> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an application partition

> Procedure to create an application partition for key and permission isolation.

To segregate applications on the HSM, you must create an application partition specifically for your use case. Application partitions segment the permissions and keys between applications on an HSM.

Choose one of the following methods to create an application partition:

## Excrypt Manager

Perform the following steps to create an application partition by using Excrypt Manager

<Steps>
  <Step>
    Go to the **Application Partitions** menu and select **\[ Add ]**.
  </Step>

  <Step>
    In the **Basic Information** tab, configure all of the fields as follows:

    <table>
      <thead>
        <tr>
          <th><em><strong>Option</strong></em></th>
          <th><em><strong>Required configuration</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Role Name</strong></td>
          <td>Specify any name that you would like for this new application partition.</td>
        </tr>

        <tr>
          <td><strong>Logins Required </strong></td>
          <td>Set to <strong>1</strong><Note>If the HSM is in FIPS mode, set Logins Required to <strong>2</strong>. The Futurex PKCS #11 library then logs in two identities. For details, see the next section.<br /></Note></td>
        </tr>

        <tr>
          <td><strong>Ports</strong></td>
          <td>Set to <strong>Prod.</strong></td>
        </tr>

        <tr>
          <td><strong>Connection Sources</strong></td>
          <td>Set to <strong>Ethernet</strong>.</td>
        </tr>

        <tr>
          <td><strong>Managed Roles</strong></td>
          <td>Leave blank because you specify the exact <strong>Permissions</strong>, <strong>Key Slots</strong>, and <strong>Commands</strong> for this application partition or role to have access to.</td>
        </tr>

        <tr>
          <td><strong>Use Dual Factor</strong></td>
          <td>Set to <strong>Never</strong>.</td>
        </tr>

        <tr>
          <td><strong>Upgrade Permissions</strong></td>
          <td>Leave unchecked.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    In the **Permissions** tab, select the following **key** permissions:

    <table>
      <thead>
        <tr>
          <th><em><strong>Permission</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Keys</strong></td>
          <td>Top-level permission</td>
        </tr>

        <tr>
          <td><strong>Authorized</strong></td>
          <td>Allows for keys that require login</td>
        </tr>

        <tr>
          <td><strong>Import</strong> <strong>PKI</strong> </td>
          <td>Allows trusting an external PKI. Generally not recommended, but some applications use this option for PKI symmetric key wrapping.</td>
        </tr>

        <tr>
          <td><strong>No</strong> <strong>Usage</strong> <strong>Wrap</strong> </td>
          <td>Enables interoperable key wrapping without defining key usage as part of the wrapped key. Use this only if you want to exchange keys with external entities or use the HSM to wrap externally used keys.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    In the **Key Slots** tab, Futurex recommends you create a range of 1000 keys that do not overlap with another application partition. Within the specified range, you should have ranges for both symmetric and asymmetric keys. If the application requires more keys, configure it accordingly.
  </Step>

  <Step>
    To use the HSM functionality, you must enable particular functions on the application partition based on application requirements. Enable the following commands under **Commands**:

    **PKCS #11 communication commands**:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>ECHO</strong></td>
          <td>Communication Test/Retrieve Version</td>
        </tr>

        <tr>
          <td><strong>GPKM</strong></td>
          <td>Retrieve key table information</td>
        </tr>

        <tr>
          <td><strong>GPKS</strong></td>
          <td>General-purpose key settings get/change</td>
        </tr>

        <tr>
          <td><strong>HASH</strong></td>
          <td>Retrieve device serial</td>
        </tr>

        <tr>
          <td><strong>RAND</strong></td>
          <td>Generate random data</td>
        </tr>

        <tr>
          <td><strong>TIME</strong></td>
          <td>Set Time</td>
        </tr>
      </tbody>
    </table>

    **Key operations commands**:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>GRSA</strong></td>
          <td>Generate RSA Private and Public Key</td>
        </tr>

        <tr>
          <td><strong>GPSR</strong></td>
          <td>General-purpose RSA Operations</td>
        </tr>

        <tr>
          <td><strong>LRSA</strong></td>
          <td>Load key into RSA Key Table</td>
        </tr>
      </tbody>
    </table>
  </Step>
</Steps>

## FXCLI

Run the following **role** FXCLI commands to create the new application partition and enable all needed functions. Replace `[role_name]` with the name of the application partition and `[first_slot]` and `[last_slot]` with a key slot range that doesn't overlap another application partition.

```shell title="FXCLI" wrap theme={null}
role add --name [role_name] --application --key-range ([first_slot],[last_slot]) --perm "Keys:Authorized" --perm "Keys:Import PKI" --perm "Keys:No Usage Wrap"
```

```shell title="FXCLI" wrap theme={null}
role modify --name [role_name] --add-perm Excrypt:ECHO --add-perm Excrypt:GPKM --add-perm Excrypt:GPKS --add-perm Excrypt:HASH --add-perm Excrypt:RAND --add-perm Excrypt:TIME --add-perm Excrypt:GRSA --add-perm Excrypt:GPSR --add-perm Excrypt:LRSA
```

If the HSM is in FIPS mode, also set the number of logins that the application partition requires to 2. Set it with `role modify`, because `role add` ignores the `--logins` option for application partitions:

```shell title="FXCLI" theme={null}
role modify --name [role_name] --logins 2
```

To verify the application partition, run `role get --name [role_name]` and confirm the `loginsRequired` value, key slot range, and permissions.

<Note>
  FXCLI doesn't set the **Ports** or **Connection Sources** of an application partition. A new application partition uses the **Ethernet** and **Serial** connection sources. To restrict it to **Ethernet** only, use Excrypt Manager.
</Note>