To provide details for the master keys:

1. Select one of the following options:

   • New Installation – Application Tier – select this option if you are installing the primary (or only) application server.

   • Existing Installation – Additional Application Tier – select this option if you have already installed MyID on your primary application server, and are now installing MyID on an additional application server.

     See section 2.14.1, Configuring the master keys for an additional application server.

   • Existing Installation – Upgrade Application Tier – select this option if you have already installed MyID and are upgrading your system.

     Because your server is already configured, you do not need to set up your master keys, and can proceed to the next stage.

2. Click Next.

   

3. Select the protection device from the drop-down list.

   You can choose from the following:

   • Registry Key Protection – the key is stored in the registry of the MyID application server.

   • Thales LUNA HSM – the key is generated and stored in the Thales Luna HSM.

   • Entrust nShield HSM – the key is generated and stored in the Entrust nShield HSM.

   To use the Registry Key Protection option:

   1. Select Registry Key Protection from the drop-down list.
   2. Click Next.

   3. Select one of the following options:

      • Store the backup file in this location – click Browse and provide a location and filename for the backup registry file.

        You are recommended to save this backup file to a secure location.

      • Do not backup the registry keys – skip the backup step.

      

   To use the Thales LUNA HSM option:

   1. Select Thales LUNA HSM from the drop-down list.

   2. Click Next.

      

   3. Provide the following information:

      • Partition – type the name of the partition that you want to use.

      • Master Key Name – type the name of the key you want to use.

        If you have previously generated a master key in Keysafe (for instance if you are operating in FIPS140-1 level 3 mode), type the name of the existing key.

        If you have not previously generated a master key in Keysafe, type the new name for the key you want to generate.

      • Generate New Master Key – select this option if you have not previously generated a master key.

        Note: There must not already be a key of this name installed on the HSM.

      • Password – type the password for the partition; this is the HSM Partition Administrator password, not the crypto user.

      • Confirm Password – confirm the password for the partition.

      • Save Password – select this option to save the password.

        If you do not select the Save Password checkbox, you must enter the password in the Card Manager Startup dialog box after any machine reboot before the MyID keyserver can start.

        If you choose to save the password, the MyID keyserver starts automatically.

        Note: This password protection is in addition to the HSM client certificate access control, so even if a user obtains the password they cannot use the HSM remotely unless their client has a certificate and has been authorized.

        Important: If you choose to save the password, the password is saved in the registry on the MyID application server for the MyID COM+ user:

        HKEY_CURRENT_USER\Software\Intercede\Edefice\MasterCard

        The password is saved encrypted to the registry; see section 8.6, Setting the HSM PIN.

      For more information, see the Thales Luna HSM Integration Guide.

   To use the Entrust nShield HSM option:

   1. Select Entrust nShield HSM from the drop-down list.

   2. Click Next.

      

   3. Provide the following information:

      • Module – type the name of the module you want to use.

      • Master Key Name – type the name of the key you want to use.

        If you have previously generated a master key in Keysafe (for instance if you are operating in FIPS140-1 level 3 mode), type the name of the existing key.

        If you have not previously generated a master key in Keysafe, type the new name for the key you want to generate.

      • Generate New Master Key – select this option if you have not previously generated a master key.

        Note: There must not already be a key of this name installed on the HSM.

      For more information, see the Entrust nShield HSM Integration Guide.

4. Click Next to move to the next stage.