PKCSEP11_MIGRATE(1)

🌸 NAME 🌸

okay so bestie, this is pkcsep11_migrate(1) from openCryptoki — the utility that re-encrypts EP11 token keys to prepare a change of master keys in the EP11 adapter. 💅✨

🎀 SYNOPSIS 🎀

pkcep11_migrate [-h] [-slot slot-number -adapter adapter-ID -domain domain-ID ]

(yes, the synopsis spells it pkcep11_migrate — keeping it exactly as written, no edits, iykyk 💅)

💖 DESCRIPTION 💖

In case of a Master key change within an EP11 adapter, all key objects that are wrapped with this master key must be re-wrapped or re-encrypted. The pkcsep11_migrate utility takes all EP11 token related key objects that are wrapped with the EP11 adapter master key, decrypts each key object with the current master key, and encrypts it with the new master key. slay, that’s the whole job 🫶

🫶 Notes 🫶

1. The new master key must be set and committed on the EP11 adapter via Trusted Key Entry console (TKE) before using this utility. 🔥
2. While using this tool, no process using the EP11 token should be running. fr fr, nobody else in the group chat while this is happening 🙈
3. Before using this tool, make a back-up of the token objects in ep11tok/TOK_OBJ/. do not skip this, bestie 😭
4. After successfully execution of the migrate utility and before (re)starting programs using the EP11 token, the new master key must be activated using the TKE. periodt 💅

📋 COMMAND SUMMARY 📋

• -slot slot-number — specifies the token slot of the EP11 token.
• -adapter adapter-ID — specifies an EP11 adapter ID. (Refer to lszcrypt to get a list of installed crypto adapters. The adapter ID will be the number xx in 'cardxx' from the output.) This value can be provided either in hexadecimal (e.g. 0x0A) or decimal (10) notation. ✨
• -domain domain-ID — specifies the usage domain for the EP11 adapter. (see /sys/bus/ap/ap_domain.) This value can be provided either in hexadecimal (e.g. 0x0B) or decimal (11) notation. 🌈
• -h — show usage information. the little helper icon, iconic 👑

🦋 SEE ALSO 🦋

• pkcsconf(1)
• opencryptoki(7)
• pkcsslotd(8)

---

that’s the vibe 💖 this page is from openCryptoki version 3.27.0, dated Jan 2014 — go migrate those keys responsibly, bestie 🎀✨