQUFADCB
yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ASN.1 Certificate structure
Binary view of ASN.1 DER encoded Certificate (.der)
Base64 representation of ASN.1 DER encoded Certificate (.arm / .pem)

11. © 2015 IBM Corporation11
IBM Systems - Middleware
 gsk<x>cmd (or other Java wrappers like runmqckm/nc_gskcmd) :
-target_type <cms | jceks | jks | kdb | p12 | pkcs12>
p12 pkcs12
cms kdb
 gsk<x>capicmd :
-target_type <cms | kdb | pkcs12 | p12>
p12 pkcs12
cms kdb
 File extension rules !!!
Exporting personal
certificates

12. © 2015 IBM Corporation12
IBM Systems - Middleware
GSKit Key Store
formats
 CMS
 PKCS#12
 PKCS#11
 PKCS#7 (limited support)

13. © 2015 IBM Corporation13
IBM Systems - Middleware
GSKit’s CMS
formats
 CMS V3 still used but slowly deprecated,
 CMS V4 FIPS compliant format,
 CMS V5 = PKCS#12 standard
Cryptographic Message Syntax
Certificate Management System

14. © 2015 IBM Corporation14
IBM Systems - Middleware
CMS keystores under the
hood
0000 37 48 04 02 00 00 00 00 58 35 30 39 4b 45 59 00 7H......X509KEY.
0010 00 00 13 88 00 00 00 17 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 66 b8 99 fa 92 8f 92 9b a5 38 25 db 01 5a 73 af f........8%..Zs.
0040 48 e0 a9 d2 fe 4e 49 b8 e7 35 a8 13 71 76 2f 15 H....NI..5..qv/.
0050 6b ab 05 ec cd a3 1c a4 00 00 00 01 00 00 00 01 k...............
0060 00 00 05 1e 30 82 05 1a 02 01 01 a1 82 04 dc 30 ....0..........0
0000 37 48 04 02 00 00 00 00 58 35 30 39 4b 45 59 00 7H......X509KEY.
0010 00 00 13 88 00 00 00 17 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 66 b8 99 fa 92 8f 92 9b a5 38 25 db 01 5a 73 af f........8%..Zs.
0040 48 e0 a9 d2 fe 4e 49 b8 e7 35 a8 13 71 76 2f 15 H....NI..5..qv/.
0050 6b ab 05 ec cd a3 1c a4 00 00 00 01 00 00 00 01 k...............
0060 00 00 05 1e 30 82 05 1a 02 01 01 a1 82 04 dc 30 ....0..........0
0000 37 48 03 02 00 00 00 00 58 35 30 39 4b 45 59 00 7H......X509KEY.
0010 00 00 13 88 00 00 00 17 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 fe 2d 36 ab 04 63 79 f7 9f ed ed 9e 36 59 a4 b2 .-6..cy.....6Y..
0040 61 cf a8 c0 5e 22 c2 a2 03 a9 e1 17 2c 5f dd b6 a...^"......,_..
0050 00 00 00 01 00 00 00 01 00 00 05 1e 30 82 05 1a ............0...
0000 37 48 03 02 00 00 00 00 58 35 30 39 4b 45 59 00 7H......X509KEY.
0010 00 00 13 88 00 00 00 17 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 fe 2d 36 ab 04 63 79 f7 9f ed ed 9e 36 59 a4 b2 .-6..cy.....6Y..
0040 61 cf a8 c0 5e 22 c2 a2 03 a9 e1 17 2c 5f dd b6 a...^"......,_..
0050 00 00 00 01 00 00 00 01 00 00 05 1e 30 82 05 1a ............0...
CMS V3
CMS V4

15. © 2015 IBM Corporation15
IBM Systems - Middleware
GSKit keystore validation
Validation of PKCS#12 keystore file (IKeyman)
 gsk8capicmd -keydb -list -db <keystore file> -pw <password>
...
KDB file format is CMS version 5 (PKCS12)
OID = PKCS12pbeWithSHAAnd40BitRC2CBC
...
KDB file format is CMS version 5 (PKCS12)
OID = PKCS12pbeWithSHAAnd40BitRC2CBC
Validation of CMS keystore file
...
KDB file format is CMS version 4
hdmac:
66 B8 99 FA 92 8F 92 9B A5 38 25 DB 01 5A 73 AF
48 E0 A9 D2
dbmac:
FE 4E 49 B8 E7 35 A8 13 71 76 2F 15 6B AB 05 EC
CD A3 1C A4
File size is as expected, good.
...
KDB file format is CMS version 4
hdmac:
66 B8 99 FA 92 8F 92 9B A5 38 25 DB 01 5A 73 AF
48 E0 A9 D2
dbmac:
FE 4E 49 B8 E7 35 A8 13 71 76 2F 15 6B AB 05 EC
CD A3 1C A4
File size is as expected, good.

