SET OPTION

Set a device-global option.

Description

Set device-global options that affect general behavior. Each invocation of this command sets a single option, which is represented as a TAG-LENGTH-VALUE (TLV).

Shell Example

Turn off audit logging for Sign HMAC (command 53) and Verify HMAC (command 5c):

yubihsm> put option 0 command_audit 53005c00

Protocol Details

Command

Tc = 0x4f

Lc = 3 + Lo

Vc = TO

To := The TLV encoding of the selected option

Lo := The option-specific length in bytes

The options currently supported are the following:

TAG is 1 byte

LENGTH is 2 bytes

VALUE is Lo bytes

Tags:

Force audit

0x01

Command audit

0x03

Values:

OFF

0x00

Disabled

ON

0x01

Enabled

FIX

0x02

Enabled, not possible to turn off

There are two supported options, Force audit and Command audit.

With Force audit set, the device will refuse operations as long as the Log Store is full. It takes a 1 byte value option.

Command audit can be used to toggle whether a specific command should be logged, this takes tuples of command number and option value.

Response

Tr = 0xcf

Lr = 0

Vr = Ø