The HSM can be configured to suit the cryptographic needs of your organization. Configurable functions are governed by the following settings:
>HSM Capabilities are features of HSM functionality, set at manufacture based on the HSM model you selected at time of purchase. You can add new capabilities to the HSM by purchasing and applying capability licenses from Thales (see Upgrading HSM Capabilities). Some capabilities have corresponding modifiable HSM policies.
>HSM Policies are configurable settings that allow the HSM Security Officer to modify the function of their corresponding capabilities. Some policies affect HSM-wide functionality, and others allow further customization of individual partitions by the Partition Security Officer.
The table below describes all Luna PCIe HSM 7 capabilities, their corresponding policies, and the results of changing their settings. This section contains the following procedures:
>Setting HSM Policies Manually
>Setting HSM Policies Using a Template
To zeroize the HSM and revert policies to their default values, see Resetting the Luna PCIe HSM 7 to Factory Condition.
To zeroize the HSM and keep the existing policy settings, use
Destructive Policies
Some policies affect the security of the HSM. As a security measure, changing those security-affecting policies results in application partitions, or the entire HSM, being zeroized. Among those listed below, such policies are marked as Destructive.
| # | HSM Capability | HSM Policy |
|---|---|---|
| 0 |
Enable PIN-based authentication >
>
|
N/A |
| 1 |
Enable PED-based authentication >
>
|
N/A |
| 2 |
Performance level Numerical value indicates the HSM's performance level, determined by the model you selected at time of purchase: >4: Standard performance >8: Enterprise performance >15: Maximum performance |
N/A |
| 4 |
Enable domestic mechanisms & key sizes Always |
N/A |
|
6 |
Enable masking Always
|
Destructive If this policy is allowed, see partition policy 3: Allow private key masking and partition policy 7: Allow secret key masking. |
|
7 |
Enable cloning Always |
Destructive >1 (default): The HSM may clone cryptographic objects from one partition to another. This is required to back up partitions >0: No partition on the HSM may clone cryptographic objects. Partition SOs cannot change this. |
|
9 |
Enable full (non-backup) functionality >
>
|
N/A |
|
12 |
Always |
Destructive * >1 (default): The HSM may use all available cryptographic algorithms, meaning all the FIPS-approved algorithms as well as all the non-FIPS algorithms. >0: Only algorithms sanctioned by the FIPS 140-2 standard are permitted. The following is displayed in the output from The HSM is in FIPS 140-2 approved operation mode. NOTE When C_GetMechanismInfo is called and the HSM policy “Allow NonFIPS Algorithms” is disabled: >If a mechanism has the WRAP flag set and MPE_NO_WRAP, the WRAP flag is not returned by the HSM as part of the mechanism info. >If a mechanism has the SIGN flag set and MPE_NO_SIGN, the SIGN flag is not returned by the HSM as part of the mechanism info. When the policy is enabled, the HSM returns all the flags that are applicable to the requested mechanism. This policy must be ON for the HSM, in order to allow the non-FIPS choice to be made on a per-partition basis (Luna HSM Firmware 7.7.1 and newer) using partition policy 43. If this HSM policy is OFF, then non-FIPS algorithms cannot be permitted on a per-partition basis and partition policy 43 is not available for use. |
|
15 |
Enable SO reset of partition PIN Always >the Partition SO to reset the password or PED key secret of the Crypto Officer. >the Crypto Officer to reset the password or PED key secret of the Crypto User. |
Destructive >1: Partition SO may reset the password or PED key secret of a Crypto Officer who has been locked out after too many failed login attempts. >0 (default): The CO lockout is permanent and the partition contents are no longer accessible. The partition must be re-initialized, and key material restored from a backup device. See Resetting the Crypto Officer, Limited Crypto Officer, or Crypto User Credential. |
|
16 |
Enable network replication Always NOTE Luna HSM Firmware 7.8.0 and newer ignores this setting where CPv4 is invoked; that cloning option is always allowed, when the corresponding cloning policies are enabled. |
>1 (default): Cloning of cryptographic objects is permitted over a network. Remote backup is allowed >0: Cloning over a network is not permitted. Partition backup is possible to a locally-connected Luna Backup HSM only. |
|
17 |
Enable Korean Algorithms >
>
|
N/A |
|
18 |
FIPS evaluated Always NOTE This capability is visible (not used) in previous HSM firmware versions, but is removed from Luna HSM Firmware 7.7.0 and newer. |
N/A |
|
19 |
Manufacturing Token Always |
N/A |
|
21 |
Enable forcing user PIN change Always |
Force user PIN change after set/reset >1 (default): After the Partition SO initializes or resets the Crypto Officer credential, the CO must change the credential before any other actions are permitted. This also applies when the CO initializes/resets the Crypto User role. This policy is intended to enforce the separation of roles on the partition. >0: The CO/CU may continue to use the credential assigned by the Partition SO. They can change / rotate the credential at any time, but the change is not forced at first use of the role after role initialization or reset. |
