Crypt2Pay User'S Guide: Version No.: 1.0 Reference: Bntng/V7/En/Lp54007

CRYPT2Pay User's Guide
Version No.: 1.0

Reference: BNTng/V7/EN/LP54007
THIS DOCUMENT IS THE PROPERTY OF BULL AND MAY NOT BE REPRODUCED OR COMMUNICATED WITHOUT ITS WRITTEN AUTHORIZATION
Trademarks
All brand names and product names are trademarks or registered trademarks of their
respective owners.
Copyrights
Under the copyright law, neither the Crypt2Pay software nor documentation may be
copied, photocopied, reproduced, translated or reduced to any electronic medium or
machine readable form, in whole or in part, without the prior written consent of Bull
SA.
License Conditions
Please read your license agreement with Bull carefully and make sure you understand
the exact terms of usage.
You are not allowed to make any modifications to the product. If you feel the need
for any modifications, please contact Bull.
Disclaimer
This Document is provided “ as is” without warranty of any kind, either express or
implied, including, but not limited to, the implied warranties of merchantability,
fitness for a particular purpose, or non-infringement.
This document could include technical inaccuracies or typographical errors. Changes
are periodically made to the information herein; these changes will be incorporated
in new editions of the document. Bull may make improvements of and/or changes to the
product described in this document at any time.
Contact
If you wish to obtain further information on this product or any other Bull product,
you are always welcome to contact us.
http://www.bull.com/security/crypt2pay.html
Date: 04/06/05
Doc. title: CRYPT2Pay User's Guide
Doc. reference: BNTng/V7/EN/LP54007
Doc. version: 1.0
CE DOCUMENT EST LA PROPRIETE DE BULL INGENIERIE ET NE PEUT ETRE REPRODUIT OU COMMUNIQUE SANS AUTORISATION ECRITE
REFERENCE VERSION PAGE
CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 M1
Document revision notice
VERSION NUMBER DATE OF REASONS

REVISION
1.0 05/08/05 Creation of document
CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 TMI
CONTENTS
1. INTRODUCTION______________________________________________________________________________ 1
1.1. GENERAL DESCRIPTION ..................................................................................................................................................1
1.2. CONTENT OF THIS DOCUMENT ........................................................................................................................................1
1.3. BULL SERVICE ASSISTANCE ...........................................................................................................................................2
2. HOW TO GET STARTED ? _____________________________________________________________________ 3
2.1. INSTALL AND INITIALISE KMC AND ITS HSM ...............................................................................................................3

2.1.1. Step A1 : Reception and connection of CRYPT2Pay authorized for KMC ..............................................................3
2.1.2. Step A2 : Personalization of CRYPT2Pay authorized for KMC ..............................................................................4
2.1.3. Step A3 : Installation of the KMC software .............................................................................................................6
2.1.4. Step A4 : Initialization of the KMC database ..........................................................................................................7
2.1.5. Step A5 : Key loading test (Optional, but highly recommended).............................................................................8
2.1.6. Step A6 : Personalization validation .......................................................................................................................9
2.2. INSTALL AND INITIALISE AN ADDITONAL CRYPT2PAY ...............................................................................................11
2.2.1. Step B1 : Reception and connection of an other CRYPT2Pay...............................................................................11
2.2.2. Step B2 : Personalization of CRYPT2Pay .............................................................................................................12
2.2.3. Step B3 : Update the KMC database .....................................................................................................................13
2.2.4. Step B4 : Key loading test (Optional, but highly recommended)...........................................................................14
2.2.5. Step B5 : Personalization validation .....................................................................................................................15
2.3. INITIALISE SERVICE KEYS .............................................................................................................................................17
2.3.1. Step C1 : Update the KMC database with service keys ........................................................................................17
2.3.2. Step C2 : CRYPT2Pay up and running..................................................................................................................18
3. GENERAL CONFIGURATION PROCEDURES___________________________________________________ 19
3.1. USER ADMINISTRATION ................................................................................................................................................19

3.1.1. Initialization of user management .........................................................................................................................19
3.1.2. Reset user management .........................................................................................................................................19
3.2. APPLICATION ADMINISTRATION ...................................................................................................................................20
3.2.1. Loading options .....................................................................................................................................................20
3.2.2. Checking and activating options............................................................................................................................20
3.2.3. Change or update firmware ...................................................................................................................................20
CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 TMII
LIST OF ILLUSTRATIONS
Figure 1 Reception and connection of CRYPT2Pay authorized for KMC .....................................................................................3

