Trading Partner PGP or SSH key rotation

View some of the Frequently Asked Questions to our support staff. Included are some tips and tricks making this forum ideal for users getting started with GoAnywhere MFT. Note: Users can reply to existing topics but only our support staff can add new topics to this forum.
1 post Page 1 of 1

Support_Julie

User avatar
Support Specialist
Posts: 91
Joined: Thu Mar 05, 2009 3:49 pm
Location: Ashland, NE USA

Post by Support_Julie » Fri Aug 10, 2018 1:01 pm
Many trading partners require key rotation of the keys/certificates used to encrypt or transport files to their server.

For Example, one of the larger banks sends out a notification to their customers requesting that they rotate the PGP/SSH Keys and sign with their existing PGP Key.
Review your current projects to see what keys they are using as well as protocol.
If you Encrypt or Sign a file, then your Public PGP key is sent to the trading partner.
If the file is sent using the SFTP protocol, then you send your public SSH key to the trading partner.
  •  Before the current PGP Key expires, Create a New PGP Key Pair
     PGP Keys should be an RSA key and at least 2048 in size - expire in 2years (unless otherwise specified)
     SSH Keys must use the RSA algorithm.
     Export the Public Key from the NEW PGP Key pair. (or export Public SSH key)
     Using the project below, PGP Sign the NEW Public Key with the CURRENT PGP secret key
     The PGP signed PGP Key file should be named ${Partner_ID}.PAYLOAD.IN.DAT
     The PGP signed SSH key file should be named ${Partner_ID}.TRANSPORT.IN.DAT
     SFTP PUT that file to the JPMC's "/Inbound/Encrypted" folder
<project name="JPMC send new PGP key" mainModule="Main" version="2.0" logLevel="verbose">
<description>Project to sign new PGP key & send to JPMC</description>
<variable name="New_PGP_Public_Key" value="/Helpsystems/Goanywhere/Userdata/keys/pgp/MyPGP.asc" />
<variable name="New_PGP_Key" value="xx" description="Enter the Key ID for your New PGP Key. The PGP Key should be RSA and 2048 bites or more" />
<variable name="Current_PGP_Password" value="password" description="enter the password for your current PGP Key" />
<variable name="Current_PGP_Key" value="xx" description="Enter the Key ID for your Current PGP Key" />
<variable name="Partner_ID" value="COBOAT" description="this is an unique ID assigned to you by JPMC. The Partner ID may be referenced in your renewal letter from JPMC" />

<module name="Main" logLevel="debug">

<createWorkspace version="1.0" />


<pgpSign keyLocation="File" resourceId="Linoma Key ring" inputFile="${New_PGP_Public_Key}" outputFile="${Partner_ID}.PAYLOAD.IN.DAT" outputFilesVariable="FileToSend" version="1.0">
<secretKey keyID="${Current_PGP_Key}" passphrase="${Current_PGP_Password}" passphraseIsEncrypted="false" />
</pgpSign>


<sftp resourceId="TradingPartnerSFTP" version="1.0">
<put sourceFilesVariable="${FileToSend}" destinationDir="/Inbound/Encrypted" />
</sftp>


<deleteWorkspace version="1.0" />

</module>

</project>
Julie Rosenbaum
Sr Support Analyst
e. goanywhere.support@helpsystems.com
p. 1.800.949.4696
w. HelpSystems.com
1 post Page 1 of 1