HSM Capabilities and Policies

The HSM can be configured to suit the cryptographic needs of your organization. Configurable functions are governed by the following settings:

>HSM Capabilities are features of HSM functionality, set at manufacture based on the HSM model you selected at time of purchase. You can add new capabilities to the HSM by purchasing and applying capability licenses from Thales (see Upgrading HSM Capabilities and Partition Licenses). Some capabilities have corresponding modifiable HSM policies.

>HSM Policies are configurable settings that allow the HSM Security Officer to modify the function of their corresponding capabilities. Some policies affect HSM-wide functionality, and others allow further customization of individual partitions by the Partition Security Officer.

The table below describes all Luna Network HSM 7 capabilities, their corresponding policies, and the results of changing their settings. This section contains the following procedures:

>Setting HSM Policies Manually

>Setting HSM Policies Using a Template

To zeroize the HSM and revert policies to their default values, see Resetting the Luna Network HSM 7 to Factory Condition.

To zeroize the HSM and keep the existing policy settings, use lunash:> hsm zeroize

NOTE Regarding Capabilities and Policies - as a general rule, when firmware is updated, a given policy retains whatever value it had (default or your setting), before the update. Some firmware versions introduce new capabilities with their accompanying policies. The listed default setting of a policy is the expected setting

•if the Capability and Policy was not in existence,
or

•if the Policy was not changed,

before a firmware update.

Rolling back the HSM firmware or resetting the HSM to factory conditions restores that version's default settings for all policies.

Applying a non-default policy setting should be [re-]done after updating firmware from factory settings.

Destructive Policies

Some policies affect the security of the HSM. As a security measure, changing those security-affecting policies results in application partitions, or the entire HSM, being zeroized. Among those listed below, such policies are marked as Destructive.

