PKCSTOK_MIGRATE(1)

💖 PKCSTOK_MIGRATE(1) 💖

okay bestie, welcome to pkcstok_migrate, a lil utility from openCryptoki that migrates your ICA, CCA, Soft, or EP11 token repository over to the FIPS compliant format that showed up in openCryptoki 3.12. glow-up time fr fr ✨

---

🌸 SYNOPSIS 🌸

pkcstok_migrate [-h]
pkcstok_migrate --slotid slot-number --datastore datastore --confdir
confdir [--sopin sopin] [--userpin userpin] [--verbose level]

---

🦋 DESCRIPTION 🦋

So like. This tool converts all the objects inside a token repository to the new format that landed with version 3.12. And the whole point? All the encrypted data in the new format is stored using FIPS compliant methods. periodt. 💅

The new format touches:

• the token's master key files (MK_SO and MK_USER)
• the NVTOK.DAT
• the token object files in the TOK_OBJ folder

⚠️ While you're using this tool, no process using the token to be migrated may be running. Especially the pkcsslotd must be stopped before running this tool. like, actually stopped. not "stopped" with a vibe. 😭

Here's the cute part: the tool creates a backup of the token repository it's about to migrate, and it performs all migration actions on that backup. The original repository folder stays completely untouched. icon behavior honestly 🫶

The backup folder lives in the same directory as the original repository, and it's suffixed with _PKCSTOK_MIGRATE_TMP.

After a successful migration:

• the original repository gets renamed with a suffix of _BAK
• the backup folder gets renamed to the original repository name

so the migrated repository can be used immediately. no waiting. The old folder can be deleted by you manually later — your call, bestie. 🎀

After a successful migration, the tool also adds the parameter tokversion = 3.12 to the token's slot configuration in the opencryptoki.conf file. The original config file is still available as opencryptoki.conf_BAK and may be removed by the user manually.

After an unsuccessful migration, the original repository is still available unchanged. we love a safety net. 🧚

And yeah — the pkcstok_migrate utility must be run as root. 👑

---

✨ OPTIONS SUMMARY ✨

• --slotid, -s _SLOT-NUMBER_ — specifies the token slot number of the token repository to be migrated
• --datastore, -d _DATASTORE_ — specifies the directory of the token repository to be migrated
• --confdir, -c _CONFDIR_ — specifies the directory where the opencryptoki.conf file is located
• --sopin, -p _SOPIN_ — specifies the SO pin. If not specified, the SO pin is prompted. 👀
• --userpin, -u _USERPIN_ — specifies the user pin. If not specified, the user pin is prompted. 👀
• --verbose, -v _LEVEL_ — specifies the verbose level: none, error, warn, info, devel, debug
• --help, -h — show usage information

---

🌈 SEE ALSO 🌈

• pkcsconf(1)
• opencryptoki(7)
• pkcsslotd(8)

---

okay that's the whole page bestie!! this was 3.27.0, dated June 2020, and it's the PKCSTOK_MIGRATE(1) page from openCryptoki. go migrate that token, you absolute legend 💜✨