Figure 2 Personalization of CRYPT2Pay authorized for KMC .....................................................................................................4
Figure 3 Installation of the KMC software ....................................................................................................................................6
Figure 4 Initialization of the KMC database..................................................................................................................................7
Figure 5 Key loading test ...............................................................................................................................................................8
Figure 6 Personalization validation...............................................................................................................................................9
Figure 7 Reception and connection of other CRYPT2Pays..........................................................................................................11
Figure 8 Personalization of production CRYPT2Pay ..................................................................................................................12
Figure 9 Update of the KMC database ........................................................................................................................................13
Figure 10 Key loading tests..........................................................................................................................................................14
Figure 11 Personalization validation...........................................................................................................................................15
Figure 12 Update of the KMC database with service keys ..........................................................................................................17
Figure 13 CRYPT2Pays up and running......................................................................................................................................18
CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 1
1. INTRODUCTION
1.1. General description

CRYPT2Pay is a high-performance encryption product for banks, used to secure bank transactions using magstripe
cards and smart cards for cash withdrawals and payments.
Additionally, CRYPT2Pay also offers Personal Identification Number generation and cryptographic data computation
functions used to prepare the magstripe card personalization data.
Specified jointly with the largest French banks, CRYPT2Pay product helps meet the security requirements of electronic
banking servers to handle EMV transactions (EMV96, EMV 2000) taking into account the special characteristics of the
international Mastercard (Mchip 2, Mchip4) and VISA (VIS132, VIS140) payment systems.
CRYPT2Pay is the response to two requirements:

• Security: Fraud fighting involves checking and calculating cryptographic data on electronic banking servers.
Hence the need for connection to those systems of a device used to securely store and handle the « secrets ». This
module's resistance to aggression is key to the confidence in a payment systems.
• Performance.
This product is easily implemented by direct connection to the bank's server system via an IP or X25 link.
The implementation of cryptographic equipment, for the purpose of achieving secure exchanges with remote servers
over networks, and with stripe or smart cards personalized with issuer's keys, implies the management of keys the
number of which increases as the number of equipment units, remote servers and issuer is keys increases. To control
key distribution to CRYPT2Pays and simplify keys management at each electronic banking server, Bull provides a
specific key management tool known as KMC (Key Management Center).
1.2. Content of this document

Chapter 2 "How to get started" contains a complete description of the procedure used to have CRYPT2Pays up and
running. Initializing a HSM (Host Security Module) requires several steps (installation, personalization, key
management…) some of which are very critical (e.g. the Master Key introduced during personalization cannot be
changed after personalization validation).
Bull highly recommend it's customers to get some training and/or assistance from Bull's experts in order to
guarantee a safe and quick installation of the solution.
Chapter 3 "General configuration procedures" contains a list of main configuration procedures.
1.3. Bull Service Assistance

If you require any further information, please call the Bull Services assistance department:
Bull Services
HSM & Pre-personalization Solutions
Business Unit
Rue Jean Jaures
BP 68
78340 Les Clayes-sous-Bois
FRANCE
HOT LINE : Telephone +(33) 1.30.80.62.00
e-mail: [email protected]
Fax: + (33) 1.30.80.78.87
2. HOW TO GET STARTED ?

You have received two or more CRYPT2Pay's. Among these CRYPT2Pay, at least one has been authorized to be used
as the KMC's HSM (Please refer to the delivery order to identify which CRYPT2Pay has the 'KMC' option authorized).
In order to have all your CRYPT2Pays up and running, you will have to load production software, personalize
CRYPT2Pays, install the KMC (Key Management Center) and create key distribution files.
This chapter briefly explains the standard procedure to have your CRYPT2Pay up and running, and gives you the
reference of detailed procedures in "CRYPT2Pay Reference Manual" or in the "KMC user's guide".
In this procedure, KMC server is also used as the administration workstation for CRYPT2Pay.
2.1. Install and Initialise KMC and its HSM
2.1.1. Step A1 : Reception and connection of CRYPT2Pay authorized for

KMC
CRYPT2Pay KMC software

production
ISO7816-4 software
Production CRYPT2Pays
Initialized Smart Cards
KMC PC (not
supplied by Bull)
CRYPT2Pay with
KMC option
SafePAD
Figure 1 Reception and connection of CRYPT2Pay authorized for KMC

