HSM Capabilities and Policies
The SafeNet Luna Network HSM's configuration is based on HSM capabilities. They are set at manufacture according to the model you selected at time of purchase. Capabilities can only be modified by purchase and application of capability updates.
A subset of HSM capabilities have corresponding HSM policies that allow you to customize the HSM configuration. Policies can be modified based on your specific needs. They can never be modified to be less secure than the corresponding capability.
To view the HSM capability and policy settings, use the LunaSH command hsm showpolicies. Include the -exporttemplate option to create a template based on the current HSM policy settings. See Policy Templates.
To modify HSM policies, log in as HSM SO and use the LunaSH command hsm changepolicy -policy <policy#> -value <0/1>. See hsm changepolicy in the LunaSH Command Reference Guide for command syntax.
To zeroize the HSM and reset the policies to their default values, use hsm factoryreset. See hsm factoryreset in the LunaSH Command Reference Guide for command syntax.
To zeroize the HSM and keep the current policy settings, use hsm zeroize. See hsm zeroize in the LunaSH Command Reference Guide for command syntax.
To view the HSM capability and policy settings, issue the LunaCM command hsm showpolicies on the Admin partition. Only policies that the HSM SO can change (the corresponding capability is not set to 0) are included in the output.
Destructiveness
In some cases, changing an HSM policy zeroizes all application partitions or the entire HSM as a security measure. These policies are listed as destructive in the table below.
HSM Capability and Policy Descriptions
The table below summarizes the relationships and provides a brief description of the purpose and operation of each capability and policy.
# |
HSM Capability | HSM Policy | Description |
---|---|---|---|
0 |
Enable PIN-based authentication |
|
If allowed, the HSM authenticates all users with keyboard-entered passwords. |
1 |
Enable PED-based authentication |
|
If allowed, the HSM authenticates users with secrets stored on physical PED keys, read by a SafeNet Luna PED. |
2 |
Performance level |
|
Numerical value indicates the performance level of this HSM, determined by the model you selected at time of purchase: >4: Standard performance >8: Enterprise performance >15: Maximum performance |
4 |
Enable domestic mechanisms & key sizes |
|
Always allowed. All SafeNet |
6 |
Enable masking |
|
Always disallowed. SIM has been deprecated on all current SafeNet Luna Network HSMs. |
7 |
Enable cloning |
Allow cloning |
If allowed, the HSM is capable of cloning cryptographic objects from one partition to another. This policy must be enabled to backup partitions over a network Destructive: OFF-to-ON |
9 |
Enable full (non-backup) functionality |
|
If allowed, the HSM is capable of full cryptographic functions. This capability is only disallowed on SafeNet Luna Backup HSMs. |
12 |
Enable non-FIPS algorithms |
Allow non-FIPS algorithms |
If allowed, the HSM can use all available cryptographic algorithms. If disallowed, only algorithms sanctioned by the FIPS 140-2 standard are permitted. The following is displayed in the output from FIPS 140-2 Operation: ===================== The HSM is in FIPS 140-2 approved operation mode. Destructive: OFF-to-ON |
15 |
Enable SO reset of partition PIN |
SO can reset partition PIN |
If allowed, a Partition SO can reset the password or PED secret of a Crypto Officer who has been locked out after too many bad login attempts. If disallowed, the lockout is permanent and the partition contents are no longer accessible. The partition must be re-initialized, and key material restored from a backup device. See Failed Login Attempts for more information. Destructive: OFF-to-ON, ON-to-OFF |
16 |
Enable network replication |
Allow network replication |
If allowed, cryptographic object cloning is permitted over a network. This is required for HA groups, and for partition backup to a remote or client-connected SafeNet Luna Backup HSM. If disallowed, cloning over a network is not permitted. Partition backup is possible to a locally-connected SafeNet Luna Backup HSM only. Setting this policy to 0 means that only the HSM SO can backup partitions. |
17 |
Enable Korean Algorithms |
Allow Korean algorithms |
If allowed, the SafeNet Luna Network HSM can use the Korean algorithm set. This capability may be purchased as an upgrade. See Upgrading HSM Capabilities and Partition Licenses. |
