Document:10-1163 Key Load Procedure

KEY LOAD PROCEDURE (HARDLINE 10-SERIES)

This procedure must be performed with a 10-series Key Directive Loader (KDL) that is Load Authority (LA) certified. KDLs that are only Command Authority (CA) Certified CANNOT be used to perform key load operations, and will not display the Load submenu in the Material menu. 10-series KDLs with Load Authority (LA) will be marked with a PURPLE stripe, and display a serial number starting with "LAS". For further advice, please contact Metatron support.

Notice: This procedure must be carried out by appropriately trained and cleared personnel and not deviated from except when approved. Metatron is not responsible for injuries or fatalities sustained by personnel operating hardware in a negligent or improper manner. While handling the module, keep all areas marked with a yellow cross clear and do not touch them; contact with these areas risks setting off module tamper alarms.

1. Confirm the module control display shows 10-1163 Online.
2. Use the physical operator key to unlock each side of the Module Front Panel (MFP) cover.
3. Locate the DTL-38999 port marked "KDL" and remove the dust cover.
4. Connect the KDL to the DTL-38999 to the KDL port using a Type-A shielded cable, and ensure both ends of the cable lock into position. WARNING: Ensure the KDL is powered OFF before making or breaking connections with the module.
5. Power on the KDL. Slide your Raven badge (smart card) or other SAM-based identity card into the IDENT slot on the KDL, and enter your PIN. Confirm the KDL enters the unlocked state.
6. Select Module > State > Modify. Select Offline. Wait for the Confirm mode actuation on MFP message to appear on the KDL display.
7. The Pending Command (PC) light on the MFP begins flashing blue.
8. On the MFP keypad, press the EXECUTE key.
   1. Note that there is a 10-second window to confirm the operation. If this window expires, the module will delete the pending command and the KDL will display an error.
9. Confirm the module control display shows 10-1163 Offline.
10. Select Material > Load > New.
11. Wait for the Ready for material load message to appear on the KDL display.
12. Locate the port marked "KEY" on the module and remove the dust cover.
13. Remove the source Red Token (RT) from its Standard Shielding Enclosure (SSE). Confirm the serial number printed on the side of the RT matches your job audit documentation.
14. Push the RT into the KEY port on the module until it clicks into place.
    1. If the module display flashes Code E-105, the module port has detected an improper electromagnetic seal between the chassis and the RT. If you have heard a click, try removing the RT from the port and re-inserting it after gently cleaning the electromagnetic gasket. If the error continues to persist, the gasket may be damaged; contact Metatron and order a replacement for FRU 112-81088005.
    2. If the module display flashes Code E-110, the module is unable to communicate with the RT hardware. Try removing the RT from the port and re-inserting it. If the error persists, either the RT or the port may be damaged; contact Metatron support.
    3. If the module display flashes Code E-121, the module is unable to communicate with the RT because one or both sides of the token-core key exchange (TCKE) failed. The token cannot be used; contact Metatron support.
15. The KDL display changes to display the RT serial, expiry, and contents. Confirm the presence of the key to be loaded, as well as its serial and classification level.
16. Select Preload. You will be prompted to re-enter your SAM PIN.
17. The module runs its checks against the key.
    1. If you receive Code E-206, the classification level of the module is insufficient to load the key material. The key load cannot continue.
    2. If you receive Code E-207, the required cryptographic algorithm for the key is not installed in the module, or the authority to use said algorithm has expired. Contact Metatron to request installation or renewal.
    3. If you receive Code E-210, the module secure memory is full and cannot accommodate the qubit length of the new key. Consider zeroizing any keys that are no longer needed (Material > Destroy > Zeroize) or use a different module.
    4. If you receive Code E-300, the RAC Residency Policy (RRP) determined the module does not fulfil the Module, Location, or Time requirements set on the key policy. View the details of the policy violation to diagnose the issue.
    5. If you receive Code E-306, the current SAM credential is not authorised to load the key. Contact Internal Security if necessary to ensure the validity of the SAM.
    6. If you receive Code E-310, the Tree Root Key (TRK) loaded in the module is a mismatch for the TRK that wraps the key. Contact Metatron support.
    7. If you receive Code E-500, contact Metatron support.
18. Re-confirm all details of the key on the Confirm Load page.
    1. If the KDL displays RT Burn Notice, the policy set on the key or RT requires the RT be burned (erased) subsequent to the key load operation. Ensure that you intend to burn the key before continuing.
19. Select Load.
20. Wait for Confirm material actuation on MFP to appear on the KDL display.
21. The Pending Command (PC) light on the MFP begins flashing blue.
22. On the MFP keypad, press the EXECUTE key.
    1. Note that there is a 10-second window to confirm the operation. If this window expires, the module will delete the pending command and the KDL will display an error.
23. Confirm the KDL displays Key Load Success.
24. Remove the RT from the KEY port.
25. Select Module > State > Modify. Select Online. Wait for the Confirm mode actuation on MFP message to appear on the KDL display.
26. The Pending Command (PC) light on the MFP begins flashing blue.
27. On the MFP keypad, press the EXECUTE key.
    1. Note that there is a 10-second window to confirm the operation. If this window expires, the module will delete the pending command and the KDL will display an error.
28. Confirm the module control displays shows 10-1163 Online.
29. Disconnect the KDL from the KDL port and replace the dust cover.
30. Close and lock the Module Front Panel (MFP) and re-lock using the operator key.