Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

For this step, you need to log in with an identity that has a role with the following permissions: Role:Add, Role:Assign All Permissions, Role:Modify, Keys:All Slots, and Command Settings:Excrypt. You can use the default Administrator role and Admin identities.
This integration guide treats the terms application partition and role as synonymous.
Before logging in to the HSM with an authenticated user, an application connects through a transaction processing connection to the transaction processing application partition. Therefore, you must take steps to configure the following items to harden this partition:
  • It should not have access to the All Slots permissions.
  • It should not have access to any key slots.
  • Enable only the PKCS #11 communication commands.
Choose one of the following methods to configure the transaction processing connection:

​
Excrypt Manager

Perform the following steps to configure a transaction processing connection on Excrypt Manager:
1
Go to the Application Partitions menu, select the transaction processing application partition, and select [ Modify ].
2
In the Permissions tab, leave the top-level Keys permission checked and uncheck the All Slots sub permission.
3
In the Key Slots tab, ensure that the settings do not specify key ranges. By default, the transaction processing application partition can access the entire range of key slots on the HSM.
4
In the Commands tab, make sure to enable only the following PKCS #11 Communication commands:
CommandDescription
ASYSGenerate signature using PKI private key
ECHOCommunication Test/Retrieve Version
GPKMRetrieve key table information
GPKRGeneral-purpose key settings get (read-only)
GPKSGeneral-purpose key settings get/change
HASHRetrieve device serial
PRMDRetrieve HSM restrictions
RANDGenerate random data
STATHSM statistics
TIMESet time

​
FXCLI

Run the following role modify FXCLI commands to remove all permissions and key ranges that are currently assigned to the Transaction Processing role and enable only the PKCS #11 Communication commands:
Because the Transaction Processing role was previously called the Anonymous role, the following commands specify Anonymous in the name field.
FXCLI
  role modify --name Anonymous --clear-perms --clear-key-ranges
FXCLI
  role modify --name Anonymous --add-perm "Keys" --add-perm Excrypt:ASYS --add-perm Excrypt:ECHO --add-perm Excrypt:GPKM --add-perm Excrypt:GPKR --add-perm Excrypt:GPKS --add-perm Excrypt:HASH --add-perm Excrypt:PRMD --add-perm Excrypt:RAND --add-perm Excrypt:STAT --add-perm Excrypt:TIME