16. © 2015 IBM Corporation16
IBM Systems - Middleware
CMS Keystore password
tale
0000 85 94 86 86 82 9a 87 91 c7 f5 4e 25 8b aa 05 9c ..........N%....
0010 d0 b4 fd 59 91 95 a4 0a d9 85 98 7d ba 59 e7 10 ...Y.......}.Y..
0020 3f 05 ce cb 96 e1 4e 11 4b 89 71 ae 25 d8 82 29 ?.....N.K.q.%..)
0030 ca bf f9 4f 02 47 1a 57 18 2b f4 14 68 fa f2 50 ...O.G.W.+..h..P
0040 d8 cd 04 3b 21 4e fe 2a f7 4b 71 ba a2 3c 5f 63 ...;!N.*.Kq..<_c
0050 b1 76 69 df fe f4 86 0f 4e 43 9e 7d db 5a 57 66 .vi.....NC.}.ZWf
0060 16 99 79 87 fa a3 2e ec 6f fc 5d 1c 3a ed b7 dc ..y.....o.].:...
0070 54 9d 4f c2 4a 75 7c 7a ef f1 43 c8 ab ff bd c2 T.O.Ju|z..C.....
0000 85 94 86 86 82 9a 87 91 c7 f5 4e 25 8b aa 05 9c ..........N%....
0010 d0 b4 fd 59 91 95 a4 0a d9 85 98 7d ba 59 e7 10 ...Y.......}.Y..
0020 3f 05 ce cb 96 e1 4e 11 4b 89 71 ae 25 d8 82 29 ?.....N.K.q.%..)
0030 ca bf f9 4f 02 47 1a 57 18 2b f4 14 68 fa f2 50 ...O.G.W.+..h..P
0040 d8 cd 04 3b 21 4e fe 2a f7 4b 71 ba a2 3c 5f 63 ...;!N.*.Kq..<_c
0050 b1 76 69 df fe f4 86 0f 4e 43 9e 7d db 5a 57 66 .vi.....NC.}.ZWf
0060 16 99 79 87 fa a3 2e ec 6f fc 5d 1c 3a ed b7 dc ..y.....o.].:...
0070 54 9d 4f c2 4a 75 7c 7a ef f1 43 c8 ab ff bd c2 T.O.Ju|z..C.....
‘password2’
0000 85 94 86 86 82 9a 87 91 c4 f5 af 58 00 2d d8 f3 ...........X.-..
0010 63 a1 81 1a ea 4e 83 22 a7 8f b5 4d 85 da 88 49 c....N."...M...I
0020 82 42 ce 45 a5 8d d6 9f 59 ed 10 ea 06 72 46 f3 .B.E....Y....rF.
0030 0a 9d be 2b c5 bf 0c 88 ed 65 b4 6a 6b 2d 0a 4e ...+.....e.jk-.N
0040 c2 f3 b2 ac 01 be e2 ff 55 3f cf 50 72 47 31 33 ........U?.PrG13
0050 24 8c c3 17 27 12 84 f4 e2 ce 57 6c 18 96 47 be $...'.....Wl..G.
0060 f8 ad 19 f6 d6 64 df b8 e4 22 3c 32 73 8a dc ca .....d..."<2s...
0070 be 94 bf 51 f7 07 6e d6 14 ec 5e 33 c3 c0 71 d2 ...Q..n...^3..q.
0000 85 94 86 86 82 9a 87 91 c4 f5 af 58 00 2d d8 f3 ...........X.-..
0010 63 a1 81 1a ea 4e 83 22 a7 8f b5 4d 85 da 88 49 c....N."...M...I
0020 82 42 ce 45 a5 8d d6 9f 59 ed 10 ea 06 72 46 f3 .B.E....Y....rF.
0030 0a 9d be 2b c5 bf 0c 88 ed 65 b4 6a 6b 2d 0a 4e ...+.....e.jk-.N
0040 c2 f3 b2 ac 01 be e2 ff 55 3f cf 50 72 47 31 33 ........U?.PrG13
0050 24 8c c3 17 27 12 84 f4 e2 ce 57 6c 18 96 47 be $...'.....Wl..G.
0060 f8 ad 19 f6 d6 64 df b8 e4 22 3c 32 73 8a dc ca .....d..."<2s...
0070 be 94 bf 51 f7 07 6e d6 14 ec 5e 33 c3 c0 71 d2 ...Q..n...^3..q.
‘password1’