# HSM Capability HSM Policy

#	HSM Capability	HSM Policy
0	Enable PIN-based authentication >Allowed: The HSM authenticates all users with keyboard-entered passwords. >Disallowed: See HSM capability 1 below.	N/A
1	Enable PED-based authentication >Allowed: The HSM authenticates users with secrets stored on physical PED keys, read by a Luna PED. The Crypto Officer and Crypto User roles may also be configured with a secondary, keyboard-entered challenge secret. >Disallowed: See HSM capability 0 above.	N/A
2	Performance level Numerical value indicates the HSM's performance level, determined by the model you selected at time of purchase: >4: Standard performance >8: Enterprise performance >15: Maximum performance	N/A
4	Enable domestic mechanisms & key sizes Always allowed. All Luna Network HSM 7s are capable of full-strength cryptography with no US export restrictions.	N/A
6	Enable masking Always disallowed for HSMs with older firmware. SKS (which uses masking) was not available before Luna HSM Firmware 7.7.0. Allowed for Luna Network HSM 7s at Luna HSM Firmware 7.7.0 and newer, to support SKS.	Allow masking Destructive If this policy is allowed, see partition policy 3: Allow private key masking and partition policy 7: Allow secret key masking.
7	Enable cloning Always allowed. All Luna Network HSM 7s can clone cryptographic objects from one partition to another.	Allow cloning Destructive >ON (default): The HSM may clone cryptographic objects from one partition to another. This is required to back up partitions or include them in HA groups. The Partition SO can enable/disable cloning on individual partitions. >OFF: No partition on the HSM mayclone cryptographic objects. The Partition SO cannot change this.
9	Enable full (non-backup) functionality >Allowed: The HSM is capable of full cryptographic functions. >Disallowed: The HSM is capable of backup functions only.	N/A
12	Enable non-FIPS algorithms Always allowed. The HSM can use all cryptographic algorithms described in Supported Mechanisms.	Allow non-FIPS algorithms Destructive * >ON (default): The HSM may use all available cryptographic algorithms, meaning all the FIPS-approved algorithms as well as all the non-FIPS algorithms. >OFF: Only algorithms sanctioned by the FIPS 140 standard are permitted. Some of these algorithms will have certain operations restricted; refer to your firmware version in Supported Mechanisms for more information. NOTE When C_GetMechanismInfo is called and the HSM policy “Allow NonFIPS Algorithms” is disabled: >If a mechanism has the WRAP flag set and MPE_NO_WRAP, the WRAP flag is not returned by the HSM as part of the mechanism info. >If a mechanism has the SIGN flag set and MPE_NO_SIGN, the SIGN flag is not returned by the HSM as part of the mechanism info. When the policy is enabled, the HSM returns all the flags that are applicable to the requested mechanism. This policy must be set to ON if FIPS compliance is to be set on a per-partition basis using partition policy 43: Allow non-FIPS algorithms (requires Luna HSM Firmware 7.7.1 or newer).
15	Enable SO reset of partition PIN Always allowed. This capability enables: >the Partition SO to reset the password or PED key secret of the Crypto Officer. >the Crypto Officer to reset the password or PED key secret of the Crypto User.	SO can reset partition PIN Destructive >ON: Partition SO may reset the password or PED key secret of a Crypto Officer who has been locked out after too many failed login attempts. >OFF (default): The CO lockout is permanent and the partition contents are no longer accessible. The partition must be re-initialized, and key material restored from a backup device. See Resetting the Crypto Officer, Limited Crypto Officer, or Crypto User Credential.
16	Enable network replication Always allowed. This capability enables cloning of cryptographic objects over a network. This is required for HA groups, and for partition backup to a remote or client-connected Luna Backup HSM. NOTE Using Luna HSM Firmware 7.8.0 and newer, this setting is ignored when partition policy 44: Allow Extended Domain Management is enabled for Universal Cloning.	Allow network replication >ON (default): Cloning of cryptographic objects is permitted over a network. Remote and client-connected backup is allowed, and the partition may be used in an HA group. >OFF: Cloning over a network is not permitted. Partition backup is possible to a locally-connected Luna Backup HSM only.
17	Enable Korean Algorithms >Allowed: if you have purchased and applied a license for the Korea-specific algorithm set. See Upgrading HSM Capabilities and Partition Licenses to purchase this capability. >Disallowed if you have not applied this license.	N/A
18	FIPS evaluated Always disallowed - deprecated capability. All Luna Network HSM 7s are capable of operating in FIPS 140 approved configuration (formerly FIPS mode). NOTE This capability is visible (not used) in previous HSM firmware versions, but is removed from Luna HSM Firmware 7.7.0 and newer.	N/A
19	Manufacturing Token Always disallowed. For Thales internal use only.	N/A
21	Enable forcing user PIN change Always allowed. This capability forces the Crypto Officer or Crypto User to change the initial role credential created by the Partition SO.	Force user PIN change after set/reset >ON (default): After the Partition SO initializes or resets the Crypto Officer credential, the CO must change the credential before any other actions are permitted. This also applies when the CO initializes/resets the Crypto User role. This policy is intended to enforce the separation of roles on the partition. >OFF: The CO/CU may continue to use the credential assigned by the Partition SO. See Changing a Partition Role Credential.
22	Enable portable masking key Always allowed - deprecated capability with no application to Luna 7.	Allow offboard storage Destructive Deprecated policy with no application to Luna 7. Default: ON
23	Enable partition groups Always disallowed - deprecated capability.	N/A
25	Enable Remote PED usage Always allowed on multifactor quorum-authenticated HSMs. Always disallowed on password-authenticated HSMs.	Allow Remote PED usage >ON (default): The HSM may authenticate roles using a remotely-located Luna PED server or a locally-installed Luna PED. >OFF: The HSM must use a locally-installed Luna PED to authenticate roles.
27	HSM non-volatile storage space Displays the maximum non-volatile storage space (in bytes) on the HSM, determined by the Luna Network HSM 7 model you selected at time of purchase.	N/A
