SAKA 4.21.0

Versions
Release Notes
- SAKA 4.21.0
- SAKA 4.20.0
- SAKA 4.19.0
- SAKA 4.18.0
- SAKA 4.17.0
- SAKA 4.15.1
- SAKA 4.14.0
- SAKA 4.13.0
- SAKA 4.12.0
- SAKA 4.11.0
- Upgrading from SAKA 4.x
- Back
Preface
- Default Paths and Filenames
- Third-Party Website References
- Strongkey Welcomes Your Comments!
- Back
KAM Introduction
Architecture
Installation
- Preliminary Steps
- Install Components (Primary)
- Install Components (Secondary)
- Define KCs (Primary)
- Verify KCs (Secondary)
- Set Personal Identification Numbers (PINs) [Primary]
- Set PINs and Complete Key Migration [Secondary]
- Create System Users [Primary]
- Create a New Encryption Domain [Primary]
- Complete Second Domain Key Migration [Secondary]
- Add System Users [Primary]
- Configure the SKCE domain [Primary]
- Replicate the CEM Domain [Secondary]
- Back
CCS Web Service Operations
- CCReturnObject
- Manufacturer Identifiers for Processing CardHolder Data (CHD)
- CCS Module GetCardCaptureData Mechanics
- CCS Module DukptEncrypt Mechanics
- CCS Module DukptDecrypt Mechanics
- CCS Module DukptMAC Mechanics
- CCS Module ReencryptPINBlock Mechanics
- Back
KAM Web Service Operations
- KAM Encryption Mechanics
- KAM Decryption Mechanics
- Notes on the Mechanics
- KAM Deletion Mechanics
- KAM Search Mechanics
- KAM Entropy Mechanics
- KAM General Purpose Key Encryption Mechanics
- KAM General Purpose Key Decryption Mechanics
- KAM Batch Operations
- KAM Relay Mechanics
- HTTPS Interface
- SOAP Interface
- Back
KMS Web Service Operations
- CCReturnObject
- CCKeyComponentType
- CCCryptographicMaterialType
- CCEncryptedAnsiX9241KeyType
- KMS Module loadKeyComponent Mechanics
- KMS Module loadBaseDerivationKey Mechanics
- KMS Module generateBaseDerivationKey Mechanics
- KMS Module generateInitialKey Mechanics
- KMS Module storeAnsiX9241Key Mechanics
- KMS Module replaceAnsiX9241Key Mechanics
- KMS Module deleteAnsiX9241Key Mechanics
- KMS Module updateAnsiX9241Key Mechanics
- Back
TR31 Web Service Operations
- TR31Response
- TR31 Module generateKeypair Mechanics
- TR31 Module listKeypairs Mechanics
- TR31 Module updateKeypairs Mechanics
- TR31 Module storeDigitalCertificate Mechanics
- TR31 Module listDigitalCertificates Mechanics
- TR31 Module updateDigitalCertificate Mechanics
- TR31 Module generateKek Mechanics
- TR31 Module listKeks Mechanics
- TR31 Module updateKek Mechanics
- TR31 Module getPcrToken Mechanics
- TR31 Module decryptData Mechanics
- Back
KAM Batch Operations
- SKLESBatchInput Element
- SKLESBatchOutput Element
- Generating the SBI XML file
- Transferring XML Files to and from the Appliance
- Submitting Batch Operations
- Back
KAM DemoClients
- Installing SAKA Clients
- sakaclient.jar Operations
- sakamclient.jar Operations
- kmsclient.jar Operations
- skceclient.jar Engines
  - EncryptionEngine Operations
  - Back
- Back
KAM KCSetPINTool
- Setting KC Preferences
- Changing KC Passwords
- Setting the KC PIN on the SAKA Server
- Back
KAM DACTool
- Changing DA Passwords
- Preferences
- Systems
- Domains
- Users
- Jobs
- Configuration
- Back
KAM Key Migration Tool
- Prerequisites
- Back
KAM KMS ConsoleTool
- Loading Key Components
- Loading a BDK
- Storing ANSI X-924.1 Keys from Key Components
- Storing ANSI X-924.1 Keys from Wrapped Keys
- Back
KAM Configuration
- Immutable Configuration
- Mutable Configuration
- Sample Configuration File
- Back
KAM Key Management
- Cryptographic Hardware Modules
- Back
HSM Integration
- Building the HSM Driver
  - Rebuilding the HSM Driver
  - Back
- HSM Administration Basics
- Clearing the HSM
- Setting Up the HSM
- Backing up the HSM
- Restoring from a Backup
- HSM Battery Replacement
- Back
Managing Credentials
- KAM Credentials
- HSM Credentials
- System Credentials
- Linux strongauth
- Back
Changing Hostname and IP
- Changing the IP Address
- Changing the Hostname
- Back
Internal Repositories
- Repository Requirements
- Choosing an Online Mirror
- Internal Repository Setup
- KA Setup
- Back
Internal Repositories Rocky 9.x
- Repository Requirements
- Choosing an Online Mirror
- Internal Repository Setup
- KA Setup
- Back
Appliance Security
- Physical Security
- Operating System
- Appliance Credentials
- Back
PCI DSS 3.2
- Requirement 3: Protect Stored Cardholder Data
- Requirement 6: Develop and Maintain Secure Systems and Applications
- Back
PCI DSS 4.0.1
KC Responsibilities
Add New SKCE Domain
KAM Replication
- Check Replication
- Replicate Essentials Only
- Disable Replication to Inactive Nodes
- Known Behavior
- Manual Replication For Specific Range of Data
- Back
Appendices
- Adding a Disaster Recovery Backup (DRB) Node to a Cluster
  - Step #1 on an EXISTING server
  - Step #2 on the DRB Node
  - Step #3 on the EXISTING server
  - Step #4 on the DRB node
  - Post-Installation
  - Back
- Adding an Additional Server to a Cluster
  - Step #1 on an EXISTING server
  - Step #2 on the NEW server
  - Step #3 On the EXISTING node
  - Step #4 on the NEW node
  - Back
- Application Development Guide
  - Application Design for “Card Not Present” transactions
  - Storing Encryption Domain Identifier (DID)
  - Securing Decryption Credentials
  - Cluster Communications
  - Relay Processing
  - Summary on “Card Not Present” transactions
  - Back
- Batch Delete Tokens
- CIS Hardening Verification RHEL 7.X
- CIS Hardening Verification ROCKY 9.X
- Cleanup SAKA Disk Space
  - Cleanup Old Distributions and Files
  - Cleanup Database Tables
    - Cleanup Encryption Requests Table
    - Back
  - Back
- Configure Syslog
- Create Software Keystore HSM Credential
- Installing KCSPTool and DACTool on Windows
  - Installation
  - Back
- KA Replace EOL Node
  - Prerequisites
  - Step 1 (On New SAKA)
  - Step 2 (On EOL SAKA)
  - Step 3 (On New SAKA)
  - Step 4 (On EOL SAKA)
  - Step 5 (On New SAKA)
  - Step 6 (On EOL SAKA)
  - Step 7 (On New SAKA)
  - Back
- KAM KC Replace Tool
  - Prerequisites
  - Validating Credentials
  - Recreate a set of Key Custodians
  - Create a new set of Key Custodians
  - Back
- MariaDB Audit Logging Configuration
  - Enable MariaDB Audit Logging
  - Monitoring the MariaDB for Replication anomalies
  - Disable MariaDB Audit Logging
  - The counts_v2.sql file
  - Back
- Migration Information
- Migrating from Centos to Rocky
  - Rocky Linux Kickstart USB Guide
  - Step 1: On an Existing Production Server in the Cluster
  - Step 2: On the Same Machine after Installing Rocky 9.3
  - Back
- Modifying the Appliance's IP Address or Hostname
- Reboot StrongKey Tellaro
  - Pre-Reboot
  - Reboot
  - Post-Reboot
  - Back
- Relay Webservice
  - Mechanics of the Relay
  - Deploying the service
  - Relay Webservice Client
  - HTTP interface
  - SOAP interface
  - Back
- Replace CMOS Battery
- Setting up LACP Bonding on Tellaro KA
- Strongkey Tellaro & Ransomware Protection
- Using Custom SSL/TLS Certificates
  - Generating a TLS certificate with the SAN extension
  - Installing the keystore on SAKA
  - Conclusion
  - Back
- Using a Custom Trust Store
- Using HAProxy as a Load Balancer
- Using the Key Migration Tool (KMTool)
  - Prerequisites
  - Mechanics
  - Details
  - Back
- Test Appliance Funcationality
  - Using pingsaka script
  - Common Errors
  - Back
- Collect KeyAppliance Health Data (SAHC.sh)
  - Run SAHC.sh script
  - SAHC Files
  - Back
- Fix Data Inconsistency in DB
  - Export Data
  - Take Database Backup
  - Import Data on Other Nodes
  - Back
- Create Linux User For BatchRequest
- Back