17. © 2015 IBM Corporation17
IBM Systems - Middleware
 Used to bundle a private key with X.509 certificate,
 Popular extensions: ‘.p12’ , ‘.pfx’,
 PFX as a broken predecessor of PKCS#12,
 The PFX...is just protected wrapper (40bit RC2) around initial PKCS#12 content,
 Minimum 128bit key size for FIPS compliant keystore,
 PKCS12S2 = ???...PFX rules,
 gsk8capicmd -keydb -convert -db <PKCS#12 keystore file>
-new_format pkcs12 -new_db <PKCS#12 keystore file>
PKCS#12 under IKeyman/GSKit
domain
...
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC
...
...
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC
...
openssl dump of PKCS#12 file (IKeyman)

18. © 2015 IBM Corporation18
IBM Systems - Middleware
GSKit certificate requests
database
0000 37 48 03 01 00 00 00 00 58 35 30 39 4b 59 50 00 7H......X509KYP.
0010 00 00 13 88 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 47 32 fc 56 a0 ab e6 3e 9a 66 b3 4b 12 62 0c ec G2.V...>.f.K.b..
0040 b1 bb 19 c3 f9 fb 97 87 36 e7 99 2c fc 0c 89 6b ........6..,...k
...
01e0 84 2f 04 c0 d9 eb 00 87 f3 27 74 6f 30 82 02 a0 ./.......'to0...
01f0 30 1a 06 09 2a 86 48 86 f7 0d 01 05 0a 30 0d 04 0...*.H......0..
...
0000 37 48 03 01 00 00 00 00 58 35 30 39 4b 59 50 00 7H......X509KYP.
0010 00 00 13 88 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 47 32 fc 56 a0 ab e6 3e 9a 66 b3 4b 12 62 0c ec G2.V...>.f.K.b..
0040 b1 bb 19 c3 f9 fb 97 87 36 e7 99 2c fc 0c 89 6b ........6..,...k
...
01e0 84 2f 04 c0 d9 eb 00 87 f3 27 74 6f 30 82 02 a0 ./.......'to0...
01f0 30 1a 06 09 2a 86 48 86 f7 0d 01 05 0a 30 0d 04 0...*.H......0..
...
‘.rdb’ file structure (IKeyman)
 ‘.rdb’ file contains private key (PKCS#8) plus copy of
certificate request (PKCS#10)
 Be careful with ‘.rdb’ files backups...!!!
 ‘06 09 2a 86 48 86 f7 0d 01 05 0a’ - PBE With SHA1 And DES
 ‘06 0b 2a 86 48 86 f7 0d 01 0c 05 01 03’ - PBE With SHA1 And TripleDES

19. © 2015 IBM Corporation19
IBM Systems - Middleware
GSKit Certificate
requests
 Certificate request (PKCS#10) file contains public key and set of attributes.
----- BEGIN NEW CERTIFICATE REQUEST -----
MIIBfTCB5wIBADA+MRAwDgYDVQQKEwdjb21wYW55MQ0wCwYDVQQLEwR1bml0MRsw
...
----- END NEW CERTIFICATE REQUEST -----
----- BEGIN NEW CERTIFICATE REQUEST -----
MIIBfTCB5wIBADA+MRAwDgYDVQQKEwdjb21wYW55MQ0wCwYDVQQLEwR1bml0MRsw
...
----- END NEW CERTIFICATE REQUEST -----
Base64 representation of ASN.1 DER encoded certificate request file (.arm / .pem)
PKCS#
7
PKCS#
10
CA‘.rdb’ file

20. © 2015 IBM Corporation20
IBM Systems - Middleware
GSKit Certifications
 Common Criteria
 FIPS
 SUITE B

21. © 2015 IBM Corporation21
IBM Systems - Middleware
 BSafe as a crypto provider is not supported,
 Verify NIST website that the particular version of GSKit indeed contains an ICC
crypto module that is FIPS certified (formal certification is not very
frequent...the latest is 8.2.2.0),
 GSKit v8.x provides the multi ICC module instance :
‘C’ folder contains the latest FIPS certified release,
‘N’ folder contains the latest version,
The swap can be done through ICC_IGNORE_FIPS (formal compliance vs
performance/progress/security),
 FIPS approved ciphers & FIPS approved mode of operation,
 OpenSSL FIPS approved functions for distributions start from version
0.9.7j...GSKit 7.0.x encapsulates 0.9.7c from 2003,
GSKit under FIPS 140-2