• Check the content of the delivery (See CRYPT2Pay Reference Manual § INSTALLATION – Reception of the
equipment)
• Connect the safePAD to the front I/O port with the supplied cable
• Connect the power supply and power CRYPT2Pay ON (See CRYPT2Pay Reference Manual § INSTALLATION –
Powering on).
9 The transport application is lauched.
• Connect the KMC PC to the Ethernet port of CRYPT2Pay (RJ45 cable or HUB, not supplied with CRYPT2Pay)
(See CRYPT2Pay Reference Manual § INSTALLATION – Administration setup)
• Set the IP address and network mask of the KMC PC so that the KMC can connect to CRYPT2Pay default address
(See CRYPT2Pay Reference Manual § INSTALLATION – Verification of CRYPT2Pay configuration and
parameters setting)
• Using a browser on the KMC PC, connect to the administration server of Transport Application and load
CRYPT2Pay software (See CRYPT2Pay Reference Manual § CRYPT2Pay ADMINISTRATION – Application
management – “Download” sub-menu)
Warning: Do not to stop the CRYPT2Pay software loading (no "tilt" machine or stop of CRYPT2Pay). In case of
problem during loading, it would be necessary to carry out two successive switch-off. At first reboot CRYPT2Pay
will boot on the partition which should have been loaded. Since its state is wrong, the boot fails. It is thus necessary
to switch the CRYPT2Pay HSM off and on to start again properly on the first partition.
• Reboot CRYPT2Pay
9 The front light turns to orange, since CRYPT2Pay is not personalized, and the safePAD displays the
personalisation prompt
9 Status of CRYPT2Pay:
¾ Active Area: Production software (I)
¾ Inactive Area: Transport software (X)
¾ Boot area at power on: Transport software (X)
¾ Not personalized
¾ Default IP Address, .
2.1.2. Step A2 : Personalization of CRYPT2Pay authorized for KMC

production
ISO7816-4 software
KMC PC (not
supplied by Bull)
CRYPT2Pay with KMC option
SafePAD
KM2bntx
Figure 2 Personalization of CRYPT2Pay authorized for KMC

• Start the personalization process (See CRYPT2Pay Reference Manual § SECURITY PROCEDURES – Customer
personalization)
• Validate the "Generate key" choice to proceed with master key generation and identification (Key owner,
CRYPT2Pay logical number) (See CRYPT2Pay Reference Manual § SECURITY PROCEDURES – Customer
personalization - Stage 2 description : KM2bnt(x) key generation)
• The Master Key is splitted in two components, each one being stored on a smart card. Don't forget to label the
smart card used to store the key and write the key index. (One smart card can be used to store up to 15 key
component)
9 The Master Key is splitted in two components stored in labelled smart cards.
• Validate the "Input key" choice to proceed with introduction of the master key in the protected memory of
CRYPT2Pay (See CRYPT2Pay Reference Manual § SECURITY PROCEDURES – Customer personalization -
Stage 3 description : Key introduction by card function)
• Check the key attributes imported from the smart card (See CRYPT2Pay Reference Manual § SECURITY
PROCEDURES – Customer personalization - Personalization confirmation function)
• DO NOT VALIDATE the personalization at this step
9 CRYPT2Pay authorized for KMC is now up and running, but personalization has not been validated.
• Using a browser on the KMC PC, connect to the administration server of CRYPT2Pay
• Open an administration session using default login and password (See CRYPT2Pay Reference Manual §
UTILIZATION AND ADMINISTRATION PRINCIPLES – User profiles and accounts and § CRYPT2Pay
ADMINISTRATION – Opening an administration session)
• Change the default boot area so that production application be the default (See CRYPT2Pay Reference Manual §
CRYPT2Pay ADMINISTRATION – Application management – “Set up Boot” sub-menu)
• Configure the final CRYPT2Pay IP address (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – System management “System” menu –“TCP/IP” sub-menu). This change will be taken
into account at next reboot. Do not reboot now.
• Check and activate options (See CRYPT2Pay Reference Manual § CRYPT2Pay ADMINISTRATION –
Application management - “Options” sub-menu).
¾ Boot area at power on: Production software (I)
¾ Personalization not validated
¾ Final IP Address (at next boot).
2.1.3. Step A3 : Installation of the KMC software
CRYPT2Pay
production
ISO7816-4 software
KMC PC (not KMC software

supplied by Bull)
SafePAD
KM2bntx
Figure 3 Installation of the KMC software
• Install the KMC software on a PC (See KMC Installation guide)

