VCM features

Requesting VCM features

Features available within a VCM are provisioned for you by your service provider. For a list of the available features see Available optional features.

To request a feature be made available for your VCM you must generate a request message and send the request to your service provider.

If you are requesting a new VCM you can do this using the command hsmadmin vcm create and specifying the features you want in the --features option.

If you want to change the features for an existing VCM you can do this using the command hsmadmin vcm setproperties and specifying the features you want in the --features option.

The service provider will need to stop your VCM to apply the new features so you should put your VCM in maintenance mode as described at check and change the mode of operation. Once the service provider has applied the new features they will need to start the VCM. If you specified that the VCM requires authorization to start, see Restrict startup, you should create a start authorization message as described at Authorizing VCM start.

The --features option in the commands above specifies the features as a 32 bit word as described at Specification of features as a 32 bit word.

Built-in features

A number of features that were optional on earlier versions of firmware are now built in to the firmware and are always available for use regardless of whether they are requested or not. These are:

  • StandardKM

  • EllipticCurve

  • ECCMQV

  • AcceleratedECC

  • PostQuantum

Specifying, or not specifying, these features in any commands will have no effect on your ability to make use of these features.

Viewing VCM features

You can view the features that are available in your VCM using the command enquiry.

An example enquiry output would be:

features enabled     ForeignTokenOpen RemoteShare GeneralSEE KISAAlgorithms StandardKM EllipticCurve ECCMQV AcceleratedECC HSMSpeed2 PostQuantum

You can also view the features that are available in your VCM using the command fet --show-all but this command does not show the built-in StandardKM feature which has never been optional and has always been included in all firmware.

The fet command includes a number of options for reading and applying feature certificates. This functionality is no longer applicable within a VCM. It is not possible to order any feature certificates that can be applied within a VCM.