Skip to main content
To segregate applications on the HSM, you must create an application partition specifically for your use case. Application partitions segment the permissions and keys between applications on an HSM. Choose one of the following methods to create an application partition:

​
Excrypt Manager

Perform the following steps on Excrypt Manager to create an application partition:
1
Go to the Application Partitions menu and select [ Add ].
2
In the Basic Information tab, configure all of the fields as follows:
OptionRequired configuration
Role NameSpecify any name that you would like for this new application partition.
Logins Required Set to 1
If the HSM is in FIPS mode, set Logins Required to 2. The Futurex PKCS #11 library then logs in two identities. For details, see the next section.
PortsSet to Prod.
Connection SourcesSet to Ethernet.
Managed RolesLeave blank because you specify the exact Permissions, Key Slots, and Commands for this application partition or role to have access to.
Use Dual FactorSet to Never.
Upgrade PermissionsLeave unchecked.
3
In the Permissions tab, select the following key permissions:
PermissionDescription
KeysTop-level permission
AuthorizedAllows for keys that require login
Import PKI Allows trusting an external PKI. Generally not recommended, but some applications use this option for PKI symmetric key wrapping.
No Usage Wrap Enables interoperable key wrapping without defining key usage as part of the wrapped key. Use this only if you want to exchange keys with external entities or use the HSM to wrap externally used keys.
4
In the Key Slots tab, Futurex recommends you create a range of 1000 total keys that do not overlap with another application partition. Within the specified range, you should have ranges for both symmetric and asymmetric keys. If the application requires more keys, configure it accordingly.
5
To use the HSM functionality, you must enable particular functions on the application partition based on application requirements. Enable the following commands under Commands:PKCS #11 Communication Commands:
CommandDescription
ECHOCommunication Test/Retrieve Version
PRMDRetrieve HSM restrictions
RANDGenerate random data
HASHRetrieve device serial
GPKMRetrieve key table information
GPKSGeneral-purpose key settings get/change
GPKRGeneral-purpose key settings get (read-only)
Key Operations Commands:
CommandDescription
APFPGenerate PKI Public Key from Private Key
ASYLLoad asymmetric key into key table
GECCGenerate an ECC Key Pair
GPCAGeneral-purpose add certificate to key table
GPGSGeneral-purpose generate symmetric key
GPKAGeneral-purpose key add
GPKDGeneral-purpose key slot delete/clear
GRSAGenerate RSA Private and Public Key
LRSALoad key into RSA Key Table
RPFPGet public components from RSA private key
Interoperable Key Wrapping:
CommandDescription
GPKUGeneral-purpose key unwrap (unrestricted)
GPUKGeneral-purpose key unwrap (preserves key usage)
GPKWGeneral-purpose key wrap (unrestricted)
GPWKGeneral-purpose key wrap (preserves key usage)
Data Encryption Commands:
CommandDescription
ADPKPKI Decrypt Trusted Public Key
GHSHGenerate a Hash (Message Digest)
Starting in firmware version 7.x, this function is enabled by default and does not need to be specified.
GPEDGeneral-purpose symmetric encrypt and decrypt (used by default)
GPSEGeneral-purpose Symmetric Encrypt (used when GPED-EXPAND is YES)
GPSDGeneral-purpose Symmetric Decrypt (used when GPED-EXPAND is YES)
GPGCGeneral-purpose generate cryptogram from key slot
GPMCGeneral-purpose MAC (Message Authentication Code)
GPSRGeneral-purpose RSA encrypt/decrypt or sign/verify with recovery
HMACGenerate a hash-based message authentication code
RDPKGet Clear Public Key from Cryptogram
Signing Commands:
CommandDescription
ASYSGenerate a signature using a PKI private key
ASYVVerify a signature using a public key
GPSVGeneral-purpose data sign and verify
RSASGenerate a Ssgnature using a RSA private key

​
FXCLI

Run the following role FXCLI commands to create the new application partition and enable all needed functions. Replace [role_name] with the name of the application partition and [first_slot] and [last_slot] with a key slot range that doesn’t overlap another application partition.
FXCLI
FXCLI
On firmware 7.x, every role has GHSH enabled by default, so the command doesn’t include it. Adding Excrypt:GHSH causes the whole command to fail with Invalid permission 'Excrypt:GHSH'.
If the HSM is in FIPS mode, also set the number of logins that the application partition requires to 2. Set it with role modify, because role add ignores the --logins option for application partitions:
FXCLI
To verify the application partition, run role get --name [role_name] and confirm the loginsRequired value, key slot range, and permissions.
FXCLI doesn’t set the Ports or Connection Sources of an application partition. A new application partition uses the Ethernet and Serial connection sources. To restrict it to Ethernet only, use Excrypt Manager.