[4.27] - April 11, 2024

Fortanix Data Security Manager (DSM) 4.27 comes with some exciting new features, improvements, and resolved issues.

This release is superseded by the July 12, 2024, release.

WARNING

• You are required to upgrade Fortanix DSM to version 4.19 or 4.23 before upgrading to version 4.27. If you want to upgrade to 4.27 from an earlier version, please reach out to the Fortanix Support team.

• Downgrade from 4.27 to any version before 4.23 is not supported due to the Kubernetes version upgrade. Please reach out to Fortanix Support for downgrading to version 4.23.

NOTE

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 4.13 or later, then the HSM gateway version must also be 4.13 or later. Similarly, if the HSM Gateway version is 4.13 or later, then your Fortanix DSM version must be 4.13 or later.

• In the 4.27 release, performance will slightly decrease for certain cryptographic operations. Fortanix is investigating this.

1. New Features

1. Added support to verify the client certificate revocation status when using Trusted CA as the application (app) authentication method. (JIRA: PM-176).
   When adding a new app with Trusted CA as the app authentication method, the Certificate Revocation List (CRL) status of the client certificate used to authenticate the app connection can now be configured by the user by selecting the check box labeled Verify client certificate revocation status.
   For more details, refer to User's Guide: Authentication.

2. Added ML-KEM Kyber Crystal algorithm support in DSM (JIRA: PM-1).
   With this feature, a user can now select ML-KEM as a post-quantum cryptography method when generating a new security object.
   For more details, refer to User's Guide: Fortanix Data Security Manager Key Lifecycle Management.

2. Enhancements to Existing Features

• Removed the toggle to enable or disable the System Administration accounts (JIRA: ES-285).

  A system administrator cannot disable an account using the Enable or Disable toggle on the System Administration → Accounts page anymore.

  

• For security objects in an Azure Key Vault-backed DSM group that have audit logging enabled, DSM now logs the following new events (JIRA: PM-143):

  • The security object is soft-deleted.

  • The security object is recovered within the grace period after having been soft-deleted.

  • The corresponding Azure Key Vault entry is soft-deleted or recovered on key sync.

  • The security object is rotated on a rotation policy schedule.

  • The security object is copied.

  • Enabled audit logs for ScheduleDelete and CancelDelete APIs (JIRA: PROD-8251).

• Added support for rotating a linked key with an AWS policy set up in DSM; the updated key version will now align with the same AWS policy. (JIRA: ES-265).

3. Other Improvements

• Improved the transition of redundant Fortanix DSM FIPS nodes (JIRA: PM-203).

• I added the ability to downgrade the kernel in Fortanix DSM (JIRA: DEVOPS-4510).

• Increased the timeout in the/opt/fortanix/sdkms/bin/dsm_manual_cassandra_backup.sh script file (JIRA: DEVOPS-4583).

• Updated the Cassandra DC labeling script to display the number of nodes per label before applying the labeling and to perform a request seamlessly on a live cluster (JIRA: DEVOPS-4609).

• Packaged FX2200 series 2 new BMC firmware version 12.72.02 as part of the Fortanix DSM installer (JIRA: DEVOPS-4634).

• I removed the Intel Windows Launch Enclaves from the directorycommon/libsenclave-runner/le in the Fortanix DSM container (JIRA: PROD-8279).

• Added support to remove old DSM restore scripts from /opt/fortanix/sdkms/bin directory (JIRA: DEVOPS-4610).

4. Client Improvements

• Added support for security object name attribute deletion using KMIP (JIRA: PROD-8230).

  • Replace the name with a placeholder value that is significant only to the KMIP proxy.

  • Added logic to treat it as a security object with no name.

• Fixed an issue where the KMIP client should be able to preserve the activation date of a security object set in the past (JIRA: PROD-7972).

• The DSM JCE Provider Client (unbundled) artifacts are now distributed through the Maven repository (JIRA: PM-235).For more details, refer to the DSM JCE Client Downloads.

5. DSM Accelerator Improvements

• DSM Accelerator Webservice

  • Added HMAC support for the DSM Accelerator Webservice (JIRA: PM-244). For more details, refer to the Developer's Guide: DSM Accelerator Web Service.