22. © 2015 IBM Corporation22
IBM Systems - Middleware
FIPS
implications
 When the ICC module is initialized, it goes through SelfTest procedure:
- module integrity check,
- crypto algorithms check
(Known Answer Test impacts performance...RNG set),
 ICC Initialization is done once per process basis,
 Key Zeroization wrapper extends OpenSSL implementation,
 Certificates and Keys should be created by a FIPS-approved module,
 GSKit command line utilities and famous ‘-fips’ switch:
in 7.x it just rejects MD5 and BSafe usage...controversial,
in 8.x it also checks the key sizes (for new objects only) and ICC module
compliance,
No ‘-fips’ switch for IKeyman command line utilities !!!

23. © 2015 IBM Corporation23
IBM Systems - Middleware
 Suite B as a sub-set of FIPS approved modes,
 RSA -> EC,
 Secret vs Top Secret level,
 Requirements as to key/hash length and cipher suite,
 TLS version 1.2,
 GSKit 8.x and above,
 No mode for GSKit command line utilities...compliance setup only by SSL
Toolkit
(GSK_SSL_SUITEB_MODE_PROCESSING & GSK_STRICT_SIGALG),
 ‘-sigalg’ switch for ‘Suite B’ compliant certificates,
 CMS / RDB keystore formats are out of scope.
SUITE B - next step in sophisticated crypto recommendations
Does NSA inflence the EC set ?

24. © 2015 IBM Corporation24
IBM Systems - Middleware
Common Criteria #1
 GSKit is certified to EAL-4,
 The latest certified stream is 8.0.14.x (includes OpenSSL 0.9.8),
 Enforcing CC mode can be controlled by GSK_CC_MODE_CONTROL,
 Implicit FIPS-compliant mode,
 BSafe as a crypto provider is not supported,
 Successful ICC SelfTest,
 The use of stash files seems to be controversial (CC for 7c =
7.0.3.x),
 Enforce requirements for the passwords strength (‘-strong’),
 User-typed passwords are not accepted (use ‘-random -create’).

25. © 2015 IBM Corporation25
IBM Systems - Middleware
Common Criteria
#2
 GSKit must ignore all runtime Environment Variables (reset the state),
 Can’t use CMS / RDB V3,
 Enforce certificate validation accordingly to RFC 5280,
 IKeyman (and all Java related elements) are out of scope,
 Disable PKCS#11 hardware support,
 Single user only environment... remote login must be disabled,
 Physical device and Operating System must be located within
controlled access facilities.

26. © 2015 IBM Corporation26
IBM Systems - Middleware
GSKit and RNG
 The default GSKit RNG is HMAC-SHA256/TRNG implemented accordingly to
SP800-90,
 TRNG vs hardware support,
 Use ICC_TRNG to control the entropy source for ICC (‘/dev/random’, RdRand),
 Alternate DRBG/PRNG (SHA256) through non-FIPS library (‘/dev/urandom’),
 GSKit RNG variants are compatible with an old ANSI X9.31,
 No Dual_EC_DRBG,

27. © 2015 IBM Corporation27
IBM Systems - Middleware
GSKit in the JAVA
world

28. © 2015 IBM Corporation28
IBM Systems - Middleware
iKeyman...a gateway into the crypto
world
 iKeyman can be run in two modes:
- Graphic User Interface (GUI),
- Command Line (CLI).
 GUI and CLI are identical as far as cryptographic aspects goes,
 Historically (before GSKit V8), iKeyman was simultaneously bundled with GSKit
and Java package,
 IKeyman is just a java wrapper / launcher started from
‘com.ibm.gsk.ikeyman.<Ikeyman/ikeycmd>’ class,
 Two parallel implementations :
- gsk<x>cls.jar - GSKit iKeyman
- gskikm.jar - JDK iKeyman
 Both jars are loaded when started through gsk<x>ikm or gsk<x>cmd...just brilliant.
(classes from gsk<x>cls.jar will never be executed by JVM)
 gsk<x>ikm and gsk<x>cmd use JAVA_HOME for JVM location,

29. © 2015 IBM Corporation29
IBM Systems - Middleware
iKeyman versioning saga
The ‘About’ popup from iKeyman 8
The ‘About’ popup from iKeyman 7
 ‘iKeyman 8’ is always run from the gskikm.jar located under ‘…/java/jre/lib/ext’
 ‘iKeyman 7’ can be run from the ‘gsk<x>cls.jar’ or ‘gskikm.jar’...you never know

