hsm showpolicies

Displays the HSM-level capability and policy settings for the HSM. Include the -exporttemplate option to export the current state of all HSM policies to a policy template. Only policies that the HSM SO can change (the corresponding capability is not set to 0) are included in the output. For a complete list of HSM capabilities and policies, refer to HSM Capabilities and Policies.

NOTE   Some mechanisms (such as KCDSA) are not enabled unless you have purchased and installed the required Secure Capability Update package. If you require a particular mechanism, and do not see it listed when you generate a mechanism list, contact Thales Customer Support.

The hsm commands appear only when LunaCM's active slot is set to the administrative partition.

Syntax

hsm showpolicies [-exporttemplate <filepath/filename>]

Argument(s) Short Description
-exporttemplate <filepath/filename> -et

Export the current state of all HSM policies to a policy template in the specified location.

Example

Current Slot Id: 107 (Luna Admin Slot 7.7.3 (PW) Key Export With Cloning Mode)

lunacm:>hsm showpolicies
HSM Capabilities
	0: Enable PIN-based authentication : 1
	1: Enable PED-based authentication : 1
	2: Performance level : 9
	4: Enable domestic mechanisms & key sizes : 1
	6: Enable masking : 1
	7: Enable cloning : 1
	9: Enable full (non-backup) functionality : 1
	12: Enable non-FIPS algorithms : 1
	15: Enable SO reset of partition PIN : 1
	16: Enable network replication : 1
	17: Enable Korean Algorithms : 0
	19: Manufacturing Token : 0
	21: Enable forcing user PIN change : 1
	22: Enable offboard storage : 1
	23: Enable partition groups : 0
	25: Enable remote PED usage : 1
	27: HSM non-volatile storage space : 33554432
	30: Enable unmasking : 1
	33: Maximum number of partitions : 1
	35: Enable Single Domain : 0
	36: Enable Unified PED Key : 0
	37: Enable MofN : 1
	38: Enable small form factor backup/restore : 0
	40: Enable decommission on tamper : 0
	42: Enable partition re-initialize : 0
	43: Enable low level math acceleration : 1
	46: Allow Disabling Decommission : 0
	48: Enable Controlled Tamper Recovery : 0
	49: Enable Partition Utilization Metrics : 1
	50: Enable Functionality Modules : 0
	51: Enable SMFS Auto Activation : 0
	52: Allow Restricting FM Privilege Level : 0
	53: Allow encrypting of keys from FM to HSM : 0
	54: Enable Smart Card-based authentication : 0
	55: Enable Restricted Restore : 0
	56: Enable User Defined ECC Curves : 1

HSM Policies
	0: PIN-based authentication : 1
	1: PED-based authentication : 0
	6: Allow masking : 1
	7: Allow cloning : 1
	12: Allow non-FIPS algorithms : 0
	15: SO can reset partition PIN : 0
	16: Allow network replication : 1
	21: Force user PIN change after set/reset : 0
	22: Allow offboard storage : 1
	25: Allow remote PED usage : 1
	30: Allow unmasking : 1
	33: Current maximum number of partitions : 1
	37: Allow MofN : 1
	43: Allow low level math acceleration : 1
	49: Allow Partition Utilization Metrics : 0
	56: Allow User Defined ECC Curves : 0

Command Result : No Error