• Update the KMC configuration file to set the default CRYPT2Pay address and port and set the trace level (See
KMC User's guide § Initial configuration for CRYPT2Pay connection and §2.5 Initial configuration of the KMC)
9 The KMC is now installed.
2.1.4. Step A4 : Initialization of the KMC database

production
software
KDK File
KMC PC (not
supplied by Bull)
db
SafePAD KDKM
KM2bntx
Figure 4 Initialization of the KMC database
• Start the KMC software (See KMC User's guide § Running the KMC)
• Create a KDKM key to protect CRYPT2Pay master keys in the database (See KMC User's guide § Creating the key
label). The key owner shall be identical to CRYPT2Pay owner set during personalization.
• Generate the KDKM value and output it in two smart cards (See KMC User's guide § Output on external media
(paper or card)). Use a distinct smart card set for storing KDKM and KM2bntx. Don't forget to label the smart
card used to store the key and write the key index. (One smart card can be used to store up to 15 key components).
9 The KDKM for KM2bntx is now generated and stored in two smart cards.
• Input the KDKM value from smart cards (See KMC User's guide § Entry from external media (paper or card)).
• Create the KM2bntx key in the KMC database, under the KDKM (See KMC User's guide § Creating the key label).
The key owner shall be identical to CRYPT2Pay owner set during personalization.
The key number shall be identical to key version set during personalization.
The complementary identifer (IdC) shall be the following:
30 00 00 nn nn 00 00 00 00 00 00 00 00
where nn nn is CRYPT2Pay logical number set during personalization
• Input the KM2bntx value from smart cards (See KMC User guide § Entry from external media (paper or card)).
9 The KM2bntx is now stored in the KMC database, encrypted under KDKM
• Create another KDKM key to protect the Key Distribution Keys in the database (See KMC User's guide § Creating
the key label).
• Generate the KDKM value and output it in two smart cards (See KMC User's guide § Output on external media
(paper or card)). Yon can store this key in the same smart cards than the first KDKM, with a distinct index. Don't
forget to label the smart card used to store the key and write the key index. (One smart card can be used to store up
to 15 key component).

9 The KDKM for KDKs is now generated and stored in two smart cards.
• Input the KDKM value from smart cards (See KMC User's guide § Entry from external media (paper or card)).
• Create the KDK key in the KMC database, under the KDKM (See KMC User's guide § Creating the key label).
• Generate the KDK value (See KMC User's guide § Key generation).
9 The first Key Distribution Key is now generated and stored in the KMC database, encrypted under a
KDKM.
• Create a group of HSMS (See KMC User'sguide § Group creation).

• Create a CRYPT2Pay in this group (See KMC User's guide § Equipment creation). You can use CRYPT2Pay
logical number as the HSM label.
• Select the KM2bntx key in the key tree and assign it to CRYPT2Pay (See KMC User's guide § Key assignment to
equipment or group).
• Select the KDK key in the key tree and assign it to the group (See KMC User's guide § Key assignment to
9 CRYPT2Pay is now configured in the KMC database, with its master key and key distribution key.
• Create the key distribution files for CRYPT2Pays (See KMC User's guide § Generation).
• Save the KMC database (Menu 'Database', option 'Save').
• Exit from the KMC software (Menu 'Database', option 'Exit').
9 KDK file is created and contains the KDK token encrypted under the KM2bntx.
9 The KMC database is stored in the PC.
2.1.5. Step A5 : Key loading test (Optional, but highly recommended)

production
software
KDK File
KMC PC (not
supplied by Bull)
db
SafePAD KM2bntx
KDKMs
Figure 5 Key loading test

• connect CRYPT2Pay to the host server
• Switch CRYPT2Pay OFF and ON to reboot (the actual new IP address of CRYPT2Pay is now active).
9 If CRYPT2Pay has been moved, security mechanisms may have triggered (flashing red light). In that case
you will have to reboot. The front light turns to orange, since CRYPT2Pay personalization has been
canceled, and the safePAD displays the personalisation prompt.
personalization)
• SKIP the "Generate key" choice
• Validate the "Input key" choice to proceed with the introduction of the master key in the secured memory of
• DO NOT VALIDATE the personalization
9 The front light are green and CRYPT2Pay application is launched
• Check the KDK loading (Please refer to the server application documentation for the detailed procedure)
9 The result of steps A1 to A4 is checked (i.e. CRYPT2Pay personalization and KMC database initialization
was successfully performed). You can apply the personalization
2.1.6. Step A6 : Personalization validation

production
software
KDK File
KMC PC (not
supplied by Bull)
db
SafePAD KM2bntx
KDKMs
Figure 6 Personalization validation
• Move CRYPT2Pay to activate security mechanisms
9 Front light is flashing red.
• Switch CRYPT2Pay OFF and ON to reboot (twice).
9 The front light turns to orange, since CRYPT2Pay personalization has been cancelled, and the safePAD
displays the personalisation prompt.
personalization)
• Validate the "Input key" choice to proceed with introduction of the master key in the secured memory of
• VALIDATE the personalization now
• Switch CRYPT2Pay OFF and ON to reboot.
9 The front light turns to green: CRYPT2Pay authorized for KMC is now personalized.
• Set the IP address and network mask of the KMC PC so that the KMC can connect to CRYPT2Pay address
• Update the KMC configuration file to set the correct CRYPT2Pay IP address
• Using a browser on the KMC PC, connect to the administration server and load CRYPT2Pay software in the
inactive area, to replace the transport application (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – Application management – “Download” sub-menu)
• Reboot CRYPT2Pay on the loaded partition to check download (See CRYPT2Pay Reference Manual §
CRYPT2Pay ADMINISTRATION – Application management – “Reboot” sub-menu)
¾ Inactive Area: Production software (I)
¾ Personalization validated
¾ Final IP Address.
2.2. Install and Initialise an additonal CRYPT2Pay
2.2.1. Step B1 : Reception and connection of an other CRYPT2Pay
CRYPT2Pay
production
KMC software software
KMC PC (not
supplied by Bull)
SafePAD KM2bntx
KDKMs
Figure 7 Reception and connection of other CRYPT2Pays
• Check the content of the delivery (See CRYPT2Pay Reference Manual § INSTALLATION – Reception of the
equipment)
• Connect the safePAD to the front I/O port of the production CRYPT2Pay with the supplied cable
• Connect the power supply and power CRYPT2Pay ON (See CRYPT2Pay Reference Manual § INSTALLATION –
Powering on).
9 The transport application is lauched.
• Connect the KMC PC to the Ethernet port of CRYPT2Pay (RJ 45 cable or HUB, not supplied with CRYPT2Pay)
(See CRYPT2Pay Reference Manual § INSTALLATION – Administration setup)
• Set the IP address and network mask of the KMC PC so that the KMC can connect to CRYPT2Pay default address
(See CRYPT2Pay Reference Manual § INSTALLATION – Verification of CRYPT2Pay configuration and
parameter setting)
• Using a browser on the KMC PC, connect to the administration server and load CRYPT2Pay software (See
CRYPT2Pay Reference Manual § CRYPT2Pay ADMINISTRATION – Application management – “Download”
sub-menu)
Warning: Do not to stop the CRYPT2Pay software loading (no "tilt" machine or stop of CRYPT2Pay). In case of
problem during loading, it would be necessary to carry out two successive switch-off. At first reboot CRYPT2Pay
will boot on the partition which should have been loaded. Since its state is wrong, the boot fails. It is thus necessary
to switch the CRYPT2Pay HSM off and on to start again properly on the first partition.
• Reboot CRYPT2Pay
9 The front light turns to orange, since CRYPT2Pay is not personalized, and the safePAD displays the
personalisation prompt.
¾ Boot area at power on: Transport software (X)
¾ Not personalized
¾ Default IP Address
2.2.2. Step B2 : Personalization of CRYPT2Pay
CRYPT2Pay
production
KMC software software
SafePAD
KMC PC (not
supplied by Bull)
KM2bntx
KDKMs
Figure 8 Personalization of production CRYPT2Pay
personalization)
• Validate the "Generate key" choice to proceed with master key generation and identification (Key owner,
CRYPT2Pay logical number) (See CRYPT2Pay Reference Manual § SECURITY PROCEDURES – Customer
personalization - Stage 2 description : KM2bnt(x) key generation
• The Master Key is split in two components, each one being stored in a smart card. Don't forget to label the smart
card used to store the key and write the key index. (One smart card can be used to store up to 15 key components).
You can add the key to the smart cards used for personalization of other CRYPT2Pays, with a new index.
9 The Master Key is split in two components stored in a labelled smart card.
• Validate the "Input key" choice to proceed with introduction of the master key in the secured memory of
• DO NOT VALIDATE the personalization at this step
9 CRYPT2Pay is now up and running, but personalization has not been validated.
• Open an administration session using default login and password
• Change the default boot area so that production application be the default (See CRYPT2Pay Reference Manual §
CRYPT2Pay ADMINISTRATION – Application management – “Set up Boot” sub-menu)
• Configure the final CRYPT2Pay IP address (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – System management “System” menu –“TCP/IP” sub-menu). This change will take place
into account at next reboot. Do not reboot now.
• Check and activate options (See CRYPT2Pay Reference Manual § CRYPT2Pay ADMINISTRATION –
Application management - “Options” sub-menu).
¾ Personalization not validated
¾ Final IP Address (at next boot).
2.2.3. Step B3 : Update the KMC database

