SET OPTION Command

Set a device-global option.

Description

Set device-global options that affect general behavior. Each invocation of this command sets a single option, which is represented as a TAG-LENGTH-VALUE (TLV).

Shell Example

Turn off audit logging for Sign HMAC (command 53) and Verify HMAC (command 5c):

yubihsm> put option 0 command_audit 53005c00

Protocol Details

Command

Tc = 0x4f
Lc = 3 + Lo
Vc = TO

Parameters:

To := The TLV encoding of the selected option

Lo := The option-specific length in bytes

The options currently supported are the following:

TAG is 1 byte

LENGTH is 2 bytes

VALUE is Lo bytes

Tags:

Force audit 0x01
Command audit 0x03

Values:

OFF 0x00 Disabled
ON 0x01 Enabled
FIX 0x02
Enabled, only possible to turn off through factory
reset

There are two supported options, Force audit and Command audit.

With Force audit set, the device will refuse operations as long as the Log Store is full. It takes a 1 byte value option.

Command audit can be used to toggle whether a specific command should be logged, this takes tuples of command number and option value.

Response

Tr = 0xcf
Lr = 0
Vr = Ø