30. © 2015 IBM Corporation30
IBM Systems - Middleware
 Is the removal of gskikm.jar (JDK iKeyman) a good solution ?
 Java JCE/JCEFIPS vs GSKit cryptographic provider,
 Use unrestricted Policy files (‘local_policy.jar’ / ‘US_export_policy.jar’)
(restricted crypto never reduces hash functions availability,
SHA-2 family available from 7.0.4),
 iKeyman initialization is controlled by ikminit.properties file
(located under ‘…gsk<x>classes’ or ‘…java<x>jrebin’ folder),
...
DEFAULT_FIPS_MODE_PROCESSING=ON
DEFAULT_CRYPTOGRAPHIC_BASE_LIBRARY=ICC
DEFAULT_SIGNATURE_ALGORITHM=SHA1_WITH_RSA
DEFAULT_CMS_STORE_VER_V4=true
...
DEFAULT_FIPS_MODE_PROCESSING=ON
DEFAULT_CRYPTOGRAPHIC_BASE_LIBRARY=ICC
DEFAULT_SIGNATURE_ALGORITHM=SHA1_WITH_RSA
DEFAULT_CMS_STORE_VER_V4=true
iKeyman troubleshooting
Excerpt from ikminit.properties file
iKeyman 7 (disabled by default)
iKeyman 7/8 (can be ignored)
iKeyman 7 (can be ignored)
iKeyman 7 (can be ignored)

31. © 2015 IBM Corporation31
IBM Systems - Middleware
 SHA5…well, this is still a song of the
future.
Hash suite ‘counterfeit’
 Signature Algorithms defined in ‘iKeyman 7’

32. © 2015 IBM Corporation32
IBM Systems - Middleware
 ‘iKeyman 7’ loads a CMS provider (GSKit JNI wrapper) automatically
(com.ibm.spi.IBMCMSProvider),
no need for updates in ‘java.security‘ file !!!
 ‘iKeyman 8’ uses a dedicated Java based CMS provider
(com.ibm.security.cmskeystore.CMSProvider - ibmcmsprovider.jar)
this model does require setup within ‘java.security‘ file.
 You can’t mix those CMS providers...
Java CMS...Certificate Management System providers
Confusing keystore types under ‘iKeyman 7’

33. © 2015 IBM Corporation33
IBM Systems - Middleware
 JAVA_HOME rules,
 gsk<x>kjni library requires the same ‘bitness’ as underlying JVM,
 Use truss / procmon when in doubt,
GSKit IKeyman in 64bit
world

34. © 2015 IBM Corporation34
IBM Systems - Middleware
IKEYMAN under FIPS 140-
2
 Requires at least Java 6.0,
 Setup java.security file by adding IBMJCEFIPS as a security provider
(watch out for IBMJCE / IBMJCEFIPS reciprocal order),
 DEFAULT_FIPS_MODE_PROCESSING setup not really required,
 ECDSA for Suite B compliance available since 8.0.383,
 IBMJCEFIPS does impact performance,
 Make sure to use CMS V4...watch out for ‘.rdb’ files format,

35. © 2015 IBM Corporation35
IBM Systems - Middleware
IDUP-GSS...signed/enveloped data protection
 Independent Data Unit Protection designed by IETF,
 IDUP-GSS provides a standard for cryptographic envelope,
 Describes an encapsulation syntax for a protected data,
 Used by WebSphere MQ Advanced Message Security.

36. © 2015 IBM Corporation36
IBM Systems - Middleware
GSKit
troubleshooting
 ICC_TRNG and ICC_IGNORE_FIPS
 <Ikeyman CMD/GUI> -Dkeyman.debug=true -Dkeyman.jnitracing=on
 java -Djava.security.debug=all com.ibm.gsk.ikeyman.ikeycmd ...
 GSKCAPICMD_TRACE_FILE = <...>
 GSKKM_TRACE_FILE = <...>
 GSKKM_TRACE_LEVEL=0xFFFF
 GSK_TRACE=0xFFFF
 GSK_TRACE_FILE = <...>
 gsk8capicmd -keydb -convert -db <keystore file> -new_format ...
-new_db <keystore file>

37. © 2015 IBM Corporation37
IBM Systems - Middleware
Keystores/Certificates troubleshooting
tools
 openssl s_client -connect IP/Host:Port
 openssl asn1parse -in <file in Base64 format>
 certutil -<asn/dump> <file in Base64/Binary/PKCS#7/PKCS#12 format>
(certutil can also be used as a HEX viewer)
 Keytool -printcert -file <cert in Base64/Binary>
 dumpasn1

38. © 2015 IBM Corporation38
IBM Systems - Middleware