Excrypt Manager
In the Basic Information tab, configure all of the fields as follows:
| Option | Required configuration |
|---|---|
| Role Name | Specify any name that you would like for this new application partition. |
| Logins Required | Set to 1 If the HSM is in FIPS mode, you must set Logins Required to 2. |
| Ports | Set to Prod. |
| Connection Sources | Set to Ethernet. |
| Managed Roles | Leave blank because you specify the exact Permissions, Key Slots, and Commands for this application partition or role to have access to. |
| Use Dual Factor | Set to Never. |
| Upgrade Permissions | Leave unchecked. |
In the Permissions tab, select the following key permissions:
| Permission | Description |
|---|---|
| Keys | Top-level permission |
| Authorized | Allows for keys that require login |
| No Usage Wrap | Enables interoperable key wrapping without defining key usage as part of the wrapped key. Use this only if you want to exchange keys with external entities or use the HSM to wrap externally used keys. |
In the Key Slots tab, we recommend you create a range of 1000 total keys that do not overlap with another application partition. Within the specified range, you should have ranges for both symmetric and asymmetric keys. If the application requires more keys, configure it accordingly.
Based on application requirements, enable specific functions on the application partition to use the HSM functionality. You can enable the following commands according to your use case in the Commands tab.PKCS #11 Communication commands:
Key Operations commands:
Data encryption commands:
Signing commands:
| Command | Description |
|---|---|
| ECHO | Communication Test/Retrieve Version |
| HASH | Retrieve device serial |
| GPKM | Retrieve key table information |
| GPKS | General-purpose key settings get/change |
| TIME | Retrieve HSM time |
| Command | Description |
|---|---|
| APFP | Generate PKI Public Key from Private Key |
| ASYL | Load asymmetric key into key table |
| GECC | Generate an ECC Key Pair |
| GPCA | General-purpose add certificate to key table |
| GRSA | Generate RSA Key |
| RSAR | Generate PKCS #10 Certificate Request |
| LRSA | Load RSA Key into Key Table |
| Command | Description |
|---|---|
| GPSR | General Purpose RSA Operations |
| Command | Description |
|---|---|
| ASYS | Generate a Signature by using a PKI Private Key |