HSM Capabilities and Policies

The SafeNet Luna PCIe HSM's configuration is based on HSM capabilities. They are set at manufacture according to the model you selected at time of purchase. Capabilities can only be modified by purchase and application of capability updates.

A subset of HSM capabilities have corresponding HSM policies that allow you to customize the HSM configuration. Policies can be modified based on your specific needs. They can never be modified to be less secure than the corresponding capability.

To view the HSM capability and policy settings, issue the LunaCM command hsm showpolicies on the Admin partition. Include the -exporttemplate option to create a template based on the current HSM policy settings. See Policy Templates.

To modify HSM policies, login as HSM SO and use the LunaCM command hsm changehsmpolicy-policy <policy#> -value <0/1>. See hsm changehsmpolicy in the LunaCM Command Reference Guide for command syntax.

To zeroize the HSM and reset the policies to their default values, use hsm factoryreset. See hsm factoryreset in the LunaCM Command Reference Guide for command syntax.

To zeroize the HSM and keep the current policy settings, use hsm zeroize. See hsm zeroize in the LunaCM Command Reference Guide for command syntax.

Destructiveness

In some cases, changing an HSM policy zeroizes all application partitions or the entire HSM as a security measure. These policies are listed as destructive in the table below.

HSM Capability and Policy Descriptions

The table below summarizes the relationships and provides a brief description of the purpose and operation of each capability and policy.

#

HSM Capability HSM Policy Description
0

Enable PIN-based authentication

 

If allowed, the HSM authenticates all users with keyboard-entered passwords.

1

Enable PED-based authentication

 

If allowed, the HSM authenticates users with secrets stored on physical PED keys, read by a SafeNet Luna PED. The Crypto Officer and Crypto User roles may also be configured with a secondary, keyboard-entered challenge secret.

2

Performance level

 

Numerical value indicates the performance level of this HSM, determined by the model you selected at time of purchase:

>4: Standard performance

>8: Enterprise performance

>15: Maximum performance

4

Enable domestic mechanisms & key sizes

 

Always allowed. All SafeNet Luna HSMs are capable of full-strength cryptography with no US export restrictions.

6

Enable masking

 

Always disallowed. SIM has been deprecated on all current SafeNet Luna PCIe HSMs.

7

Enable cloning

Allow cloning

If allowed, the HSM is capable of cloning cryptographic objects from one partition to another. This policy must be enabled to backup partitions over a network or create HA groups. Partition Security Officers may then enable/disable cloning on individual partitions.

Destructive: OFF-to-ON

9

Enable full (non-backup) functionality

 

If allowed, the HSM is capable of full cryptographic functions.

This capability is only disallowed on SafeNet Luna Backup HSMs.

12

Enable non-FIPS algorithms

Allow non-FIPS algorithms

If allowed, the HSM can use all available cryptographic algorithms.

If disallowed, only algorithms sanctioned by the FIPS 140-2 standard are permitted. The following is displayed in the output from hsm showinfo in LunaCM:

The HSM is in FIPS 140-2 approved operation mode.
 

Destructive: OFF-to-ON

15

Enable SO reset of partition PIN

SO can reset partition PIN

If allowed, a Partition SO can reset the password or PED secret of a Crypto Officer who has been locked out after too many bad login attempts.

If disallowed, the lockout is permanent and the partition contents are no longer accessible. The partition must be re-initialized, and key material restored from a backup device.

See Failed Logins for more information.

Destructive: OFF-to-ON, ON-to-OFF

16

Enable network replication

Allow network replication

If allowed, cryptographic object cloning is permitted over a network. This is required for HA groups, and for partition backup to a remote or client-connected SafeNet Luna Backup HSM.

If disallowed, cloning over a network is not permitted. Partition backup is possible to a locally-connected SafeNet Luna Backup HSM only. Setting this policy to 0 means that only the HSM SO can backup partitions.