30	Enable Unmasking Always allowed. This capability enables migration from legacy Luna HSMs that used SIM.	Allow unmasking >ON (default): Cryptographic objects may be migrated from legacy Luna HSMs that used SIM. >OFF: Migration from legacy HSMs using SIM is not possible.
33	Maximum number of partitions Displays the maximum number of application partitions that can be created on the Luna Network HSM 7. The default maximum is determined by the Luna Network HSM 7 model you selected at time of purchase. On some models, you can upgrade the number of allowable partitions by purchasing additional partition licenses (see Upgrading HSM Capabilities and Partition Licenses).	Current maximum number of partitions You can change HSM policy 33 to lower the effective maximum number of partitions below the actual licensed maximum. You cannot, however, lower the maximum below the number of partitions currently existing on the HSM.
35	Enable Single Domain Always disallowed.	N/A
36	Enable Unified PED Key Always disallowed.	N/A
37	Enable MofN Always allowed on multifactor quorum-authenticated HSMs. Always disallowed on password-authenticated HSMs.	Allow MofN >ON (default): During PED key creation, you have the option to require a quorum to authenticate the role, by splitting the authentication secret among multiple PED keys. See Quorum Split Secrets (M of N) >OFF: Users do not have the option to split PED key secrets (M and N are automatically set to 1).
38	Enable small form factor backup/restore Always disallowed.	N/A
39	Enable Secure Trusted Channel Always allowed. This capability enables Secure Trusted Channel (STC) to be used for partition-client connections, and/or to encrypt traffic between the HSM and appliance (see Secure Trusted Channel).	Allow Secure Trusted Channel >ON: Secure Trusted Channel is enabled for partition-client connections (see Creating an STC Connection). STC can be used to encrypt traffic between the appliance and the HSM (see Using the STC Admin Channel). >OFF (default): All clients must access partitions using NTLS connections. Not applicable to HSMs at Luna HSM Firmware 7.7.0 or newer, where STC is always enabled and is optional to use in any application partition, unless Partition Policy 37 is set to make STC mandatory for that partition.
40	Enable decommission on tamper Always allowed. This enables the HSM to be automatically decommissioned if a tamper event occurs (see Comparing Zeroize, Decommission, Re-image, and Factory Reset).	Decommission on tamper Destructive >ON: The HSM is decommissioned if a tamper event occurs (see Tamper Events). >OFF (default): The contents of the HSM are not affected by a tamper event.
42	Enable partition re-initialize Always disallowed.	N/A
43	Enable low level math acceleration Always allowed. This capability enables acceleration of cryptographic functionality for maximum HSM performance.	Allow low-level math acceleration >ON (default): Provides maximum HSM performance. >OFF: Do not turn this policy off unless instructed by Thales Technical Support.
45	Enable Fast-Path Always disallowed.	N/A
46	Allow Disabling Decommission Always allowed. This capability enables the HSM SO to disable the decommission button on the HSM.	Disable Decommission Destructive >ON: The decommission button is disabled, preventing decommissioning of the HSM. >OFF (default): Decommission works as described in Decommissioning the Luna Network HSM 7 Appliance. CAUTION! Changing this policy will destroy partitions on the HSM, and they must be recreated. If HSM policy 40 is enabled, you cannot enable this policy (fails with error: CKR_CONFIG_FAILS_DEPENDENCIES). However, attempting to enable it will still destroy HSM partitions.
47	Enable Tunnel Slot Always disallowed.	N/A
48	Enable Controlled Tamper Recovery Always allowed. This capability enables the HSM SO to require tamper events to be explicitly cleared before normal operations can resume.	Do Controlled Tamper Recovery >ON (default): After a tamper event, the HSM SO must explicitly clear the tamper before the HSM can resume normal operations. >OFF: The HSM must be restarted before it can resume normal operations. See Tamper Events for more information.
49	Enable Partition Utilization Metrics Always allowed. This capability enables the HSM SO to view (or export to a named file) counters that record how many times specific cryptographic operations have been performed in application partitions since the last counter-reset event. This provides a picture of operational utilization that can be used to guide the (re-)allocation and balancing of partitions and applications, for better service to all users of your partitions.	Allow Partition Utilization Metrics >ON: The HSM SO can view Partition Utilization Metrics. >OFF (default): Partition Utilization Metrics are not available. See Partition Utilization Metrics for more information.
50	Enable Functionality Modules This capability enables Functionality Modules (FMs) to be loaded to the HSM (see Functionality Modules). >Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs). >Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.	Allow Functionality Modules Destructive >ON: With this policy enabled, Functionality Modules may be loaded to the HSM, permitting custom cryptographic operations. Allows use of the ctfm utility and FM-related commands, and the use of Functionality Modules in general with this HSM. NOTE FIPS compliance requires that objects are never cloned or restored to an HSM using less secure firmware. FIPS 140 validation is performed against the HSM hardware with a specific firmware version. Since the introduction of a Functionality Module changes the firmware, allowing FMs in the HSM removes the HSM from FIPS compliance. For purposes of cloning, an HSM where FMs have ever been allowed is considered less secure than one where FMs have never been allowed. See the Caution below. You can subsequently disable FMs, but future cloning operations will work only with other FM-HOC HSMs. >OFF (default): FMs may not be loaded to the HSM. CAUTION! Enabling FMs (HSM policy 50) introduces changes to Luna HSM functionality, some of which are permanent; they cannot be removed by disabling the policy. FM-enabled status is not reversible by Factory Reset. Refer to FM Deployment Constraints for details before enabling. If you are using Crypto Command Center, ensure that your CCC version supports FM-enabled HSMs before you enable HSM policy 50. Refer to the CCC CRN for details.
