ZMK is short for Zone Master Key.
It is the key used to transport a key from one environment to another. In short, we can say that ZMK is the main transport vehicle. The key that the two parties use to encrypt and exchange new ZPKs is the ZMK.
For example, ZMK can be used to transfer keys between HSMs.
If a key is to be transferred between HSMs, each HSM must have the same ZMK.
Transferred keys are encrypted under the ZMK outside the HSM, which is why ZMK is an important key and is generally transferred between HSMs in the form of 3 components.
- First, a ZMK key is created.
- The ZMK is exported as 3 components and given to 3 different key officers.
- These components are entered into the other HSM by 3 different key officers.
- Once the key officers have transferred these 3 components into the other HSM, the keys become ready to be sent to the other HSM.
- The keys are transferred under this ZMK, and the keys (XKeyUnderZMK) can be sent to the other HSM.
- If the HSMs have the same ZMK, the keys can be transferred successfully. Otherwise, the key transfer fails.
For example, during a ZPK exchange, the clear ZPK is never transported in the open. The ZPK is transported to the relevant location under the ZMK (ZPK under ZMK).
The keys transported between interrelated networks, and the hierarchy of these keys, are as follows:
