HSM Capabilities and Policies

The HSM can be configured to suit the cryptographic needs of your organization. Configurable functions are governed by the following settings:

>HSM Capabilities are features of HSM functionality, set at manufacture based on the HSM model you selected at time of purchase. You can add new capabilities to the HSM by purchasing and applying capability licenses from Thales Group (see Upgrading HSM Capabilities and Partition Licenses). Some capabilities have corresponding modifiable HSM policies.

>HSM Policies are configurable settings that allow the HSM Security Officer to modify the function of their corresponding capabilities. Some policies affect HSM-wide functionality, and others allow further customization of individual partitions by the Partition Security Officer.

The table below describes all SafeNet Luna Network HSM capabilities, their corresponding policies, and the results of changing their settings. This section contains the following procedures:

>Setting HSM Policies Manually

>Setting HSM Policies Using a Template

To zeroize the HSM and revert policies to their default values, see Resetting the SafeNet Luna Network HSM to Factory Condition.

To zeroize the HSM and keep the existing policy settings, use lunash:> hsm zeroize

Destructive Policies

Some policies affect the security of the HSM. As a security measure, changing these policies results in application partitions or the entire HSM being zeroized. These policies are listed below as destructive.

#	HSM Capability	HSM Policy
0	Enable PIN-based authentication >Allowed: The HSM authenticates all users with keyboard-entered passwords. >Disallowed: See HSM capability 1 below.	N/A
1	Enable PED-based authentication >Allowed: The HSM authenticates users with secrets stored on physical PED keys, read by a SafeNet Luna PED. The Crypto Officer and Crypto User roles may also be configured with a secondary, keyboard-entered challenge secret. >Disallowed: See HSM capability 0 above.	N/A
2	Performance level Numerical value indicates the HSM's performance level, determined by the model you selected at time of purchase: >4: Standard performance >8: Enterprise performance >15: Maximum performance	N/A
4	Enable domestic mechanisms & key sizes Always allowed. All SafeNet Luna Network HSMs are capable of full-strength cryptography with no US export restrictions.	N/A
6	Enable masking Always disallowed. SIM has been deprecated on all current SafeNet Luna Network HSMs.	N/A
7	Enable cloning Always allowed. All current SafeNet Luna Network HSMs can clone cryptographic objects from one partition to another.	Allow cloning (Destructive) >ON (default): The HSM may clone cryptographic objects from one partition to another. This is required to back up partitions or include them in HA groups. Partition SOs can enable/disable cloning on individual partitions. >OFF: No partition on the HSM may clone cryptographic objects. Partition SOs cannot change this.
9	Enable full (non-backup) functionality >Allowed: The HSM is capable of full cryptographic functions. >Disallowed: The HSM is capable of backup functions only (disallowed on SafeNet Luna Backup HSMs only).	N/A
12	Enable non-FIPS algorithms Always allowed. The HSM can use all cryptographic algorithms described in Supported Mechanisms.	Allow non-FIPS algorithms (Destructive) >ON (default): The HSM may use all available cryptographic algorithms. >OFF: Only algorithms sanctioned by the FIPS 140-2 standard are permitted. The following is displayed in the output from lunash:> hsm show: FIPS 140-2 Operation: ===================== The HSM is in FIPS 140-2 approved operation mode.
15	Enable SO reset of partition PIN Always allowed. This capability enables: >the Partition SO to reset the password or PED secret of the Crypto Officer. >the Crypto Officer to reset the password or PED secret of the Crypto User.	SO can reset partition PIN (Destructive) >ON: Partition SO may reset the password or PED secret of a Crypto Officer who has been locked out after too many failed login attempts. >OFF (default): The CO lockout is permanent and the partition contents are no longer accessible. The partition must be re-initialized, and key material restored from a backup device. See Resetting the Crypto Officer or Crypto User Credential.
16	Enable network replication Always allowed. This capability enables cloning of cryptographic objects over a network. This is required for HA groups, and for partition backup to a remote or client-connected SafeNet Luna Backup HSM.	Allow network replication >ON (default): Cloning of cryptographic objects is permitted over a network. Remote and client-connected backup is allowed, and the partition may be used in an HA group. >OFF: Cloning over a network is not permitted. Partition backup is possible to a locally-connected SafeNet Luna Backup HSM only.
17	Enable Korean Algorithms >Allowed: if you have purchased and applied a license for the Korea-specific algorithm set. See Upgrading HSM Capabilities and Partition Licenses to purchase this capability. >Disallowed if you have not applied this license.	N/A
18	FIPS evaluated Always disallowed - deprecated capability. All SafeNet Luna Network HSMs are capable of operating in FIPS Mode.	N/A