production
software
KDK File
KMC PC (not
supplied by Bull)
db
SafePAD KDKM
KM2bntx
Figure 9 Update of the KMC database
• Connect the KMC with its CRYPT2Pay, and connect the safePAD to CRYPT2Pay
• Reboot CRYPT2Pay with KMC option

• Input the KDKM for KM2bntx from smart cards (See KMC User's guide § Entry from external media (paper or
card)).
• Create the KM2bntx key in the KMC database, under the KDKM (See KMC User's guide § Creating the key label).
The key owner shall be identical to CRYPT2Pay owner set during personalization.
The key number shall be identical to key version set during personalization.
The complementary identifer (IdC) shall be the following:
30 00 00 nn nn 00 00 00 00 00 00 00 00
where nn nn is CRYPT2Pay logical number set during personalization
• Input the KM2bntx value from smart cards (See KMC User's guide § Entry from external media (paper or card)).
9 The KM2bntx is now stored in the KMC database, encrypted under KDKM
• Input the KDKM for KDK from smart cards (See KMC User's guide § Entry from external media (paper or card)).
• Create a new CRYPT2Pay in the HSM group (See KMC User's guide § Equipment creation). You can use
CRYPT2Pay logical number as the HSM label.
• Select the KM2bntx key in the key tree and assign it to CRYPT2Pay (See KMC User's guide § Key assignment to
9 The new CRYPT2Pay is now configured in the KMC database, with its master key and key distribution key.
• Create the key distribution files for CRYPT2Pay (See KMC User guide § Generation).
9 KDK file is created and contains the KDK token encrypted under the KM2bntx.
9 The KMC database is stored on the PC.
2.2.4. Step B4 : Key loading test (Optional, but highly recommended)

production
software
KM2bntx
KMC PC (not
KDK File
supplied by Bull)
db
KDKMs
Figure 10 Key loading tests
• connect CRYPT2Pay to the host server

• Switch CRYPT2Pay OFF and ON to reboot (the new IP address of CRYPT2Pay is now active).
9 If CRYPT2Pay has been moved, security mechanisms may have triggered (flashing red light). In that case
you will have to reboot. The front light turns to orange, since CRYPT2Pay personalization has been
canceled, and the safePAD displays the personalisation prompt.
• Start the personalization (See CRYPT2Pay Reference Manual § SECURITY PROCEDURES – Customer
personalization)
• Validate the "Input key" choice to proceed with introduction of the master key in the protected memory of
Stage 3 description : Key introduction by card function
PROCEDURES – Customer personalization - Personalization confirmation function
• DO NOT VALIDATE the personalization
9 The front light are green and CRYPT2Pay application is launched
• Check the KDK loading (Please refer to the server application documentation for the detailed procedure)
9 The result of steps B1 to B3 is checked (i.e. CRYPT2Pay personalization and KMC database update were
successfully performed). You can apply the personalization
2.2.5. Step B5 : Personalization validation

production
software
Production CRYPT2pays
KM2bntx
KMC PC (not
supplied by Bull)
db KDK File
CRYPT2pay with KMC option
KDKMs
Figure 11 Personalization validation
• Move CRYPT2Pay to activate security mechanisms
9 Front light is flashing red.
• Switch CRYPT2Pay OFF and ON to reboot (twice).
9 The front light turns to orange, since CRYPT2Pay personalization has been cancelled, and the safePAD
displays the personalisation prompt.
• Start the personalization (See CRYPT2Pay Reference Manual § SECURITY PROCEDURES – Customer
personalization)
• Validate the "Input key" choice to proceed with the introduction of the master key in the protected memory of
PROCEDURES – Customer personalization - Personalization confirmation function
• VALIDATE the personalization now
• Switch CRYPT2Pay OFF and ON to reboot.
9 The front light turns to green: CRYPT2Pay is now personalized.
• Using a browser on the KMC PC, connect to the administration server and load CRYPT2Pay software in the
inactive area, to replace the transport application (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – Application management – “Download” sub-menu
¾ Inactive Area: Production software (I)
¾ Personalization validated
¾ Final IP Address.
2.3. Initialise service keys
2.3.1. Step C1 : Update the KMC database with service keys
CRYPT2pay KMC software

production
software
KSK File
KMC PC (not
supplied by Bull)
db
KDK File
CRYPT2Pay with KMC

SafePAD option
KDKMs
Service
keys
KM2bntx
Figure 12 Update of the KMC database with service keys
• Connect the KMC with its CRYPT2Pay, and CRYPT2Pay with its safePAD
• Check CRYPT2Pay connection
• Input the KDKM for KDK from smart cards (See KMC User's guide § Entry from external media (paper or card)).
For each service key (e.g. KPVV, KCVX, IMKac...)

• Create the key under KDK (See KMC User's guide § Creating the key label)
• Introduce or generate the key value (See KMC User's guide § Entry from external media (paper or card) or § Key
Generation)
• Select the key and assign it to CRYPT2Pay group (See KMC User's guide § Key assignment to equipment or
group)
• Create the key distribution files for CRYPT2Pay group (See KMC User's guide § Generation).
9 KSK file is created and contains the KSK tokens encrypted under the KDK.
9 The KMC database is stored on the PC.
2.3.2. Step C2 : CRYPT2Pay up and running
CRYPT2Pay
production KDKMs Production KDKMs
db software CRYPT2Pays
KM2bntx
KM2bntx
KMC software
SafePAD StrongBox 2
StrongBox 1
KSK File
KMC PC (not KDK File

supplied by Bull)

(spare for production)
Figure 13 CRYPT2Pays up and running
• Connect CRYPT2Pay to the host server and check the KDK and KSK loading (Please refer to the server
application documentation for the detailed procedure)
• Check CRYPT2Pay installtion environment (See CRYPT2Pay Reference Manual § INSTALLATION –
Installation environment)
9 CRYPT2Pay is up and running with its key tokens on the server
• Store in a safe place:

• The received software,
• The SafePAD,
• The KMC database,
• Smart cards used to store keys (All parts needed to recover one key should be stored in distinct safe boxes)
9 Keys, software and sensitive hardware are stored in a safe place.
3. GENERAL CONFIGURATION PROCEDURES
3.1. User administration
3.1.1. Initialization of user management

Initialization of user management shall be performed after CRYPT2Pay's delivery from Bull.
• Open an administration session using default login and password (See CRYPT2Pay Reference Manual §
UTILIZATION AND ADMINISTRATION PRINCIPLES – User profiles and accounts and § CRYPT2Pay
ADMINISTRATION – Opening an administration session)
• Change the password of default admin user (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – "Users" management – “Password” sub-menu)
9 "Admin" user is configured with a new password.
• Create the identifiers of all the users who will manage CRYPT2Pay (See CRYPT2Pay Reference Manual §
CRYPT2Pay ADMINISTRATION – "Users" management – “Add” sub-menu)
9 Users are configured and can now connect to change their password.
Warning: Only an administrator can reinitialize an account who have lost his password (blocked). You shall define a
procedure to guarantee that there is always at least one administrator account no blocked. Otherwise, CRYPT2Pay
administration server may be definitely blocked:
• Store "admin" password in a safe place
• and/or, create backup administrator's accounts
3.1.2. Reset user management

Reset of user management may be performed before returning CRYPT2Pay to Bull maintenance service. This will
enable Bull to perform tests using application administration.
• Open an administration session (See CRYPT2Pay Reference Manual § UTILIZATION AND ADMINISTRATION
PRINCIPLES – User profiles and accounts and § CRYPT2Pay ADMINISTRATION – Opening an administration
session)
• Clear all users and reset "admin" password to its default value (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – "Users" management – “Delete” sub-menu)
9 "Admin" user is reconfigured with default password.
3.2. Application administration
3.2.1. Loading options

When CRYPT2Pay is delivered by Bull, options are authorized in CRYPT2Pay EEPROM according to purchase order.
In some cases however, you may have to load new option files in CRYPT2Pay:
♦ to use CRYPT2pay in test mode (test option is usually not authorized on production environement)
♦ to add new options later on.
Procedure is the following:

• Using a browser on the KMC PC, connect to the administration server of CRYPT2Pay and open an administration
session
• Load CRYPT2Pay option file (See CRYPT2Pay Reference Manual § CRYPT2Pay ADMINISTRATION –
Application management – “Download” sub-menu)
• Check and activate required options, among authorised options (See CRYPT2Pay Reference Manual §
CRYPT2Pay ADMINISTRATION – Application management - “Options” sub-menu).
9 CRYPT2Pay is ready to be used by the server
3.2.2. Checking and activating options

Checking and activation of options may be performed during CRYPT2Pay installation (How to get started?), or later on
to adjust active option list to the needs of the server connected to CRYPT2Pay (KMC vs. Host server, Test vs.
production…).
session
• Check and activate required options, among authorised options (See CRYPT2Pay Reference Manual §
CRYPT2Pay ADMINISTRATION – Application management - “Options” sub-menu).
9 CRYPT2Pay is ready to be used by the server
3.2.3. Change or update firmware

CRYPT2pay firmware may be updated:
session
• Load CRYPT2Pay new firmware application file (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – Application management – “Download” sub-menu)
¾ Active Area: New software (I)
¾ Inactive Area: Old software (I)
¾ Boot area at power on: Old software (I)
• Change the default boot area so that new be the (See CRYPT2Pay Reference Manual § CRYPT2Pay
ADMINISTRATION – Application management – “Set up Boot” sub-menu)
¾ Active Area: New software (I)
¾ Inactive Area: Old software (I)
¾ Boot area at power on: New software (I)
Signet de Fin de document (ne pas effacer cette ligne).

Crypt2Pay User'S Guide: Version No.: 1.0 Reference: Bntng/V7/En/Lp54007

Uploaded by

Copyright:

Available Formats

Crypt2Pay User'S Guide: Version No.: 1.0 Reference: Bntng/V7/En/Lp54007

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Crypt2Pay User'S Guide: Version No.: 1.0 Reference: Bntng/V7/En/Lp54007

Uploaded by

Copyright:

Available Formats

CRYPT2Pay User's Guide

Version No.: 1.0

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 M1

Document revision notice

VERSION NUMBER DATE OF REASONS

1.0 05/08/05 Creation of document

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 TMI

1.1. GENERAL DESCRIPTION ..................................................................................................................................................1

1.2. CONTENT OF THIS DOCUMENT ........................................................................................................................................1

1.3. BULL SERVICE ASSISTANCE ...........................................................................................................................................2

2. HOW TO GET STARTED ? _____________________________________________________________________ 3

2.1. INSTALL AND INITIALISE KMC AND ITS HSM ...............................................................................................................3

3.1. USER ADMINISTRATION ................................................................................................................................................19

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 TMII

Figure 1 Reception and connection of CRYPT2Pay authorized for KMC .....................................................................................3

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 1

1.1. General description

CRYPT2Pay is the response to two requirements:

1.2. Content of this document

Chapter 3 "General configuration procedures" contains a list of main configuration procedures.

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 2

1.3. Bull Service Assistance

HOT LINE : Telephone +(33) 1.30.80.62.00

Fax: + (33) 1.30.80.78.87

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 3

2. HOW TO GET STARTED ?

2.1. Install and Initialise KMC and its HSM

2.1.1. Step A1 : Reception and connection of CRYPT2Pay authorized for

CRYPT2Pay KMC software

Figure 1 Reception and connection of CRYPT2Pay authorized for KMC

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 4

9 The transport application is lauched.

2.1.2. Step A2 : Personalization of CRYPT2Pay authorized for KMC

CRYPT2Pay KMC software

CRYPT2Pay with KMC option

Figure 2 Personalization of CRYPT2Pay authorized for KMC

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 5

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 6

2.1.3. Step A3 : Installation of the KMC software

KMC PC (not KMC software

CRYPT2Pay with KMC option

Figure 3 Installation of the KMC software

• Install the KMC software on a PC (See KMC Installation guide)

9 The KMC is now installed.

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 7

2.1.4. Step A4 : Initialization of the KMC database

CRYPT2Pay KMC software

CRYPT2Pay with KMC option

Figure 4 Initialization of the KMC database

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 8

• Create a group of HSMS (See KMC User'sguide § Group creation).

2.1.5. Step A5 : Key loading test (Optional, but highly recommended)

CRYPT2Pay KMC software

CRYPT2Pay with KMC option

Figure 5 Key loading test

CRYPT2Pay User's Guide BNTNG/V7/EN/LP54007 1.0 9

9 The front light are green and CRYPT2Pay application is launched

2.1.6. Step A6 : Personalization validation

CRYPT2Pay KMC software