Thales · Futurex · SafeNet Luna · Utimaco · nCipher · Generic

HSM Command Console

Beta

A host-command client for hardware security modules. Connect to a real or simulated HSM, fire individual host commands, chain them into repeatable scenarios, and drive them under load — all over TCP/IP with optional TLS. Inside the app it is titled HSM Host Console.

Download Studio Browse the tabs

On this page

hsm-command-console · HSM Host Console - local · Thales payShield

Overview

The HSM Command Console acts as a client that talks to an HSM’s host interface. It packs your command payload with the vendor’s framing (length header, STX/ETX, etc.), sends it over the socket, and shows the raw request/response exchange. Point it at ISO8583Studio’s own HSM Simulator or at a physical device on your bench.

HSM Host Console - localhsm-command-console › ConsoleCONSOLE

ConsoleConsole

ScenarioScenario

Load TestLoad

LogsLogs

ConnectedThales payShield · 127.0.0.1:90902-byte lengthTLS offTimeout 30 s

Disconnect

Host Commands

Thales payShield · 41 commands

Search commands…

AllDiagnosticsKey ManagementPINMAC

NOHSM StatusDiagnostics

NCDiagnostic TestDiagnostics

A0Generate a KeyKey Management

A6Import a KeyKey Management

A8Export a KeyKey Management

BUGenerate Key Check ValueKey Management

CATranslate PIN: TPK → ZPKPIN Translation

DCVerify PIN (VISA PVV)PIN Verification

NPHSM StatusReturns buffer size, socket count, firmware and DSP status. No parameters.NP 00 · 0.9 ms

Clear

Send

Formatted Request146

Message Header........... = [0000]

Command Code............. = [NO] HSM Status Request

Mode Flag................ = [00] Status Info

Formatted Response400

Message Header........... = [0000]

Command Code............. = [NP] HSM Status Response

Error Code............... = [00] No error

I/O Buffer Size.......... = [3]

Ethernet Type............ = [1]

Number of TCP Sockets.... = [64]

Firmware number.......... = [1448-0001]

DSP fitted............... = [1]

DSP Firmware Version..... = [9100]

Raw Request (framed)10

0000NO00

LEN 00 08 · 8 B payload · 10 B on the wire

Raw Response (framed)28

0000NP0031641448-000119100

LEN 00 1A · 26 B payload · 28 B on the wire

hsm-command-console · Console — connected to Thales payShield at 127.0.0.1:9090 — the command list on the left and an NO / NP HSM Status exchange as formatted request and response

Multi-VendorThales payShield, Futurex, SafeNet Luna, Utimaco CryptoServer & Atalla, and nCipher nShield — each with the correct default port and framing.

Command ConsoleCompose host commands from the vendor’s command set, fill in fields, send, and read the decoded response.

Scenario BuilderChain commands into a named scenario (each step is a command code + field values) and replay it on demand.

Load TesterRun a scenario at a target rate with constant, ramp-up, spike, or burst patterns across concurrent connections.

TLS TransportOptional mutual TLS with configurable version, cipher suites, CA verification, and PKCS#12 client certificates.

Exchange LogEvery command and response is timestamped and captured in the Logs tab for review and export.

Runtime tabs

The console screen has four tabs. Each card links to the section that documents it.

Compose · Send · DecodeConsoleCompose and send individual host commands; read decoded responses.Read the section

Steps · PlaylistsScenarioBuild, save, and replay ordered command sequences.Read the section

Constant · Ramp · Spike · BurstLoad TestRun a scenario at a target rate and pattern across connections.Read the section

Timestamps · Bytes in / outLogsTimestamped exchange log with connection and byte counters.Read the section

01 · Configure

Quick Start

From a new configuration to the first decoded response:

Create a console configuration — From the Home screen open HSM Host Console and add a new configuration.
Pick your HSM vendor — In Connection Settings, choose the HSM Type. The port and framing default to that vendor (e.g. Thales payShield → port 1500, 2-byte binary length).
Set the address — Enter the HSM’s IP Address and Port, and a connection Timeout.
(Optional) Enable TLS — In SSL/TLS Configuration turn on TLS, choose the version and certificate-verification mode, and attach your CA / client certificate.
Launch and connect — Open the console and click Connect. The header dot turns green when the socket is up.
Send a command — In the Console tab select a command from the vendor set, fill its fields, and send. The response appears in the exchange log.

Tip

No physical HSM? Start the HSM Simulator as a server on the same machine and point the console at 127.0.0.1:1500 for a fully local key-management loop.

01 · Configure

Supported HSM Vendors

Selecting a vendor sets its default port and message framing automatically. All vendors are driven over the same socket client.

