Capabilities and Policies

Capabilities are factory settings that determine the broad capacity and performance parameters of your Luna HSM. Some are fixed. Some are adjustable.

Policies are the means by which adjustable capabilities can be modified.

HSM

"HSM Capabilities & Policies" apply to the entire Luna HSM. Partition capabilities and policies apply to individual HSM Partitions (sub-divisions with the overall HSM).

There are two kinds of HSM capabilities. Some are determined at time of manufacturing and cannot be changed - for these capabilities there are no corresponding policies. For others, the HSM Admin or Security Officer can change the HSM Policies to be more restrictive than the given HSM Capability.

A Policy can never set a condition to be less restrictive than the corresponding Capability. By default, policies are set to the same value as the capabilities. So if a capability allows something (such as masking), the corresponding HSM policy is set to “On”, by default. If a capability is "Off" or disallowed, then you cannot switch it on by means of a policy.

Partition

Most Partition capabilities (see "Partition Capabilities & Policies") have corresponding policies that the HSM Admin or SO can set to customize the behavior of individual partitions.

HSMs come from the factory as either password authenticated or PED authenticated, and that cannot be changed. However, both types need passwords.

A partition password is always required when a partition is created (partition create -partition <partitionname>).

For a password authenticated HSM, the partition password is a string that you provide - either type it in-the-clear as you issue the command, or leave it out of the command and be prompted (where it is then obscured by asterisks as you type). That password is both the administrative authentication and the client authentication for that partition - the partition owner uses it to perform administrative tasks and the client uses it to access cryptographic functions.
For a PED authenticated HSM, the administrative authentication is a secret imprinted on both the HSM and a black PED Key, while the client authentication is a text password generated at the time you create the partition, and presented to you by the PED. Later, you provide that text password (also called the client challenge secret) to your clients. Clients can connect to their individual partitions, using the provided password/challenge secret in order to perform cryptographic operations, but only if the administrator (using the secret in the PED Key for that partition) has opened the partition for business. When you run the partition create command for a PED authenticated HSM, any password that you type at the command line is ignored.

Partition capabilities are determined by the license. Your Luna HSM is licensed with X-many partitions of a certain type, with all those partitions having the same capability settings. The HSM Admin or SO can make the partitions all behave differently by turning on and off various policy settings on each partition. By default policies are set to the same value as the capabilities, so if the capability allows something, the corresponding policy will be on when the partition is created.

Some capability descriptions (partition and HSM) are worded in a seemingly awkward or unnatural way. This is because policies can be set only to be more restrictive than the corresponding capability.