51	Enable SMFS Auto Activation This capability enables the Secure Memory File System (SMFS) to be activated automatically on startup. >Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs). >Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.	Allow SMFS Auto Activation Destructive >ON: With this policy enabled, the Secure Memory File System (SMFS) is automatically activated on startup, providing a secure, tamper-enabled location in the HSM memory where Functionality Modules can load keys and parameters. Auto-activation for SMFS, like auto-activation for multifactor quorum-authenticated partitions in general, persists through a power outage of up to 2 hours duration. >OFF (default): If disabled, the HSM SO must manually activate the SMFS each time the HSM reboots or loses power.
52	Allow Restricting FM Privilege Level This capability enables the HSM SO to restrict the sensitive key attributes of partition objects from FMs. >Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs). >Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.	Restrict FM Privilege Level Destructive >ON: FM privilege is restricted. >OFF (default): FM privilege permits FMs to see the sensitive key attributes (including key values) of cryptographic objects on application partitions. This privilege is necessary for most FMs, so that the Crypto Officer (CO) and Crypto User (CU) roles can use partition objects with the FM. However, some FMs might not require this privilege and it can be restricted to satisfy some certification requirements (such as Common Criteria).
53	Allow Encrypting of Keys from FM to HSM This capability enables key encryption between the FM and the Functionality Module Crypto Engine interface (FMCE). >Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs). >Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license. Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.	Encrypt Keys Passing from FM to HSM Destructive >ON: With this policy enabled, keys created by an FM are encrypted before crossing from the FM to the Functionality Module Crypto Engine interface (FMCE). This internal encryption may be required to satisfy some certification requirements (such as Common Criteria). >OFF (default): Keys are not encrypted before crossing to the FMCE.
55	Enable Restricted Restore This capability allows the HSM SO to restrict a Luna Backup HSM 7 from being used with firmware older than Luna HSM Firmware 7.7.0, for any purpose other than to migrate cryptographic objects to Luna HSM Firmware 7.7.0 or newer. See V0 and V1 Partitions for more information. Appears on Luna Backup HSM 7 running Luna Backup HSM 7 Firmware 7.7.1 or newer. NOTE This capability/policy does not appear on Luna Network HSM 7. This setting is visible in LunaCM when the active slot is set to a Luna Backup HSM 7.	Enable Restricted Restore ON-to-OFF Destructive >1: Objects backed up from pre-7.7.0 firmware partitions can only be restored to V0 or V1 partitions (Luna HSM Firmware 7.7.0 or newer). Enable this policy to ensure FIPS compliance. >0 (default): Objects backed up from pre-7.7.0 firmware partitions can be restored to pre-7.7.0 firmware partitions. Do not use this setting if you require FIPS compliance. CAUTION! FIPS compliance requires that objects are never cloned or restored to an HSM using less secure firmware, and this includes restoring from Luna Backup HSM 7 firmware. If you have backups already stored on the Luna Backup HSM 7 that were taken from pre-7.7.0 partitions, turning this policy ON will prevent you from restoring them to the same source partition. You must update the HSM containing the source partition to Luna HSM Firmware 7.7.0 or newer before restoring from backup.
56	Enable User Defined ECC Curves Always 1 using Luna HSM Firmware 7.7.2 or newer. This capability allows the HSM SO to restrict or allow the use of user-defined ECC curves. The state of the associated policy is preserved through firmware update.	Allow User Defined ECC Curves Destructive >ON (default using Luna HSM Firmware 7.7.2): User-defined ECC curves can be used, without restriction. >OFF (default using Luna HSM Firmware 7.8.0 or newer): Named curves (that we have verified) can still be used, as can user-defined ECC curves where the named-curve parameters are provided. User-defined ECC curves that cannot map to built-in named curves during key-pair generation, public key creation, private key unwrapping, cloning or SKS, and key derivation, return the error ECC_CURVE_NOT_ALLOWED. Named-curve samples are provided when you include the SDK option while installing Luna HSM Client. The files must be unmodified. /usr/safenet/lunaclient/samples/ecc_examples >bpP160r1.txt >bpP512t1.txt >x962_char2_163v1.txt >bpP192r1.txt >secp384r1.txt >x962_char2_359V1.txt >bpP224r1.txt >bpP384R1.txt >sm2p256v1.txt NOTE For FIPS compliance, NIST requires us to make security claims with respect to the curves that we support. It is impossible to test and report on all possible user-defined ECC curves. Therefore, commonly-used, named curves are explicitly tested, documented to comply with FIPS requirements, and allowed in FIPS 140 approved configuration (formerly FIPS mode).
57	Enable Sync with Host Time Always 1 using Luna HSM Firmware 7.8.0 or newer. This capability enables the HSM SO to automatically synchronize the HSM's time to the host system time every 24 hours.	Allow Sync with Host Time >ON: The HSM's time is synchronized to the host system time once every 24 hours. The maximum drift that is allowed to be synchronized by this policy is 3 seconds. If the HSM time and the host time have drifted by more than 3 seconds in the last 24 hours, a log entry is created instead: `[HSM] LOG(INFO): Hsm clock(1647624503) drifts from host clock(1647628144) > threshold, stop sync clock!` `[HSM] ALM2029: HSM clock drift allowed threshold exceeded` This applies to the first synchronization as well -- set the time manually using hsm time get and hsm time sync before setting this policy to ON. See also the `System times` block in the output of hsm show command. As a best practice for on-premises HSMs, this policy should be on. As well, time should be synchronized after every HSM or host reboot, due to cloning protocol version 4 (CPv4) requiring close synchronization, and newer algorithms having tight timing tolerances as well. >OFF (default): HSM time is not automatically synchronized to host time. The HSM SO can still synchronize the clocks manually.
58	Enable Unrestricted Metrics Access Using Luna HSM Firmware 7.8.9 or newer, this capability enables collection of partition utilization metrics without the SO logged into the HSM.	Allow Unrestricted Metrics Access >ON: Partition utilization metrics can be viewed, collected and reset without need for SO login. >OFF(default): The HSM SO must log into the HSM before partition utilization metrics can be captured or reset. See Partition Utilization Metrics for more information.