19	Manufacturing Token Always disallowed. For Thales Group internal use only.	N/A
21	Enable forcing user PIN change Always allowed. This capability forces the Crypto Officer or Crypto User to change the initial role credential created by the Partition SO.	Force user PIN change after set/reset >ON (default): After the Partition SO initializes or resets the Crypto Officer credential, the CO must change the credential before any other actions are permitted. This also applies when the CO initializes/resets the Crypto User role. This policy is intended to enforce the separation of roles on the partition. >OFF: The CO/CU may continue to use the credential assigned by the Partition SO. See Changing a Partition Role Credential.
22	Enable portable masking key Always allowed, but SIM is not supported on this version of SafeNet Luna Network HSM.	Allow offboard storage (Destructive) Deprecated policy. On previous HSMs, this policy allowed or disallowed the use of the portable SIM key. Default: ON
23	Enable partition groups Always disallowed - deprecated capability.	N/A
25	Enable Remote PED usage Always allowed on PED-authenticated HSMs. Always disallowed on password-authenticated HSMs.	Allow Remote PED usage >ON (default): The HSM may authenticate roles using a remotely-located PED server or a locally-installed PED. >OFF: The HSM must use a locally-installed PED to authenticate roles.
27	HSM non-volatile storage space Displays the maximum non-volatile storage space (in bytes) on the HSM, determined by the SafeNet Luna Network HSM model you selected at time of purchase.	N/A
30	Enable Unmasking Always allowed. This capability enables migration from legacy SafeNet HSMs that used SIM.	Allow unmasking >ON (default): Cryptographic objects may be migrated from legacy SafeNet HSMs that used SIM. >OFF: Migration from legacy HSMs using SIM is not possible.
33	Maximum number of partitions Displays the maximum number of application partitions that can be created on the HSM. The default maximum is determined by the SafeNet Luna Network HSM model you selected at time of purchase. On some models, you can upgrade the number of allowable partitions by purchasing additional partition licenses (see Upgrading HSM Capabilities and Partition Licenses).	Current maximum number of partitions You can change HSM policy 33 to lower the effective maximum number of partitions below the actual licensed maximum. You cannot, however, lower the maximum below the number of partitions currently existing on the HSM.
35	Enable Single Domain Always disallowed. Not applicable to SafeNet Luna Network HSM.	N/A
36	Enable Unified PED Key Always disallowed. Not applicable to SafeNet Luna Network HSM.	N/A
37	Enable MofN Always allowed on PED-authenticated HSMs. Always disallowed on password-authenticated HSMs.	Allow MofN >ON (default): During PED key creation, you have the option to require a quorum to authenticate the role, by splitting the PED secret among multiple PED keys (see M of N Split Secrets (Quorum)) >OFF: Users do not have the option to split PED secrets (M and N are automatically set to 1).
38	Enable small form factor backup/restore Always disallowed. Not available in this release.	N/A
39	Enable Secure Trusted Channel Always allowed. This capability enables Secure Trusted Channel (STC) to be used for partition-client connections, and/or to encrypt traffic between the HSM and appliance (see Secure Trusted Channel).	Allow Secure Trusted Channel >ON: Secure Trusted Channel is enabled for partition-client connections (see Creating an STC Connection). STC can be used to encrypt traffic between the appliance and the HSM (see Using the STC Admin Channel). >OFF (default): All clients must access partitions using NTLS connections.
40	Enable decommission on tamper Always allowed. This enables the HSM to be automatically decommissioned if a tamper event occurs (see Comparing Zeroize, Decommission, Re-image, and Factory Reset).	Decommission on tamper (Destructive) >ON: The HSM is decommissioned if a tamper event occurs (see Tamper Events). >OFF (default): The contents of the HSM are not affected by a tamper event.
42	Enable partition re-initialize Always disallowed. Not applicable to SafeNet Luna Network HSM. This capability and any associated feature and command(s) are applicable only to the Luna IS product, which shares some common code. No such feature has been tested on SafeNet Luna Network HSM.	N/A
43	Enable low level math acceleration Always allowed. This capability enables acceleration of cryptographic functionality for maximum HSM performance.	Allow low-level math acceleration >ON (default): Provides maximum HSM performance. >OFF: Do not turn this policy off unless instructed by Thales Group Technical Support.
45	Enable Fast-Path Always disallowed. Not available in this release.	N/A
46	Allow Disabling Decommission Always allowed. This capability enables the HSM SO to disable the decommission button on the HSM.	Disable Decommission (Destructive) >ON: The decommission button is disabled, preventing decommissioning of the HSM. >OFF (default): Decommission works as described in Decommissioning the HSM Appliance. CAUTION! Changing this policy will destroy partitions on the HSM, and they must be recreated. If HSM policy 40 is enabled, you cannot enable this policy (fails with error: CKR_CONFIG_FAILS_DEPENDENCIES). However, attempting to enable it will still destroy HSM partitions.
