Requirements

CORE Server Requirements

Hardware

  • CPU: 
    • X86 2.0 GHz 64-bit (Intel, AMD) 3rd or later generation.
    • IBM Z 15.
  • RAM: 4 GB.
  • Disk space: 200 MB.

Server OS

Notes:

  • Intel/AMD CPU must provide AES, SSSE3, PCLMULDQ, and RDRAND instructions. These instructions are available starting with the 3rd generation of processors. To check whether your processor meets these requirements:
    • Linux: Examine the flags property in the /proc/cpuinfo file.
    • Windows: Download the Coreinfo utility and run Coreinfo64.exe -f.
  • IBM Z 15 CPU running LinuxONE III OS is supported by CORE clients and servers. For platform-specific details see the “Running Unbound on the Z platform” guide.

Java Requirements

The CORE server software assumes that Java 8 GA or higher GA version is installed on the server.

CORE Client Requirements

CORE client is supported on X86 and POWER® processors.

Client Hardware

X86 Architecture

  • CPU:
    • X86 2.0 GHz 64-bit (Intel, AMD) 3rd or later generation. See note above.
    • POWER® P7, P8, P9
  • RAM: 2 GB.
  • Disk space: 200 MB.

Client OS

  • Windows 2008 R2 64 bit, 2102, 2016, and 2019
  • Windows 7 64 bit and Windows 10
  • RHClosedRed Hat Linux 7.2, 7.6, 7.7, 7.9, and RHClosedRed Hat Linux 8.1, 8.4
  • Ubuntu 16.04, 18.04, and 20.4
  • Debian 9 and 10
  • SuSE 12 SP2 and SuSE 15 SP1
  • Amazon Linux 2
  • Oracle Linux 7
  • macOS 10.15 (Catalina) and 11 (Big Sur)
  • AIX 7.2 32 bit

Note
IBM Z 15 CPU running LinuxONE III OS is supported by CORE clients and servers. For platform-specific details see the “Running Unbound on the Z platform” guide.

OpenSSL Integration Requirements

To integrate OpenSSL based application with the Unbound libraries, see Integration with OpenSSL and use the following OpenSSL platforms:

Java Development Requirements

To integrate Java application with the Unbound Java classes, see Developing in Java and use the following Java distributions:

  • Oracle:
    • Java 8: Oracle Java 64-bit Standard Edition (SE) 8 u312 and later.
    • Java 11: Oracle Java 64-bit Standard Edition (SE) 11.0.2 and later
  • OpenJDK:

Cipher Suite Requirements

The CORE servers use the following HIGH+AESGCM cipher suites in their internal connections and expect the same from their clients:

Connectivity Requirements

External connections to EPs provide complete management and service links. External connections to the other type of servers are intended for CLIClosedCommand Line Interface-based maintenance and troubleshooting.

Internal connections among the servers are used to distribute management and MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private. commands.

Connectivity Requirements

External Connections

Purpose Port From To Comment
Management
Connection
443 Web browser EP server UI Management (EP server only)
22 Admin station CORE Linux server SSHClosedSecure Shell (SSH) - a cryptographic network protocol for operating network services securely over an unsecured network port – CLIClosedCommand Line Interface port
3389 Admin station CORE Windows server Remote desktop protocol (RDP) port
Purpose Port From To Comment
CORE Service 443 CORE client,
RESTClosedRepresentational State Transfer (REST) - an architectural style that defines a set of constraints and properties based on HTTP. Web Services that conform to the REST architectural style, or RESTful web services, provide interoperability between computer systems on the Internet. API,
ClientlessClosedSystem that is using Unbound Java Security Provider without dependency on the UKC Client software. Java
EP server Client-server communication.
KMIPClosedKey Management Interoperability Protocol - an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server Service 5696 KMIPClosedKey Management Interoperability Protocol - an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server client EP server Secure KMIPClosedKey Management Interoperability Protocol - an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server standard port

Note
The CORE system is preconfigured to accept the service and UI requests on EP ports 443 and 8443. To use a different port, see Customize the Service Port.

Internal Connections

Internal connections serve CORE internal traffic planes:

CORE cluster establishes the following connections:

In particular:

Server Port To Comment
EP 443 The assigned Partner Internal Management connection
All other EPs
All Aux servers
6603 The assigned Partner Crypto connection for non-FIPSClosedFederal Information Processing Standards - standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private.
All Aux servers
  6604 The assigned Partner Crypto connection for the FIPS modeClosedUKC system mode that allows processing FIPS-certified and not-certified keys MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private.
All Aux servers
Server Port To Comment
Partner 443 The assigned EP Internal Management connection
All other Partners
All Aux servers
6603 The assigned EP Crypto connection for non-FIPSClosedFederal Information Processing Standards - standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private.
All Aux servers
  6604 The assigned EP Crypto connection for the FIPS modeClosedUKC system mode that allows processing FIPS-certified and not-certified keys MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private.
All Aux servers
Server Port To Comment
Auxiliary 443 All EP servers Internal Management connection
All Partner servers
6603 All EP servers Crypto connection for non-FIPSClosedFederal Information Processing Standards - standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private.
All Partner servers
6604 All EP servers Crypto connection for FIPSClosedFederal Information Processing Standards - standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors MPCClosedMultiparty computation - A methodology for parties to jointly compute a function of their inputs while keeping those inputs private.
All Partner servers

Minimal Cluster Requirements

The minimal CORE system operating in the non-FIPS modeClosedUKC system advanced execution mode that hasn't yet received the FIPS certification is comprised of two servers: EP and its Partner. Starting with the CORE release 2.0.2010, an Auxiliary server is just an optional accelerator of the symmetric cryptography in the non-FIPSClosedFederal Information Processing Standards - standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors systems. For such systems we recommend the following:

  • New deployments: Start without the auxiliary server - bootstrap the EP-Partner pair. As needed, add an Auxiliary server to improve the symmetric key performance. However, if you plan an intensive use of the symmetric operations, bootstrap the server triplet from the start.

  • Upgrades: If the system does not use symmetric operations intensively - you can remove all Aux servers from the cluster.