Special Specifications

Internal Key Usage and Attack Defense

• The ECM provides internal keys generated by using the management tool or management APIs. When an asymmetric key or a master key is generated, you need to configure a password.
• The cryptographic module complies with GM/T 0018-2023. The SDF APIs are called by the cryptographic device service layer instead of users. The cryptographic device service layer calls the management tool to generate internal keys. Normally, the service layer calling SDF_GetPrivateKeyAccessRight or SDF_GetKEKAccessRight does not lead to errors related to incorrect passwords.

Cryptographic Module Initialization

During device initialization, call the management tool to generate internal keys and configure the application paths that can access the keys. After the configuration is complete, applications can enter the key password to obtain the key usage permission and then use the capabilities provided by the cryptographic module. File operations can be performed only on hosts. File operation APIs cannot be used in containers.

Encryption Key Usage

The access permission of asymmetric private keys needs to be obtained through the SDF_GetPrivateKeyAccessRight API, and that of KEKs needs to be obtained through the SDF_GetKEKAccessRight API.

Asymmetric Key Password Requirements

The password of asymmetric keys must meet the following requirements:

1. The password must contain at least two types of the following characters:
   • Lowercase letters
   • Uppercase letters
   • Digits
   • Special characters: `~!@#$%^&*()-_=+\|[{}];:'",<.>/? and spaces
2. The length ranges from 8 bytes to 128 bytes.

Algorithm Self-Test

The algorithm self-test function is added to the cryptographic module based on the Chinese cryptographic certification standards. This function is used to verify the correctness of key algorithms in the cryptographic module and ensure its operational security.

Self-tests include full self-tests and conditional self-tests. A full self-test is performed when the cryptographic module is initialized and started. It performs a one-time complete test on the Chinese cryptographic algorithms required for certification. If any algorithm fails the self-test, the full self-test fails, and the cryptographic module fails to start and cannot provide services. In this case, you need to restart the cryptographic module and perform the full self-test again. After the cryptographic module is started normally, a conditional self-test is performed before each execution of a specific algorithm. If the conditional self-test for the algorithm fails, the service for the algorithm cannot be used. In this case, you need to call the algorithm to perform the conditional self-test again.

The algorithm self-test can be configured using a configuration file. The SDF_OpenDeviceWithConf API is called to read and parse the configuration file. The configuration format is as follows:

selftest:true

The configuration parameters are as follows:

Performance impact warning: Enabling the self-test function (full and conditional self-tests) will significantly increase the algorithm computation time and hinder performance.

The list of self-test algorithms is as follows: