Anti brute-force attack for yubihsm2 session key

[lcmmhcc]

it seems there are only 16 sessions for user to attempt the password, and after that, the attacker need to wait for 30s ,is that right?