Excrypt Manager
Perform the following steps to use Excrypt Manager to create an application partition:1
Go to the Application Partitions menu and select [ Add ].
2
In the Basic Information tab, configure all of the fields as follows:
| Option | Required configuration |
|---|---|
| Role Name | Specify a name for this new application partition that you would like to use. |
| Logins Required | Set to 1 If the HSM is in FIPS mode, set Logins Required to 2. The Futurex PKCS #11 library then logs in two identities. For details, see the next section. |
| Ports | Set to Prod. |
| Connection Sources | Set to Ethernet. |
| Managed Roles | Leave blank because you specify the exact Permissions, Key Slots, and Commands for this application partition or role to have access to. |
| Use Dual Factor | Set to Never. |
| Upgrade Permissions | Leave unchecked. |
3
In the Permissions tab, select the following key permissions:
| Permission | Description |
|---|---|
| Keys | Top-level permission |
| Authorized | Allows for keys that require login |
| Import PKI | Allows trusting an external PKI. Generally not recommended, but some applications use this option for PKI symmetric key wrapping. |
| No Usage Wrap | Enables interoperable key wrapping without defining key usage as part of the wrapped key. Use this only if you want to exchange keys with external entities or use the HSM to wrap externally used keys. |
4
In the Key Slots tab, we recommend creating a range of 1000 total keys that do not overlap with another application partition. Within the specified range, you should have ranges for both symmetric and asymmetric keys. If the application requires more keys, configure it accordingly.
5
To use the HSM functionality, you must enable particular functions on the application partition based on application requirements. Enable the following commands under Commands:PKCS #11 Communication Commands:
Key Operations Commands:
Data Encryption Commands:
Data Verification Commands:
| Command | Description |
|---|---|
| ECHO | Communication Test/Retrieve Version |
| GPKM | Retrieve key table information |
| GPKS | General purpose key settings get/change |
| HASH | Retrieve device serial |
| RAND | Generate random data |
| TIME | Set the HSM internal clock |
| Command | Description |
|---|---|
| GRSA | Generate RSA Private and Public Key |
| LRSA | Load key into RSA Key Table |
| Command | Description |
|---|---|
| GPSR | General purpose RSA encrypt/decrypt or sign/verify with recovery |
| Command | Description |
|---|---|
| GPSV | General purpose sign and verify |
FXCLI
Run the following role FXCLI commands to create the new application partition and enable all needed functions. Replace[role_name] with the name of the application partition and [first_slot] and [last_slot] with a key slot range that doesn’t overlap another application partition.
FXCLI
FXCLI
role modify, because role add ignores the --logins option for application partitions:
FXCLI
role get --name [role_name] and confirm the loginsRequired value, key slot range, and permissions.
FXCLI doesn’t set the Ports or Connection Sources of an application partition. A new application partition uses the Ethernet and Serial connection sources. To restrict it to Ethernet only, use Excrypt Manager.