SET OPTION

T_o := The TLV encoding of the selected option

L_o := The option-specific length in bytes

The options currently supported are the following:

TAG is 1 byte

LENGTH is 2 bytes

VALUE is L_o bytes

Tags:

Values:

The defined options are as follows:

With Force audit set, the device will refuse operations as long as the Log Store is full. It takes a 1 byte value option.

Command audit can be used to toggle whether a specific command should be logged, this takes tuples of command number and option value.

Algorithm toggle allows the user to selectively disable individual algorithms for the whole device. This option can only be toggled on a freshly reset device, i.e. one with only the default Authentication Key. This takes a tuple of algorithm number and option value.

FIPS mode is only available on FIPS devices and can only be toggled on a freshly reset device, i.e. one with only the default Authentication Key present. It disables algorithms that are not allowed by FIPS 140. This step is required as part of setting the device in the approved mode of operation, together with deleting the default Authentication Key (see Section 3.2 of the YubiHSM FIPS Security Policy).