Vendor	Model family	Default Port	Framing
Thales payShield	payShield 9000 / 10K	`1500`	2-byte binary length
Futurex Excrypt	KMES Series 3	`2000`	2-byte binary length
SafeNet Luna	Thales Luna Network HSM	`1500`	2-byte binary length
Utimaco CryptoServer	Se / CP5	`3001`	2-byte binary length
nCipher nShield	Entrust nShield Connect / Solo	`9004`	4-byte ASCII length
Utimaco Atalla	Atalla AT1000	`7000`	STX / ETX framing
Generic HSM	Custom / other	`1500`	Configurable

01 · Configure

Connection Settings

The Connection Settings configuration tab defines the transport to the HSM.

HSM Host Console Configuration - localhsm-command-console › Connection SettingsCONSOLE

Connection SettingsConnectionSSL/TLS ConfigurationSSL/TLSLoad Test SettingsLoad

Console Identity

Name

HSM Host Console - local

Description

Optional description

Network

IP Address

127.0.0.1

Port

9090

Timeout (s)

Port overridden — the Thales payShield default is 1500

HSM Type

Select the vendor — its default port and framing follow

Thales payShield:1500

Futurex Excrypt:2000

SafeNet Luna:1500

Utimaco CryptoServer:3001

nCipher nShield:9004

Utimaco Atalla:7000

Generic HSM:1500

TCP Length Header2-byte binary length prefix, big-endian

Save Configuration

Launch Console

hsm-command-console · Connection Settings — the console named HSM Host Console - local, HSM type Thales payShield, 127.0.0.1:9090, a 30 second timeout and the TCP length header enabled

Setting	Description
IP Address	HSM host interface address. Default `127.0.0.1`.
Port	TCP port; auto-filled from the selected vendor (e.g. `1500` for Thales).
Timeout	Connection / response timeout in seconds. Default `30`.
Name & Description	Identifiers for the saved configuration.

01 · Configure

Message Framing

HSMs delimit messages differently. The console supports the common framing schemes; the correct one is selected when you pick a vendor, and can be overridden.

HSM Host Console Configuration - localhsm-command-console › Message FramingCONSOLE

Connection SettingsConnectionSSL/TLS ConfigurationSSL/TLSLoad Test SettingsLoad

Message Framing

TCP Length Header EnabledPrefix every message with its length

Header Format

2-byte Binary LengthTwo-byte big-endian length prefixThales · Futurex · Luna · Utimaco

4-byte ASCII LengthFour ASCII digits of lengthnCipher nShield

STX / ETX FramingStart / end control bytes bracket the messageUtimaco Atalla

No Header / FramingRaw payload, no length prefix—

Custom HeaderUser-defined header / trailer bytes—

Message Header (hex)

0000

Message Trailer (hex)

optional

Message Header Length

Frame Preview

NO · HSM Status

How the console puts the command on the wire

Length00 082 BHeader30 30 30 300000Command4E 4F 30 30NO00Trailer··none

00 08 30 30 30 30 4E 4F 30 30

Payload 8 BOn the wire 10 BBig-endian

Save

hsm-command-console · Message Framing — TCP length header enabled, header format 2-byte binary length, message header 0000, empty trailer and message header length 4 — with the framed NO command previewed byte by byte

Header Format	Description
`2-byte Binary Length`	Two-byte big-endian length prefix. Used by Thales, Futurex, Luna, Utimaco.
`4-byte ASCII Length`	Four ASCII digits of length. Used by nCipher nShield.
`STX / ETX Framing`	Start/end control bytes bracket the message. Used by Utimaco Atalla.
`No Header / Framing`	Raw payload with no length prefix.
`Custom Header`	User-defined header / trailer bytes.

Additional framing fields: TCP Length Header Enabled toggle, Message Header (hex, e.g. 0000), Message Trailer (hex, optional), and Message Header Length.

01 · Configure

SSL / TLS Configuration

Enable encrypted transport to the HSM in the SSL/TLS Configuration tab.

HSM Host Console Configuration - localhsm-command-console › SSL/TLS ConfigurationCONSOLE

Connection SettingsConnectionSSL/TLS ConfigurationSSL/TLSLoad Test SettingsLoad

SSL/TLS Configuration

Enable SSL/TLSEncrypt the socket to the HSM host interface

TLS Version

TLS 1.0TLS 1.1TLS 1.2TLS 1.3

Certificate Type

PKCS#12 bundle (.p12 / .pfx)

Certificate Verification

No Verification

Trust All Certificates

CA-Signed Only

Custom CA Authority

Key Material

CA Authority

certs/hsm-root-ca.pem

Client Certificate

Not set

Client Private Key

Not set

Keystore Password

Not set

Handshake OK · TLS 1.2 · TLS_AES_256_GCM_SHA384 · 41 msTest the handshake before saving

Test Handshake

Save

hsm-command-console · SSL/TLS Configuration — encryption enabled, TLS 1.2, a PKCS#12 bundle, CA-signed-only verification, and empty client certificate, private key and keystore password fields