47	Enable Tunnel Slot Always disallowed. Not available in this release.	N/A
48	Enable Controlled Tamper Recovery Always allowed. This capability enables the HSM SO to require tamper events to be explicitly cleared before normal operations can resume.	Do Controlled Tamper Recovery >ON (default): After a tamper event, the HSM SO must explicitly clear the tamper before the HSM can resume normal operations. >OFF: The HSM must be restarted before it can resume normal operations. See Tamper Events for more information.
49	Enable Partition Utilization Metrics Always allowed. This capability enables the HSM SO to view (or export to a named file) counters that record how many times specific cryptographic operations have been performed in application partitions since the last counter-reset event. This provides a picture of operational utilization that can be used to guide the (re-)allocation and balancing of partitions and applications, for better service to all users of your partitions.	Allow Partition Utilization Metrics >ON: The HSM SO can view Partition Utilization Metrics. >OFF (default): Partition Utilization Metrics are not available. See Partition Utilization Metrics for more information.
50	Enable Functionality Modules This capability enables Functionality Modules (FMs) to be loaded to the HSM (see Functionality Modules). >Allowed on FM-ready HSMs running firmware 7.4 or higher, with the FM capability license installed (see Preparing the SafeNet Luna Network HSM to Use FMs). >Disallowed on FM-ready HSMs running firmware 7.4 or higher without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than 7.4.	Allow Functionality Modules (Destructive) >ON: With this policy enabled, Functionality Modules may be loaded to the HSM, permitting custom cryptographic operations. Allows use of the ctfm utility and FM-related commands, and the use of Functionality Modules in general with this HSM. >OFF (default): FMs may not be loaded to the HSM. CAUTION! Enabling FMs (HSM policy 50) introduces changes to Luna HSM functionality, some of which are permanent; they cannot be removed by disabling the policy. FM-enabled status is not reversible by Factory Reset.Refer to FM Deployment Constraints for details before enabling. If you are using Crypto Command Center, ensure that your CCC version supports FM-enabled HSMs before you enable HSM policy 50. Refer to the CCC CRN for details.
51	Enable SMFS Auto Activation This capability enables the Secure Memory File System (SMFS) to be activated automatically on startup. >Allowed on FM-ready HSMs running firmware 7.4 or higher, with the FM capability license installed (see Preparing the SafeNet Luna Network HSM to Use FMs). >Disallowed on FM-ready HSMs running firmware 7.4 or higher without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than 7.4.	Allow SMFS Auto Activation (Destructive) >ON: With this policy enabled, the Secure Memory File System (SMFS) is automatically activated on startup, providing a secure, tamper-enabled location in the HSM memory where Functionality Modules can load keys and parameters. Auto-activation for SMFS, like auto-activation for PED-authenticated partitions in general, persists through a power outage of up to 2 hours duration. >OFF (default): If disabled, the HSM SO must manually activate the SMFS each time the HSM reboots or loses power.
52	Allow Restricting FM Privilege Level This capability enables the HSM SO to restrict the sensitive key attributes of partition objects from FMs. >Allowed on FM-ready HSMs running firmware 7.4 or higher, with the FM capability license installed (see Preparing the SafeNet Luna Network HSM to Use FMs). >Disallowed on FM-ready HSMs running firmware 7.4 or higher without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than 7.4.	Restrict FM Privilege Level (Destructive) >ON: FM privilege is restricted. >OFF (default): FM privilege permits FMs to see the sensitive key attributes (including key values) of cryptographic objects on application partitions. This privilege is necessary for most FMs, so that the Crypto Officer (CO) and Crypto User (CU) roles can use partition objects with the FM. However, some FMs might not require this privilege and it can be restricted to satisfy some certification requirements (such as Common Criteria).
53	Allow Encrypting of Keys from FM to HSM This capability enables key encryption between the FM and the Functionality Module Crypto Engine interface (FMCE). >Allowed on FM-ready HSMs running firmware 7.4 or higher, with the FM capability license installed (see Preparing the SafeNet Luna Network HSM to Use FMs). >Disallowed on FM-ready HSMs running firmware 7.4 or higher without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than 7.4.	Encrypt Keys Passing from FM to HSM (Destructive) >ON: With this policy enabled, keys created by an FM are encrypted before crossing from the FM to the Functionality Module Crypto Engine interface (FMCE). This internal encryption may be required to satisfy some certification requirements (such as Common Criteria). >OFF (default): Keys are not encrypted before crossing to the FMCE.