HP Secure Development Lifecycle

ManualsBrandsHP ManualsSoftwareHP-UX 11i v3 Virtual Server Operating Environment (VSE-OE) LTU

Technical white paper

Authenticity and Integrity Verification of HP-UX Software Packages

Table of contents

Introduction 2

HP Secure Development Lifecycle 2

Defining the Concepts 2

HP-UX Code Signing 2

HP Private Key 2

HP Public Key 2

HP-UX Packages 3

Signed HP-UX packages 3

Verification of HP-UX Software 3

Installing Required Software 3

Solution 3

Verifying a Signed Directory Depot 3

Verifying a signed tape depot 4

Verification of HP-UX Patches 4

Verification during Ignite or OE

update 4

Conclusion 4

Terminology 4

References/Related Information 5

Summary of content (5 pages)

PAGE 1
Technical white paper Authenticity and Integrity Verification of HP-UX Software Packages Table of contents Introduction 2 HP Secure Development Lifecycle 2 Defining the Concepts HP-UX Code Signing HP Private Key HP Public Key HP-UX Packages Signed HP-UX packages Verification of HP-UX Software Installing Required Software 2 2 2 2 3 3 3 3 Solution Verifying a Signed Directory Depot Verifying a signed tape depot Verification of HP-UX Patches Verification during Ignite or OE update 3 3 4 4 Conclusion
PAGE 2
Introduction As part of HP’s continued innovation in security we are ensuring that any HP-UX software that we deliver to you has not been tampered with and contains no malicious code. Now – with HP Secure Development Lifecycle – HP enables you to verify the authenticity and integrity of HP-UX software on your host system thus empowering you to safe guard your environment from malware.
PAGE 3
HP-UX Packages The software packages are shipped by HP on HP-UX in the form of a directory (directory depots) and files (tape depot). The OE and AR media (DVD) shipped by HP can be mounted as a directory, whereas the software that is available for download from http://software.hp.com as well as the patches from HPSC are available in the form of a file, in a format named ‘tape depot’.
PAGE 4
If the depot is located on a remote machine, the remote machine must have a version of SW-DIST and HP-UX Whitelisting with versions B.11.31.1303 or newer and B.01.01.07 or newer respectively. The complete details of signature verification can be obtained by running the swjob command displayed at the end of the swverify session. Note : • • Currently, swverify verifies signatures for all the products in the depot irrespective of the software specified.
PAGE 5
References/Related Information Software Distributor documentation at http://www.hp.com/go/sd-docs Ignite-UX documentation at http://www.hp.com/go/ignite-ux-docs HP Secure Development Lifecycle at http://software.hp.com Get connected hp.com/go/getconnected Current HP driver, support, and security alerts delivered directly to your desktop © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.