|
22 |
Enable offboard storage Always |
Destructive Deprecated policy with no application to Luna 7. Default: 1 |
|
23 |
Enable partition groups Always |
N/A |
|
25 |
Enable Remote PED usage Always Always |
>1 (default): The HSM may authenticate roles using a remotely-located Luna PED server or a locally-installed Luna PED. >0: The HSM must use a locally-installed Luna PED to authenticate roles. |
|
27 |
HSM non-volatile storage space Displays the maximum non-volatile storage space (in bytes) on the HSM, determined by the Luna PCIe HSM 7 model you selected at time of purchase. |
N/A |
|
30 |
Enable Unmasking Always |
>1 (default): Cryptographic objects may be migrated from legacy Luna HSMs that used SIM. >0: Migration from legacy HSMs using SIM is not possible. |
|
33 |
Maximum number of partitions Displays the maximum number of application partitions that can be created on the HSM. |
Current maximum number of partitions You can change HSM policy 33 to lower the effective maximum number of partitions below the actual licensed maximum. You cannot, however, lower the maximum below the number of partitions currently existing on the HSM. |
|
35 |
Enable Single Domain Always |
N/A |
|
36 |
Enable Unified PED Key Always |
N/A |
|
37 |
Enable MofN Always |
>1 (default): During PED key creation, you have the option to require a quorum to authenticate the role, by splitting the authentication secret among multiple PED keys (see Quorum Split Secrets (M of N)) >0: Users do not have the option to split PED key secrets (M and N are automatically set to 1). |
|
38 |
Enable small form factor backup/restore Always |
N/A |
|
39 |
Enable Secure Trusted Channel Always |
Secure Trusted Channel is a Luna Network HSM 7 feature, and has no function on Luna PCIe HSM 7. Thales does not recommend turning this policy on at any time. |
|
40 |
Enable decommission on tamper Always |
Destructive >1: The HSM is decommissioned if a tamper event occurs (see Tamper Events). >0 (default): The contents of the HSM are not affected by a tamper event. |
|
42 |
Enable partition re-initialize Always |
N/A |
|
43 |
Enable low level math acceleration Always |
Allow low-level math acceleration >1 (default): Provides maximum HSM performance. >0: Do not turn this policy off unless instructed by Thales Technical Support. |
|
46 |
Allow Disabling Decommission Always |
Destructive >1: >0 (default): Decommission works as described in Decommissioning the HSM Card. CAUTION! Changing this policy will destroy partitions on the HSM, and they must be recreated. If HSM policy 40 is enabled, you cannot enable this policy (fails with error: CKR_CONFIG_FAILS_DEPENDENCIES). However, attempting to enable it will still destroy HSM partitions. |
| 47 |
Enable Tunnel Slot Always |
N/A |
| 48 |
Enable Controlled Tamper Recovery Always |
>1 (default): After a tamper event, the HSM SO must explicitly clear the tamper before the HSM can resume normal operations. >0: The HSM must be restarted before it can resume normal operations. See Tamper Events for more information. |
| 49 |
Enable Partition Utilization Metrics Always |
Allow Partition Utilization Metrics >1: The HSM SO can view Partition Utilization Metrics. >0 (default): Partition Utilization Metrics are not available. See Partition Utilization Metrics for more information. |
| 50 |
Enable Functionality Modules This capability enables Functionality Modules (FMs) to be loaded to the HSM (see Functionality Modules). >
>
Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0. |
Destructive >1: With this policy enabled, Functionality Modules may be loaded to the HSM, permitting custom cryptographic operations. Allows use of the ctfm utility and FM-related commands, and the use of Functionality Modules in general with this HSM. NOTE FIPS compliance requires that objects are never cloned or restored to an HSM using less secure firmware. FIPS 140 validation is performed against the HSM hardware with a specific firmware version. Since the introduction of a Functionality Module changes the firmware, allowing FMs in the HSM removes the HSM from FIPS compliance. For purposes of cloning, an HSM where FMs have ever been allowed is considered less secure than one where FMs have never been allowed. See the Caution below. You can subsequently disable FMs, but future cloning operations will work only with other FM-HOC HSMs. >0 (default): FMs may not be loaded to the HSM. CAUTION! Enabling FMs (HSM policy 50) introduces changes to Luna HSM functionality, some of which are permanent; they cannot be removed by disabling the policy. FM-enabled status is not reversible by Factory Reset. Refer to FM Deployment Constraints for details before enabling. If you are using Crypto Command Center, ensure that your CCC version supports FM-enabled HSMs before you enable HSM policy 50. Refer to the CCC CRN for details. |
| 51 |
Enable SMFS Auto Activation This capability enables the Secure Memory File System (SMFS) to be activated automatically on startup. >
>
Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0. |