Enable PIN-based authentication

>Allowed: The HSM authenticates all users with keyboard-entered passwords.

>Disallowed: See HSM capability 1 below.

N/A

Enable PED-based authentication

>Allowed: The HSM authenticates users with secrets stored on physical PED keys, read by a Luna PED. The Crypto Officer and Crypto User roles may also be configured with a secondary, keyboard-entered challenge secret.

>Disallowed: See HSM capability 0 above.

N/A

Performance level

Numerical value indicates the HSM's performance level, determined by the model you selected at time of purchase:

>4: Standard performance

>8: Enterprise performance

>15: Maximum performance

N/A

Enable domestic mechanisms & key sizes

Always allowed. All Luna Network HSM 7s are capable of full-strength cryptography with no US export restrictions.

N/A

Enable masking

Always disallowed for HSMs with older firmware. SKS (which uses masking) was not available before Luna HSM Firmware 7.7.0.

Allowed for Luna Network HSM 7s at Luna HSM Firmware 7.7.0 and newer, to support SKS.

Allow masking

Destructive

If this policy is allowed, see partition policy 3: Allow private key masking and partition policy 7: Allow secret key masking.

Enable cloning

Always allowed. All Luna Network HSM 7s can clone cryptographic objects from one partition to another.

Allow cloning

Destructive

>ON (default): The HSM may clone cryptographic objects from one partition to another. This is required to back up partitions or include them in HA groups. The Partition SO can enable/disable cloning on individual partitions.

>OFF: No partition on the HSM mayclone cryptographic objects. The Partition SO cannot change this.

Enable full (non-backup) functionality

>Allowed: The HSM is capable of full cryptographic functions.

>Disallowed: The HSM is capable of backup functions only.

N/A

Enable non-FIPS algorithms

Always allowed. The HSM can use all cryptographic algorithms described in Supported Mechanisms.

Allow non-FIPS algorithms

Destructive *

>ON (default): The HSM may use all available cryptographic algorithms, meaning all the FIPS-approved algorithms as well as all the non-FIPS algorithms.

>OFF: Only algorithms sanctioned by the FIPS 140 standard are permitted. Some of these algorithms will have certain operations restricted; refer to your firmware version in Supported Mechanisms for more information.

NOTE When C_GetMechanismInfo is called and the HSM policy “Allow NonFIPS Algorithms” is disabled:

>If a mechanism has the WRAP flag set and MPE_NO_WRAP, the WRAP flag is not returned by the HSM as part of the mechanism info.

>If a mechanism has the SIGN flag set and MPE_NO_SIGN, the SIGN flag is not returned by the HSM as part of the mechanism info.

When the policy is enabled, the HSM returns all the flags that are applicable to the requested mechanism.

This policy must be set to ON if FIPS compliance is to be set on a per-partition basis using partition policy 43: Allow non-FIPS algorithms (requires Luna HSM Firmware 7.7.1 or newer).

Enable SO reset of partition PIN

Always allowed. This capability enables:

>the Partition SO to reset the password or PED key secret of the Crypto Officer.

>the Crypto Officer to reset the password or PED key secret of the Crypto User.

SO can reset partition PIN

Destructive

>ON: Partition SO may reset the password or PED key secret of a Crypto Officer who has been locked out after too many failed login attempts.

>OFF (default): The CO lockout is permanent and the partition contents are no longer accessible. The partition must be re-initialized, and key material restored from a backup device.

See Resetting the Crypto Officer, Limited Crypto Officer, or Crypto User Credential.

Enable network replication

Always allowed. This capability enables cloning of cryptographic objects over a network. This is required for HA groups, and for partition backup to a remote or client-connected Luna Backup HSM.

NOTE Using Luna HSM Firmware 7.8.0 and newer, this setting is ignored when partition policy 44: Allow Extended Domain Management is enabled for Universal Cloning.

Allow network replication

>ON (default): Cloning of cryptographic objects is permitted over a network. Remote and client-connected backup is allowed, and the partition may be used in an HA group.

>OFF: Cloning over a network is not permitted. Partition backup is possible to a locally-connected Luna Backup HSM only.

Enable Korean Algorithms

>Allowed: if you have purchased and applied a license for the Korea-specific algorithm set. See Upgrading HSM Capabilities and Partition Licenses to purchase this capability.

>Disallowed if you have not applied this license.

N/A

FIPS evaluated

Always disallowed - deprecated capability. All Luna Network HSM 7s are capable of operating in FIPS 140 approved configuration (formerly FIPS mode).