17

Enable Korean Algorithms

Allow Korean algorithms

If allowed, the SafeNet Luna PCIe HSM can use the Korean algorithm set. This capability may be purchased as an upgrade. See HSM Capability and Partition Upgrades.

18

FIPS evaluated

 

Always disallowed - deprecated policy. All SafeNet Luna PCIe HSMs are capable of operating in FIPS Mode.

19 Manufacturing Token   N/A (SafeNet internal use only)
21

Enable forcing user PIN change

Force user PIN change after set/reset

If allowed, when a Partition SO initializes the Crypto Officer role (or resets the password/PED secret), the CO must change the credential with role changepw before any other actions are permitted. The same is true when the CO initializes/resets the Crypto User role. This policy is intended to enforce the separation of roles on the partition.

If disallowed, the CO/CU may continue to use the credential assigned by the Partition SO.

22

Enable offboard storage

Allow off-board storage

On previous HSMs, this policy allowed or disallowed the use of the portable SIM key. SIM is not supported on this version of SafeNet Luna HSM.

Destructive: OFF-to-ON

23

Enable partition groups

 

Always disallowed - deprecated policy.

25

Enable Remote PED usage

Allow Remote PED usage

Always enabled on PED-authenticated SafeNet Luna PCIe HSMs. All PED-authenticated HSMs are capable of connecting to a local PED or a remotely-located PED server. The HSM SO may turn this feature on or off.

27 HSM non-volatile storage space  

Displays the non-volatile maximum storage space (in bytes) on the HSM. This is determined by the model of SafeNet Luna PCIe HSM you selected at time of purchase.

30

Enable Unmasking

Allow unmasking

If allowed, cryptographic material can be migrated from legacy SafeNet appliances that used SIM.

33 Maximum number of partitions Current maximum number of partitions

Displays the maximum number of application partitions that can be created on the HSM. This number is determined by the model of SafeNet Luna PCIe HSM you selected at time of purchase. On some models, the number of allowable partitions can be upgraded with a separate purchase. See HSM Capability and Partition Upgrades for more information.

35 Enable Single Domain   Not applicable to SafeNet Luna PCIe HSMs.
36 Enable Unified PED Key   Not applicable to SafeNet Luna PCIe HSMs.
37 Enable MofN Allow MofN

If allowed on PED-authenticated SafeNet Luna PCIe HSMs, this policy enables you to split a PED secret among multiple PED keys (see M of N Split Secrets).

If disallowed, users will no longer be asked to split a PED secret (M and N automatically set to 1).

Always disallowed on password-authenticated HSMs.

38 Enable small form factor backup/restore   Not available in this release.
40 Enable decommission on tamper

Decommission on tamper

If allowed, the HSM will be decommissioned if a tamper event occurs. Decommissioning deletes all partitions and their contents, the audit role, and the audit configuration. The HSM policy settings are retained.

See Tamper Events for more information.

Destructive: ON-to-OFF

42 Enable partition re-initialize   Not available in this release.
43 Enable low level math acceleration Allow low-level math acceleration

This is enabled by default, and must be enabled to provide maximum performance. Do not disable unless instructed to do so by Thales Group Technical Support.

45 Enable Fast-Path   Not available in this release.
46 Allow Disabling Decommission

Disable Decommission

If enabled, the decommission jumper header is disabled, preventing decommissioning of the HSM.

Note: You cannot enable this policy if HSM policy 40: Decommission on Tamper is enabled.

CAUTION: Changing this policy will destroy partitions on the HSM, and they must be recreated.

Destructive: OFF-to-ON, ON-to-OFF

47 Enable Tunnel Slot  

Not available in this release.

48 Enable Controlled Tamper Recovery Do Controlled Tamper Recovery

If allowed, the HSM SO must explicitly clear the tamper before the HSM can resume normal operations. This is the default behavior.

If disallowed, the HSM must be restarted before it can resume normal operations.

See Tamper Events for more information.