18 |
FIPS evaluated |
|
Always disallowed - deprecated policy. All SafeNet Luna Network HSMs are capable of operating in FIPS Mode. |
19 |
Manufacturing Token | N/A (SafeNet internal use only) | |
21 |
Enable forcing user PIN change |
Force user PIN change after set/reset |
If allowed, when a Partition SO initializes the Crypto Officer role (or resets the password/PED secret), the CO must change the credential with role changepw before any other actions are permitted. The same is true when the CO initializes/resets the Crypto User role. This policy is intended to enforce the separation of roles on the partition. If disallowed, the CO/CU may continue to use the credential assigned by the Partition SO. |
22 |
Enable offboard storage |
Allow off-board storage |
On previous HSMs, this policy allowed or disallowed the use of the portable SIM key. SIM is not supported on this version of SafeNet Luna HSM. Destructive: OFF-to-ON |
23 |
Enable partition groups |
|
Always disallowed - deprecated policy. |
25 |
Enable Remote PED usage |
Allow Remote PED usage |
|
27 |
HSM non-volatile storage space |
Displays the non-volatile maximum storage space (in bytes) on the HSM. This is determined by the model of SafeNet Luna Network HSM you selected at time of purchase. |
|
30 |
Enable Unmasking |
Allow unmasking |
If allowed, cryptographic material can be migrated from legacy SafeNet appliances that used SIM. |
33 |
Maximum number of partitions | Current maximum number of partitions |
Displays the maximum number of application partitions that can be created on the HSM. This number is determined by the model of SafeNet Luna Network HSM you selected at time of purchase. On some models, the number of allowable partitions can be upgraded with a separate purchase. |
35 |
Enable Single Domain | Not applicable to SafeNet Luna Network HSMs. | |
36 |
Enable Unified PED Key | Not applicable to SafeNet Luna Network HSMs. | |
37 |
Enable MofN | Allow MofN |
If allowed on PED-authenticated SafeNet Luna Network HSMs, this policy enables you to require a quorum for role access, by splitting a PED secret among multiple PED keys (see M of N Split Secrets (Quorum)). If disallowed, users will no longer be asked to split a PED secret (M and N automatically set to 1). Always disallowed on password-authenticated HSMs. |
38 |
Enable small form factor backup/restore | Not available in this release. | |
39 |
Enable Secure Trusted Channel | Allow Secure Trusted Channel |
If allowed, this policy enables the use of Secure Trusted Channel for partition-client connections (see Secure Trusted Channel (STC)). If disallowed, all partition-client connections must use NTLS. Secure Trusted Channel is a Network HSM feature, and has no function on SafeNet Luna Network HSM. Thales does not recommend turning this policy on at any time. |
40 |
Enable decommission on tamper |
Decommission on tamper |
If allowed, the HSM will be decommissioned if a tamper event occurs. Decommissioning deletes all partitions and their contents, the audit role, and the audit configuration. The HSM policy settings are retained. See Tamper Events for more information. Destructive: ON-to-OFF |
42 |
Enable partition re-initialize | Not available in this release. | |
43 |
Enable low level math acceleration | Allow low-level math acceleration |
This is enabled by default, and must be enabled to provide maximum performance. Do not disable unless instructed to do so by Thales Technical Support. |
45 |
Enable Fast-Path | Not available in this release. | |
46 |
Allow Disabling Decommission |
Disable Decommission |
If enabled, the decommission CAUTION: Changing this policy will destroy partitions on the HSM, and they must be recreated. If HSM policy 40: Decommission on Tamper is enabled, you cannot enable this policy (fails with error: CKR_CONFIG_FAILS_DEPENDENCIES). However, attempting to enable it will still destroy HSM partitions. Destructive: OFF-to-ON, ON-to-OFF |
47 |
Enable Tunnel Slot |
Not available in this release. |
|
48 |
Enable Controlled Tamper Recovery | Do Controlled Tamper Recovery |
If allowed, the HSM SO must explicitly clear the tamper before the HSM can resume normal operations. This is the default behavior. If disallowed, the HSM must be restarted before it can resume normal operations. See Tamper Events for more information. |
49 |
Enable Partition Utilization Metrics | Allow Partition Utilization Metrics |
|