NOTE This capability is visible (not used) in previous HSM firmware versions, but is removed from Luna HSM Firmware 7.7.0 and newer.

N/A

Manufacturing Token

Always disallowed. For Thales internal use only.

N/A

Enable forcing user PIN change

Always allowed. This capability forces the Crypto Officer or Crypto User to change the initial role credential created by the Partition SO.

Force user PIN change after set/reset

>ON (default): After the Partition SO initializes or resets the Crypto Officer credential, the CO must change the credential before any other actions are permitted. This also applies when the CO initializes/resets the Crypto User role. This policy is intended to enforce the separation of roles on the partition.

>OFF: The CO/CU may continue to use the credential assigned by the Partition SO.

See Changing a Partition Role Credential.

Enable portable masking key

Always allowed - deprecated capability with no application to Luna 7.

Allow offboard storage

Destructive

Deprecated policy with no application to Luna 7.

Default: ON

Enable partition groups

Always disallowed - deprecated capability.

N/A

Enable Remote PED usage

Always allowed on multifactor quorum-authenticated HSMs.

Always disallowed on password-authenticated HSMs.

Allow Remote PED usage

>ON (default): The HSM may authenticate roles using a remotely-located Luna PED server or a locally-installed Luna PED.

>OFF: The HSM must use a locally-installed Luna PED to authenticate roles.

HSM non-volatile storage space

Displays the maximum non-volatile storage space (in bytes) on the HSM, determined by the Luna Network HSM 7 model you selected at time of purchase.

N/A

Enable Unmasking

Always allowed. This capability enables migration from legacy Luna HSMs that used SIM.

Allow unmasking

>ON (default): Cryptographic objects may be migrated from legacy Luna HSMs that used SIM.

>OFF: Migration from legacy HSMs using SIM is not possible.

Maximum number of partitions

Displays the maximum number of application partitions that can be created on the Luna Network HSM 7. The default maximum is determined by the Luna Network HSM 7 model you selected at time of purchase. On some models, you can upgrade the number of allowable partitions by purchasing additional partition licenses (see Upgrading HSM Capabilities and Partition Licenses).

Current maximum number of partitions

You can change HSM policy 33 to lower the effective maximum number of partitions below the actual licensed maximum. You cannot, however, lower the maximum below the number of partitions currently existing on the HSM.

Enable Single Domain

Always disallowed.

N/A

Enable Unified PED Key

Always disallowed.

N/A

Enable MofN

Always allowed on multifactor quorum-authenticated HSMs. Always disallowed on password-authenticated HSMs.

Allow MofN

>ON (default): During PED key creation, you have the option to require a quorum to authenticate the role, by splitting the authentication secret among multiple PED keys. See Quorum Split Secrets (M of N)

>OFF: Users do not have the option to split PED key secrets (M and N are automatically set to 1).

Enable small form factor backup/restore

Always disallowed.

N/A

Enable Secure Trusted Channel

Always allowed. This capability enables Secure Trusted Channel (STC) to be used for partition-client connections, and/or to encrypt traffic between the HSM and appliance (see Secure Trusted Channel).

Allow Secure Trusted Channel

>ON: Secure Trusted Channel is enabled for partition-client connections (see Creating an STC Connection). STC can be used to encrypt traffic between the appliance and the HSM (see Using the STC Admin Channel).

>OFF (default): All clients must access partitions using NTLS connections.

Not applicable to HSMs at Luna HSM Firmware 7.7.0 or newer, where STC is always enabled and is optional to use in any application partition, unless Partition Policy 37 is set to make STC mandatory for that partition.

Enable decommission on tamper

Always allowed. This enables the HSM to be automatically decommissioned if a tamper event occurs (see Comparing Zeroize, Decommission, Re-image, and Factory Reset).

Decommission on tamper

Destructive

>ON: The HSM is decommissioned if a tamper event occurs (see Tamper Events).

>OFF (default): The contents of the HSM are not affected by a tamper event.

Enable partition re-initialize

Always disallowed.

N/A

Enable low level math acceleration

Always allowed. This capability enables acceleration of cryptographic functionality for maximum HSM performance.

Allow low-level math acceleration

>ON (default): Provides maximum HSM performance.

>OFF: Do not turn this policy off unless instructed by Thales Technical Support.

Enable Fast-Path

Always disallowed.

N/A

Allow Disabling Decommission

Always allowed. This capability enables the HSM SO to disable the decommission button on the HSM.

Disable Decommission

Destructive

>ON: The decommission button is disabled, preventing decommissioning of the HSM.

>OFF (default): Decommission works as described in Decommissioning the Luna Network HSM 7 Appliance.

CAUTION! Changing this policy will destroy partitions on the HSM, and they must be recreated. If HSM policy 40 is enabled, you cannot enable this policy (fails with error: CKR_CONFIG_FAILS_DEPENDENCIES). However, attempting to enable it will still destroy HSM partitions.