HSM Host Console Configuration - localhsm-command-console › Cipher SuitesCONSOLE

Connection SettingsConnectionSSL/TLS ConfigurationSSL/TLSLoad Test SettingsLoad

Cipher Suites

2 selected

Offered in the ClientHello, strongest first — the defaults cover TLS 1.3 and TLS 1.2 endpoints

TLS_AES_256_GCM_SHA384TLS 1.3Strong

TLS_AES_128_GCM_SHA256TLS 1.3Strong

TLS_CHACHA20_POLY1305_SHA256TLS 1.3Strong

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384TLS 1.2Strong

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384TLS 1.2Strong

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256TLS 1.2Strong

TLS_RSA_WITH_AES_256_CBC_SHA256TLS 1.2Medium

TLS_RSA_WITH_AES_128_CBC_SHATLS 1.2Weak

TLS_RSA_WITH_3DES_EDE_CBC_SHATLS 1.2Weak

Weak suites are listed for legacy devices only

Use Defaults

Save

hsm-command-console · Cipher Suites — cipher suites — TLS_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 selected, each entry labelled with its strength

Setting	Options
TLS Version	TLS 1.2 (default), TLS 1.3, and earlier where required.
Certificate Verification	No Verification, Trust All Certificates, CA-Signed Only, Custom CA Authority.
Certificate Type	PKCS#12 client certificate with key-store password.
Cipher Suites	Selectable set, defaulting to `TLS_AES_256_GCM_SHA384` and `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`.
Key material	CA authority path, client public certificate, client private key.

02 · Run

Command Console Tab

The Console tab is the interactive workspace. Pick a host command from the active vendor’s command set, populate its parameter fields, and send it. The request and the decoded response are appended to the exchange log with response codes and timing.

HSM Host Console - localhsm-command-console › ConsoleCONSOLE

ConsoleConsole

ScenarioScenario

Load TestLoad

LogsLogs

ConnectedThales payShield · 127.0.0.1:90902-byte lengthTLS offTimeout 30 s

Disconnect

Host Commands

Thales payShield · 41 commands

Search commands…

AllDiagnosticsKey ManagementPINMAC

NOHSM StatusDiagnostics

NCDiagnostic TestDiagnostics

A0Generate a KeyKey Management

A6Import a KeyKey Management

A8Export a KeyKey Management

BUGenerate Key Check ValueKey Management

CATranslate PIN: TPK → ZPKPIN Translation

DCVerify PIN (VISA PVV)PIN Verification

M0Encrypt Data BlockData Encryption

M6Generate MACMAC

A1Generate a KeyKey ManagementGenerates a random key under the LMK — as a variant or a key block — and optionally under a ZMK for transport.

Parameters

6 fields

Mode

0 — Generate key

Key Type

001 — ZPK

Key Scheme (LMK)

S — Key block

LMK Identifier

Algorithm

T — TDES

Exportability

E — Exportable

Wire Format:

0000A0 · mode 0 · type 001 · scheme S · LMK 03 · T B 00 E → 0000A1 00 [key-block] [KCV]

Send A0

Response

A1 00 · 1.4 ms

ResponseHeader : 0000 Response Code : A1 (command A0 → A1) Error Code : 00 ✓ Success — no error

✓ Key generated under LMK 03 as a TDES key block

Key (LMK) : S10096P0TB00E0003F848254F8A0EF52C1E84EC76DF320A50FC0ABCCF957313CE847316A3D8050901CFA2513F2117BDC1

Key Check Value : 37F0B3

Header decoded : v1 · P0 PIN encryption · TDES · mode B · KVN 00 · exportable

Raw Wire Response

0000A100S10096P0TB00E0003F848254F8A0EF52C1E84EC76DF320A50FC0ABCCF957313CE847316A3D8050901CFA2513F2117BDC137F0B3

Response will appear here after sending

hsm-command-console · Console — A0 Generate a Key selected, its parameter fields filled in for a TDES key block, and the response panel showing the decoded key block and its check value

Vendor command set — the available commands follow the selected HSM vendor (for Thales, the full payShield host-command set).
Field editor — each command exposes its parameters as labelled inputs so you don’t hand-assemble the payload.
Send & inspect — responses are shown raw and parsed; errors surface the HSM’s response/error code.

02 · Run

Scenario Builder Tab

A scenario is an ordered list of command steps — each step captures a commandCode and its field values. Build a sequence (for example: generate a key, export it under a ZMK, then translate a PIN block), name it, and save it into the configuration for reuse.