Destructive >1: With this policy enabled, the Secure Memory File System (SMFS) is automatically activated on startup, providing a secure, tamper-enabled location in the HSM memory where Functionality Modules can load keys and parameters. Auto-activation for SMFS, like auto-activation for multifactor quorum-authenticated partitions in general, persists through a power outage of up to 2 hours duration. >0 (default): If disabled, the HSM SO must manually activate the SMFS each time the HSM reboots or loses power. |
| 52 |
Allow Restricting FM Privilege Level This capability enables the HSM SO to restrict the sensitive key attributes of partition objects from FMs. >
>
Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0. |
Destructive >1: FM privilege is restricted. >0 (default): FM privilege permits FMs to see the sensitive key attributes (including key values) of cryptographic objects on application partitions. This privilege is necessary for most FMs, so that the Crypto Officer (CO) and Crypto User (CU) roles can use partition objects with the FM. However, some FMs might not require this privilege and it can be restricted to satisfy some certification requirements (such as Common Criteria). |
| 53 |
Allow Encrypting of Keys from FM to HSM This capability enables key encryption between the FM and the Functionality Module Crypto Engine interface (FMCE). >
>
Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0. |
Encrypt Keys Passing from FM to HSM Destructive >1: With this policy enabled, keys created by an FM are encrypted before crossing from the FM to the Functionality Module Crypto Engine interface (FMCE). This internal encryption may be required to satisfy some certification requirements (such as Common Criteria). >0 (default): Keys are not encrypted before crossing to the FMCE. |
| 55 |
Enable Restricted Restore This capability allows the HSM SO to restrict a Luna Backup HSM 7 from being used with firmware older than Luna HSM Firmware 7.7.0, for any purpose other than to migrate cryptographic objects to Luna HSM Firmware 7.7.0 or newer. See V0 and V1 Partitions for more information. Appears on Luna Backup HSM 7 running Luna Backup HSM 7 Firmware 7.7.1 or newer. NOTE Not visible on Luna Network HSM 7 via lunash commands. Look for this Capability/Policy via lunacm when a Luna Backup HSM 7 is the current slot. |
ON-to-OFF Destructive >1: Objects backed up from pre-7.7.0 firmware partitions can only be restored to V0 or V1 partitions (Luna HSM Firmware 7.7.0 or newer). Enable this policy to ensure FIPS compliance. >0 (default): Objects backed up from pre-7.7.0 firmware partitions can be restored to pre-7.7.0 firmware partitions. Do not use this setting if you require FIPS compliance. CAUTION! FIPS compliance requires that objects are never cloned or restored to an HSM using less secure firmware, and this includes restoring from Luna Backup HSM 7 firmware. If you have backups already stored on the Luna Backup HSM 7 that were taken from pre-7.7.0 partitions, turning this policy ON will prevent you from restoring them to the same source partition. You must update the HSM containing the source partition to Luna HSM Firmware 7.7.0 or newer before restoring from backup. |
| 56 |
Enable User Defined ECC Curves This capability allows the HSM SO to restrict or allow the use of user-defined ECC curves. The state of the associated policy is preserved through firmware update. |
Destructive >1: User-defined ECC curves can be used, without restriction. >0 (default): Named curves (that we have verified) can still be used, as can user-defined ECC curves where the named-curve parameters are provided. User-defined ECC curves that cannot map to built-in named curves during key-pair generation, public key creation, private key unwrapping, cloning or SKS, and key derivation, return the error ECC_CURVE_NOT_ALLOWED. >Named-curve samples are provided when you include the SDK option while installing the Client. The files must be unmodified. /usr/safenet/lunaclient/samples/ecc_examples •bpP160r1.txt •bpP512t1.txt •x962_char2_163v1.txt •bpP192r1.txt •secp384r1.txt •x962_char2_359V1.txt •bpP224r1.txt •bpP384R1.txt •sm2p256v1.txt NOTE For FIPS compliance, NIST requires us to make security claims with respect to the curves that we support. It is impossible to test and report on all possible user-defined ECC curves. Therefore, commonly-used, named curves are explicitly tested, documented to comply with FIPS requirements, and allowed in FIPS mode. |
| 57 |
Enable Sync with Host Time This capability enables the HSM SO to automatically synchronize the HSM's time to the host system time every 24 hours. |
>1: The HSM's time is synchronized to the host system time once every 24 hours. The maximum drift that is allowed to be synchronized by this policy is 3 seconds. If the HSM time and the host time have drifted by more than 3 seconds in the last 24 hours, a log entry is created instead:
This applies to the first synchronization as well -- set the time manually using >0 (default): HSM time is not automatically synchronized to host time. The HSM SO can still synchronize the clocks manually. |
* The Backup HSM performs only backup and restore operations and is not a general-purpose HSM. It has no information about the origin of keys or objects. In the case of FIPS-mode or non-FIPS the status of a source HSM (Policy 12) is not noticed, and a target HSM decides what to do with keys from a restore operation. However, the actions of a Backup HSM can be affected by the cloning protocol that is used - see Policy 55.