Enable Tunnel Slot

Always disallowed.

N/A

Enable Controlled Tamper Recovery

Always allowed. This capability enables the HSM SO to require tamper events to be explicitly cleared before normal operations can resume.

Do Controlled Tamper Recovery

>ON (default): After a tamper event, the HSM SO must explicitly clear the tamper before the HSM can resume normal operations.

>OFF: The HSM must be restarted before it can resume normal operations.

See Tamper Events for more information.

Enable Partition Utilization Metrics

Always allowed. This capability enables the HSM SO to view (or export to a named file) counters that record how many times specific cryptographic operations have been performed in application partitions since the last counter-reset event. This provides a picture of operational utilization that can be used to guide the (re-)allocation and balancing of partitions and applications, for better service to all users of your partitions.

Allow Partition Utilization Metrics

>ON: The HSM SO can view Partition Utilization Metrics.

>OFF (default): Partition Utilization Metrics are not available.

See Partition Utilization Metrics for more information.

Enable Functionality Modules

This capability enables Functionality Modules (FMs) to be loaded to the HSM (see Functionality Modules).

>Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs).

>Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license.

Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.

Allow Functionality Modules

Destructive

>ON: With this policy enabled, Functionality Modules may be loaded to the HSM, permitting custom cryptographic operations. Allows use of the ctfm utility and FM-related commands, and the use of Functionality Modules in general with this HSM.

NOTE FIPS compliance requires that objects are never cloned or restored to an HSM using less secure firmware. FIPS 140 validation is performed against the HSM hardware with a specific firmware version.

Since the introduction of a Functionality Module changes the firmware, allowing FMs in the HSM removes the HSM from FIPS compliance.

For purposes of cloning, an HSM where FMs have ever been allowed is considered less secure than one where FMs have never been allowed. See the Caution below.

You can subsequently disable FMs, but future cloning operations will work only with other FM-HOC HSMs.

>OFF (default): FMs may not be loaded to the HSM.

CAUTION! Enabling FMs (HSM policy 50) introduces changes to Luna HSM functionality, some of which are permanent; they cannot be removed by disabling the policy. FM-enabled status is not reversible by Factory Reset. Refer to FM Deployment Constraints for details before enabling.

If you are using Crypto Command Center, ensure that your CCC version supports FM-enabled HSMs before you enable HSM policy 50. Refer to the CCC CRN for details.

Enable SMFS Auto Activation

This capability enables the Secure Memory File System (SMFS) to be activated automatically on startup.

>Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs).

>Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license.

Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.

Allow SMFS Auto Activation

Destructive

>ON: With this policy enabled, the Secure Memory File System (SMFS) is automatically activated on startup, providing a secure, tamper-enabled location in the HSM memory where Functionality Modules can load keys and parameters. Auto-activation for SMFS, like auto-activation for multifactor quorum-authenticated partitions in general, persists through a power outage of up to 2 hours duration.

>OFF (default): If disabled, the HSM SO must manually activate the SMFS each time the HSM reboots or loses power.

Allow Restricting FM Privilege Level

This capability enables the HSM SO to restrict the sensitive key attributes of partition objects from FMs.

>Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs).

>Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license.

Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.

Restrict FM Privilege Level

Destructive

>ON: FM privilege is restricted.

>OFF (default): FM privilege permits FMs to see the sensitive key attributes (including key values) of cryptographic objects on application partitions. This privilege is necessary for most FMs, so that the Crypto Officer (CO) and Crypto User (CU) roles can use partition objects with the FM. However, some FMs might not require this privilege and it can be restricted to satisfy some certification requirements (such as Common Criteria).

Allow Encrypting of Keys from FM to HSM

This capability enables key encryption between the FM and the Functionality Module Crypto Engine interface (FMCE).

>Allowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, with the FM capability license installed (see Preparing the Luna Network HSM 7 to Use FMs).

>Disallowed on FM-ready HSMs with Luna HSM Firmware 7.4.0 or newer, without the FM capability license.

Does not appear on HSMs that are not FM-ready or are running firmware older than Luna HSM Firmware 7.4.0.

Encrypt Keys Passing from FM to HSM

Destructive

>ON: With this policy enabled, keys created by an FM are encrypted before crossing from the FM to the Functionality Module Crypto Engine interface (FMCE). This internal encryption may be required to satisfy some certification requirements (such as Common Criteria).

>OFF (default): Keys are not encrypted before crossing to the FMCE.

Enable Restricted Restore

This capability allows the HSM SO to restrict a Luna Backup HSM 7 from being used with firmware older than Luna HSM Firmware 7.7.0, for any purpose other than to migrate cryptographic objects to Luna HSM Firmware 7.7.0 or newer. See V0 and V1 Partitions for more information.

Appears on Luna Backup HSM 7 running Luna Backup HSM 7 Firmware 7.7.1 or newer.