HSM Host Console - localhsm-command-console › ScenarioCONSOLE

ConsoleConsole

ScenarioScenario

Load TestLoad

LogsLogs

Scenarios3 saved · 1 playlist

Generate + import ZPK2 steps · A0 → A6

PIN translate TPK → ZPK3 steps · A0 → CA → DC

Key check loop2 steps · A0 → BU

Playlists

Nightly smokeNO · Generate + import ZPK · auto-advance

Scenario name

Generate + import ZPK

Add Step

Run Scenario

Save

Steps

2 steps

A0Generate a KeyMode: 1Key Type: 001Scheme: UZMK: U5AA6F287…A1 00 · 1.2 ms

A6Import a KeyKey Type: 001Scheme: UZMK: U5AA6F287…Key under ZMK: [1][A0][KEY]A7 00 · 1.1 ms

Scenario passed · 2 / 2 steps2.3 ms total

[1][A0][KEY] — step 1 · command A0 · response field KEY. Values from earlier steps feed later ones.

Add a step — each step is a command code plus its field values

hsm-command-console · Scenario — a two-step flow — A0 Generate a Key then A6 Import a Key — where the import step references the generated key as [1][A0][KEY]

Steps — add, reorder, and edit command steps; values from earlier steps can feed later ones.
Saved scenarios — persisted with the configuration and available to both the console and the load tester.
Playlists — group custom text, single commands, and whole scenarios into a runnable playlist with optional auto-advance.

02 · Run

Load Testing Tab

Drive a saved scenario against the HSM to measure throughput and stability. Configure it in the Load Test Settings tab and run it from the Load Test tab.

HSM Host Console - localhsm-command-console › Load TestCONSOLE

ConsoleConsole

ScenarioScenario

Load TestLoad

LogsLogs

Playlist / Scenario

NO HSM Status

Connections

Commands / s

Duration (s)

Pattern

Constant Rate

Start Load Test

Complete10.0 s / 10 s

96Sent

96Received

96Successes

0Failures

0.9 msAvg Latency

9.6TPS

100%Success Rate

Throughput

target 10 / s

hsm-command-console · Load Test — results for an NO HSM Status playlist — 96 sent, 96 received, 96 successes, 0 failures, 0.9 ms average latency and 9.6 tps at a 100% success rate

Parameter	Description	Default
Concurrent Connections	Parallel sockets driving the load.	`1`
Commands / second	Target command rate.	`10`
Duration	Test length in seconds.	`60`
Pattern	Constant Rate, Ramp Up, Spike Test, or Burst Pattern.	Constant

02 · Run

Logs Tab

The Logs tab streams every exchange — request, response, connection events — with timestamps. Clear the buffer, and see live connection count and byte counters. Global logging can be toggled in app settings.

HSM Host Console - localhsm-command-console › LogsCONSOLE

ConsoleConsole

ScenarioScenario

Load TestLoad

LogsLogs

Logs

Connections 1Bytes in 28Bytes out 10

Filter

Auto

[22:14:02.118]INFO: Connecting to 127.0.0.1:9090 (Thales payShield · 2-byte binary length)…

[22:14:02.131]INFO: Connected · socket #1 · TLS off · timeout 30 s

[22:14:05.402]HSM: ▸ CMD NO → 0000NO00 (10 B on the wire)

[22:14:05.403]HSM: ◂ RSP NP ← 0000NP0031641448-000119100 (28 B · 0.9 ms)

Formatted RequestFormatted ResponseRaw HexParsed

REQ 00 08 | 30 30 30 30 4E 4F 30 30

RSP 00 1A | 30 30 30 30 4E 50 30 30 33 31 36 34 31 34 34 38 2D

30 30 30 31 31 39 31 30 30

[22:14:05.403]INFO: AuditEntry(timestamp=2026-09-21T22:14:05.403, entryType=HOST_COMMAND, command=NO, response=NP, errorCode=00, latencyMs=0.9, result=SUCCESS)

[22:14:09.870]INFO: Idle · keep-alive sent

› waiting for traffic

Entries: 6/6Global logging: ONAuto-scroll: ON

hsm-command-console · Logs — connection events and a Thales exchange expanded into its formatted request, formatted response, raw hex and parsed views

03 · Reference

Tabs Reference

Inside the app the console is titled HSM Host Console and exposes four runtime tabs.

Tab	Purpose
Console	Compose and send individual host commands; read decoded responses.
Scenario	Build, save, and replay ordered command sequences.
Load Test	Run a scenario at a target rate and pattern across connections.
Logs	Timestamped exchange log with connection and byte counters.

Related

Pair this with the HSM Simulator (the server side) for a complete, self-contained key-management test rig.

Run it against your own HSM

Free and open source. Download the studio, start the HSM Simulator as a server and point the console at 127.0.0.1:1500 in minutes.

Download Studio HSM Simulator guide

✦ Pro

Testing with a team, or certifying with a scheme? Pro raises the CPS ceiling, unlocks the full algorithm set and deep simulator tweaks, plus hosted endpoints and priority support.