Changes in SAKA 4.21.0

#	Explanation
RFE-322	Add Merchant Allowed Actions (MAA) argument to getPcrToken StrongKey Tap To Pay (SKTTP) webservice The 'getPcrToken' webservice in the SKTTP module now accepts an 'maa' argument. When provided, the value is added to the resulting JSON Web Token (JWT). If this field is not null, every value in the 'maa' array must be one of the following: 'PREPARE' 'LINK' 'RELINK'
RFE-323	Update KC-SetPINTool.sh to allow users to re-sign database tables The 'KC-SetPINTool.sh' wizard now allows users to re-sign tables in the database. The following tables are available for resigning through this tool: (SB2) APPLICATIONS (SB2) GROUPS (SB2) SB2_USERS (SKCC) CUSTOMERS (SKCD) CONTENT_DISTRIBUTION_PROFILES (SKCD) CONTENT_DISTRIBUTIONS (SKCD) GROUP_CONTENT_DISTRIBUTION_PROFILE (SKCD) GROUP_CONTENT_DISTRIBUTIONS (SKFS) ATTESTATION_CERTIFICATES (SKFS) CREDENTIAL_PROPERTIES (SKFS) DIGITAL_ASSET_LINK_X509_FINGERPRINTS (SKFS) DIGITAL_ASSET_LINKS (SKFS) FIDO_KEYS (SKFS) FIDO_POLICIES (SKFS) RELATED_ORIGINS NOTE: This feature will primarily be used post-upgrade when an update has been made to one of the above tables.
RFE-324	Remove insecure ciphers from the Payara HTTP and secure admin listeners The following insecure ciphers have been removed from the HTTP and secure admin listeners: 'TLS_DHE_RSA_WITH_AES_256_CBC_SHA' 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA' These ciphers are also removed from existing installations via upgrade. This change comes as an effort to remove TLS 1.0 & 1.1 cipher suites (according to RFC8996) from the SAKA environment.
BUG-135	Include various fixes from 4.20.0 upgrade The following changes and bug fixes have been made to the 4.20.0 section of the 4.21.0 upgrade script: Some asadmin commands did not execute because they required the temporary passwordfile used during the upgrade. The SELinux security context on mysql.server is now reset by using 'restorecon.' The old Xmx/Xms values from the previous Payara 6 installation are now preserved in the newly installed Payara 7 configuration.

Click here for StrongKey FIDO Server (SKFS) release notes.