Repository navigation
Document rotating the PIV admin keys - #24
Merged
Merged
Conversation
Add a section on replacing key version 1 of the PIV security domain before production: the keyless key-table read, the in-place PUT KEY, verification with the new keys, the key version 2 recovery set and its deletion. Link it from the getting-started warning, the quick start, the PIV and factory command pages and the troubleshooting KVN note. State that finalize locks the structure only and that administration with the security domain keys continues afterwards. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only.
docs/piv/piv-personalization.rst(labelpiv-admin-key-rotation): what key versions 1 and 2 of the PIV security domain are, how to read the key table without authenticating, thegpPUT KEY command that replaces key version 1 in place, how to verify with the new keys and point the CLI at them viaPIV_SCP03_ENC/PIV_SCP03_MAC/PIV_SCP03_DEK, recovery, and deleting key version 2.--new-keyver 2: that overwrites the per-card Cryptnox keyset, which is needed for remote reset and attestation.No code changes. Sphinx
-Wbuild and unit tests pass.🤖 Generated with Claude Code