• DSM Accelerator JCE Provider

  • Added HMAC support for DSM Accelerator JCE Provider (JIRA: PM-244). For more details, refer to the Developer’s Guide: DSM Accelerator JCE Provider.

• DSM Accelerator PKCS#11

  • Added HMAC support for DSM Accelerator PKCS#11 (JIRA: PM-244). For more details, refer to the Developer’s Guide: DSM Accelerator PKCS#11.

6. Quality Enhancements

• Upgraded the Fortanix DSM kernel to the 5.4 latest version (JIRA: DEVOPS-4626).

7. Bug Fixes

• Fixed an issue where choosing RAW for decryption did not enable RAW decrypt to work as intended when setting up a Fortanix DSM account or group-level cryptographic policy. (JIRA: ES-253).

• Fixed an issue caused by when invalid cert_lifetime or serial_bits parameters were passed to csr:sign() or TbsCertificate.new()(JIRA: PROD-8208).

• Fixed an issue where the Retention period for audit logs configuration had conflicting functionality using the Fortanix DSM user interface (UI) and APIs (JIRA: ES-325).

8. Known Issues

• API returns a “400 status code and response error” if its short-term access token expires during the synchronization of a group linked to AWS KMS (JIRA: PROD-3903).
  Workaround: Increase the timeout of the temporary session token beyond the expected duration of the sync key operation.

• excludedoes not work in theproxy configuration for operations such as attestation (JIRA: PROD: 3311).

• Rotating a GCP BYOK key to a pre-existing Fortanix DSM-hosted key (Rotate to DSM key) is not supported (JIRA: PROD: 6722).
  Workaround: You can manually copy the AES 256 key from a normal DSM group to a GCP-backed group. This key automatically becomes the currently active crypto key version in the GCP key ring.

• The “Rotate linked key” feature fails with an error for keys in an externally backed group where the external entity is a Google Cloud Platform key ring (JIRA: PROD-6828).
  Workaround: You must first manually rotate the source key in the normal DSM group and then copy the rotated key to the GCP group.

• If an Azure key is rotated and then soft-deleted, only one version of the key is soft-deleted (JIRA: PROD: 6947).
  Workaround: Perform a key scan in DSM to synchronize the key state with Azure.

• The create operation for security object creation does not work for the Azure Managed HSM plugin (JIRA: PROD-7078).

• Copying an RSA or EC key from a normal DSM group to an AWS KMS-backed DSM group does not work as expected and results in an error (JIRA: PROD-7787).

  Workaround: Export the RSA or EC key from the normal DSM group and import it into the AWS KMS-backed DSM group.

• Fortanix DSM does not support the ML-KEM key type in the account and group-level cryptographic policies. Although it is available on the front end (UI), the back end does not support it. (JIRA: PROD-8427)

• The Fortanix DSM user interface (UI) fails to load groups beyond 1000. Therefore, any security object associated with a group beyond 1000 will not be displayed (JIRA: ROFR-4378).

• The admin applications (apps) cannot retrieve the details for GET /users/{uuid} and instead returns the error "Inappropriate authorization for the requested operation" (JIRA: PROD-9212).

  Workaround: Use GET /users/{uuid} using the system administrator credentials to retrieve the user ID details.

• If the email configuration is incorrect, clicking RESEND VERIFICATION EMAIL on the Fortanix DSM user interface (UI) will result in a 500 Internal Server Error from the resend_confirm_email API (JIRA: PROD-9243).

  TIP

  Before enforcing email confirmation, ensure the System Administrator's email has been confirmed. Otherwise, if the email configuration is incorrect, the administrator might get locked out of the system.

  Workaround: Email verification is not enforced for the entire cluster; therefore, only a few users must verify their emails. If the email configuration is incorrect, their accounts will remain accessible and not be blocked.

9. Fortanix Data Security Manager Performance Statistics

9.1 Series 2

9.2 Azure Standard_DC8_v2

9.3 Series 2 JCE

9.4 Azure Standard DC8 JCE

10. Fortanix Data Security Manager Accelerator Performance Statistics

10.1 Runtime Environment

NOTE

• The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

• DSM Accelerator was run in the runtime environment listed below for performance testing.

10.2 DSM Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then we recommend adding multiple nodes.

10.3 Additional Modes