Open topic with navigation

Factory-Installed HSM Configurations

Luna HSMs ship from the factory in various configurations that provide different levels of authentication, performance, and key management capabilities, as detailed below. These options are selected at the time of purchase and cannot be modified. A table listing the available or supported Luna HSM models is provided at the end of this section.

Authentication Variants

You can purchase either a password-authenticated (FIPS 140-2 Level 2) HSM or a PED-authenticated (FIPS Level 3) HSM.

Password Authentication

Password-authenticated HSMs provide single-factor authentication for all roles, using passwords. Luna HSMs enforce the use of strong passwords by requiring the passwords to conform to the following rules:

•minimum length of eight characters

•must include characters from at least three of the following character classes:

–lowercase alphabetic (abcd...xyz)

–uppercase alphabetic (ABCD...XYZ). If used as the first character in the password, does not count towards the number of character classes used.

–numeric (0123456789). If used as the last character in the password, does not count towards the number of character classes used.

–special (non-alphanumeric, -_!@#$%&*...)

Luna password-authenticated HSMs are validated to FIPS 140-2 Level 2. See "About Password Authentication" for more information.

PED Authentication

PED-authenticated HSMs provide two-factor or multi-factor authentication for all roles, using a PED, PED Keys, and PINs. A PED is a physical device, equipped with a numerical keypad, that is securely connected to the HSM, either locally or remotely (see "About the Luna PED"). To authenticate to a PED-authenticated HSM, you require a PED Key, which is an iKey USB token, physically similar to a thumb drive. Separate PED keys are required for each role, and each role supports multi-factor authentication, which can include:

•something you have (the physical PED Key, see "About PED Keys")

•something you know (a PED PIN, optionally associated with a PED Key, entered at the PED keypad; see "What is a PED PIN?")

•a further option of MofN secret splitting, per role (see "About MofN")

MofN is optional split-knowledge, shared-secret access control, where the access secret for a role is split among quantity N PED Keys, with quantity M of those PED Keys required for authentication. That is, each key in an MofN context is a portion of the full role secret, and not the complete secret, thus preventing any single PED Key holder gaining unsupervised access to that role on the HSM.

Luna PED-authenticated HSMs are validated to FIPS 140-2 Level 3. See "About PED Authentication" for more information.

Key Management Variants

Luna HSMs store all key material in hardware. Depending on your security requirements and key management practices, you may need to move or copy key material from the HSM to a backup HSM, another HSM in the same HA group, or to a file for off-board storage or use. To support these different key management scenarios, Luna HSMs are available in the following key management configurations. The variants are mutually exclusive - only one variant can apply to an HSM.

Note:  The ordering code for each key management variant is indicated in parentheses, if applicable.

Cloning (CL)

A Luna HSM with cloning (CL) provides the following key management capabilities:

•All keys/objects can be cloned to other Luna HSMs, or to a Luna Backup HSM.

•All keys/objects are replicated when configured in an HA group.

•Private keys cannot be wrapped off the HSM (that is, you cannot export private keys to an encrypted file).

Note:  You can clone keys/objects only between HSMs or HSM partitions that share the same cloning domain.

In the cloning configuration, the RSA private key is normally static and would reside throughout its lifetime within the HSM, for a root-key application.

Cloning With Key Export (CKE)

A Luna HSM with cloning with key export (CKE) provides the following key management capabilities:

•All keys/objects, except private keys, can be cloned to other Luna HSMs or to a Luna Backup HSM.

•All keys/objects, except private keys, are replicated when configured in an HA group.

•Private keys can be wrapped off the HSM (that is, you can export private keys to an encrypted file).

CKE is normally used for smart card and identity issuance, where transient RSA key-pairs are generated, wrapped off, and issued to a user. They are not used on the HSM. They are simply generated securely, then deleted from the HSM after wrapping off.

No Backup

A Luna HSM with no backup provides the following key management capabilities:

•Keys/objects cannot be cloned to other Luna HSMs or to a Luna Backup HSM.

•Private keys cannot be wrapped off the HSM (that is, you cannot export private keys to an encrypted file).

An HSM without backup capability ensures that created/contained keys can never leave the HSM. This configuration might also be used when keys are intended to have short lifespans, and would not be expensive to replace.

Performance Variants

The Luna SA and Luna PCI-E HSMs are available in low performance (1700 signings/second) or high performance (7000 signings/second) variants. The Luna G5 HSM is available in a single performance level.

Luna HSM Models

The following table provides a listing of the available or supported Luna HSM models.

Luna PCI-E 6.0 Product Documentation
007-011329-007 Rev. A May 2015 Copyright 2015 SafeNet, Inc. All rights reserved.

Open topic with navigation