NOTE This capability/policy does not appear on Luna Network HSM 7. This setting is visible in LunaCM when the active slot is set to a Luna Backup HSM 7.

Enable Restricted Restore

ON-to-OFF Destructive

>1: Objects backed up from pre-7.7.0 firmware partitions can only be restored to V0 or V1 partitions (Luna HSM Firmware 7.7.0 or newer). Enable this policy to ensure FIPS compliance.

>0 (default): Objects backed up from pre-7.7.0 firmware partitions can be restored to pre-7.7.0 firmware partitions. Do not use this setting if you require FIPS compliance.

CAUTION! FIPS compliance requires that objects are never cloned or restored to an HSM using less secure firmware, and this includes restoring from Luna Backup HSM 7 firmware.

If you have backups already stored on the Luna Backup HSM 7 that were taken from pre-7.7.0 partitions, turning this policy ON will prevent you from restoring them to the same source partition. You must update the HSM containing the source partition to Luna HSM Firmware 7.7.0 or newer before restoring from backup.

Enable User Defined ECC Curves

Always 1 using Luna HSM Firmware 7.7.2 or newer. This capability allows the HSM SO to restrict or allow the use of user-defined ECC curves.

The state of the associated policy is preserved through firmware update.

Allow User Defined ECC Curves

Destructive

>ON (default using Luna HSM Firmware 7.7.2): User-defined ECC curves can be used, without restriction.

>OFF (default using Luna HSM Firmware 7.8.0 or newer): Named curves (that we have verified) can still be used, as can user-defined ECC curves where the named-curve parameters are provided. User-defined ECC curves that cannot map to built-in named curves during key-pair generation, public key creation, private key unwrapping, cloning or SKS, and key derivation, return the error ECC_CURVE_NOT_ALLOWED.

Named-curve samples are provided when you include the SDK option while installing Luna HSM Client. The files must be unmodified.

/usr/safenet/lunaclient/samples/ecc_examples

>bpP160r1.txt

>bpP512t1.txt

>x962_char2_163v1.txt

>bpP192r1.txt

>secp384r1.txt

>x962_char2_359V1.txt

>bpP224r1.txt

>bpP384R1.txt

>sm2p256v1.txt

NOTE For FIPS compliance, NIST requires us to make security claims with respect to the curves that we support.

It is impossible to test and report on all possible user-defined ECC curves. Therefore, commonly-used, named curves are explicitly tested, documented to comply with FIPS requirements, and allowed in FIPS 140 approved configuration (formerly FIPS mode).

Enable Sync with Host Time

Always 1 using Luna HSM Firmware 7.8.0 or newer. This capability enables the HSM SO to automatically synchronize the HSM's time to the host system time every 24 hours.

Allow Sync with Host Time

>ON: The HSM's time is synchronized to the host system time once every 24 hours.

The maximum drift that is allowed to be synchronized by this policy is 3 seconds. If the HSM time and the host time have drifted by more than 3 seconds in the last 24 hours, a log entry is created instead:

[HSM] LOG(INFO): Hsm clock(1647624503) drifts from host clock(1647628144) > threshold, stop sync clock!

[HSM] ALM2029: HSM clock drift allowed threshold exceeded

This applies to the first synchronization as well -- set the time manually using hsm time get and hsm time sync before setting this policy to ON. See also the System times block in the output of hsm show command.

As a best practice for on-premises HSMs, this policy should be on. As well, time should be synchronized after every HSM or host reboot, due to cloning protocol version 4 (CPv4) requiring close synchronization, and newer algorithms having tight timing tolerances as well.

>OFF (default): HSM time is not automatically synchronized to host time. The HSM SO can still synchronize the clocks manually.

Enable Unrestricted Metrics Access

Using Luna HSM Firmware 7.8.9 or newer, this capability enables collection of partition utilization metrics without the SO logged into the HSM.

Allow Unrestricted Metrics Access

>ON: Partition utilization metrics can be viewed, collected and reset without need for SO login.

>OFF(default): The HSM SO must log into the HSM before partition utilization metrics can be captured or reset.

See Partition Utilization Metrics for more information.

* The Backup HSM performs only backup and restore operations and is not a general-purpose HSM. It has no information about the origin of keys or objects. In the case of FIPS 140 approved configuration (formerly FIPS-mode) or non-FIPS the status of a source HSM (Policy 12) is not noticed, and a target HSM decides what to do with keys from a restore operation. However, the actions of a Backup HSM can be affected by the cloning protocol that is used - see Policy 55.



	SUPPORT	LEGAL
Luna Network HSM 7 Documentation © Copyright 2001-2026, Thales Group Last Updated: 2026-02-13 10:53:27 GMT-05:00	Customer Release Notes Customer Support Portal Support Contacts	End User License Agreement Third Party Software Licenses Document Information