Fortanix Data Security Manager (DSM) 4.31 comes with some exciting new features, improvements, and resolved issues.
This release is superseded by the September 25, 2024, release.
WARNING
You are required to upgrade Fortanix DSM to version 4.23 or 4.27 before upgrading to version 4.31.
Downgrade from 4.31 to any prior version is not supported due to the Kubernetes version upgrade.
NOTE
The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.
The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
If your Fortanix DSM version is 4.13 or later, then the HSM gateway version must also be 4.13 or later. Similarly, if the HSM Gateway version is 4.13 or later, then your Fortanix DSM version must be 4.13 or later.
1. New Features
This release supports a new feature for DCAP (Data Center Attestation Primitives) clusters that allows Fortanix DSM system administrators to control the joining of new nodes to the cluster, ensuring that only trusted nodes can be added to this cluster. A new tab called TRUST CENTER is added to the System Administration→ CLUSTER page where the system administrators can maintain the list of trusted CPU identities (IDs) (JIRA: PM-110).
For more information, refer to the Fortanix Data Security Manager Installation Guide - On-Prem.
2. Other Improvements
Updated the groups (
sys/v1/groups) and apps (sys/v1/apps) API to support list limit and sorting (JIRA: PM-205).Implemented improvements to make Cassandra and sdkms pods tolerant of
NotReadynodes (JIRA: DEVOPS-4938).Enabled null attestation as the default attestation method for DSM Non-SGX nodes (JIRA: DEVOPS-4819). For more details, refer to the Fortanix Data Security Manager Software Pre-Upgrade Checks – Manual.
3. Client Improvements
Enhanced the EKM client to always use basic authentication tokens (API keys) for all the cryptographic operations to optimize the session management process (JIRA: PROD-8660).
Updated the End User License Agreement (EULA) in the Windows client installer to reflect the latest terms and conditions (JIRA: PROD-8892).
The Sequoia PGP client now supports generating keys of type nistp256, nistp384, nistp521, and rsa2k (JIRA: PM-381).
4. DSM Accelerator Improvements and Bug Fixes
DSM Accelerator JCE Provider
A new variant of DSM Accelerator JCE Provider Thin client is now created as a single unified JAR that contains the Fortanix dependencies (
sdkms-clientanddsm-accelerator) (JIRA: PROD-8857).
For more details, refer to the following documents:Improved the key retrieval process in the DSM Accelerator JCE Provider to utilize the cached data more efficiently (JIRA: PROD-8799).
Fixed the
NoPaddingscheme for the DSM Accelerator JCE Provider where the ciphertext length correctly matches the input length (JIRA: ES-385).
5. Integrations and Use Cases
Fortanix DSM now integrates with Databricks for seamless tokenization and detokenization operations (JIRA: ROQA-5580).
For more information, refer to the Using Fortanix Data Security Manager with Databricks.
6. Quality Enhancements
Upgraded Kubernetes to version 1.29.6 (JIRA: DEVOPS-4625).
For more information, refer to the Administration Guide: Fortanix Data Security Manager (Release 4.31) Kubernetes Version Upgrade to 1.29 K8s.Updated the fluentd image to version 1.16.2-debian-1.1 (JIRA: DEVOPS-4867).
7. Bug Fixes
Fixed a Cassandra timeout issue when loading the Fortanix DSM Dashboard for accounts with more than three million security objects (JIRA: ES-342).
Fixed an issue where the user was unable to import a wrapped AES key into Fortanix DSM (JIRA: ES-374).
Fixed an issue where the
deactivation_datewas not being set in copy-based key rotation (JIRA: PROD-7656).Fixed an issue where Fortanix DSM nodes were not entering the reboot cycle after being drained (JIRA: DEVOPS-4648).
Fixed and issue where importing an ECSecP256K1 key into a hardware-protected Azure Premium Key Vault failed in the browser UI (JIRA: PROD-8808).
Fixed an issue where linked keys were not being rotated correctly (JIRA: ROFR-4989).
8. Known Issues
A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).
Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.When you edit the starting time of a Key rotation policy for a security object with the value as single digit time, for example: 01:00 am, it shows an error “Invalid date/time selected. Please make sure you filled in a valid 12-hour time” (JIRA: ROFR-4786).
Workaround: Re-enter the rotate start time by removing the “0” before the single digit time and enter a new time (for example, 01:00 am to 2:00 am).After downgrading Fortanix DSM to version 4.25, it still shows the Node size field with a null value for LMS keys that were added in DSM version 4.26, even though the Node size is not a supported parameter in the older version (JIRA: PROD-8278).
Unable to create an LMS key with the following height combinations of 20 (JIRA: PROD-8248).
5, 20, and vice versa.
The hyperlink color for the field “Follow the instructions in” in the “Add Instance” form for Google Workspace Client-Side Encryption (CSE) still reflects the old link color value (JIRA: ROFR-4789).
The sync key API returns a “400 status code and response error” if its short-term access token expires during the synchronization of a group linked to AWS KMS (JIRA: PROD-3903).
Workaround: Increase the timeout of the temporary session token beyond the expected duration of the sync key operation.excludedoes not work in the proxy configuration for operations such as attestation (JIRA: PROD-3311).If an Azure key is rotated and then soft-deleted, only one version of the key is soft-deleted (JIRA: PROD-6947).
Workaround: Perform a key scan in DSM to synchronize the key state with Azure.The
createoperation for security object creation does not work for the Azure Managed HSM plugin (JIRA: PROD-7078).Copying an RSA or EC key from a normal DSM group to an AWS KMS-backed DSM group does not work as expected and results in an error (JIRA: PROD-7787).
Workaround: Export the RSA or EC key from the normal DSM group and import it into the AWS KMS-backed DSM group.The Fortanix DSM user interface (UI) fails to load groups beyond 1000. Therefore, any security object associated with a group beyond 1000 will not be displayed (JIRA: ROFR-4378).
The admin applications (apps) cannot retrieve the details for GET /users/{uuid} and instead returns the error "Inappropriate authorization for the requested operation" (JIRA: PROD-9212).
Workaround: UseGET /users/{uuid}using the system administrator credentials to retrieve the user ID details.If the email configuration is incorrect, clicking RESEND VERIFICATION EMAIL on the Fortanix DSM user interface (UI) will result in a 500 Internal Server Error from the
resend_confirm_emailAPI (JIRA: PROD-9243).TIP
Before enforcing email confirmation, ensure the System Administrator's email has been confirmed. Otherwise, if the email configuration is incorrect, the administrator might get locked out of the system.
Workaround: Email verification is not enforced for the entire cluster; therefore, only a few users must verify their emails. If the email configuration is incorrect, their accounts will remain accessible and not be blocked.
9. Fortanix Data Security Manager Performance Statistics
9.1 Series 2
Key Types and Operations | Throughput (Operations/second on a 3-node cluster re-using a single TLS session) |
|---|---|
|
|
AES 256: CBC Encryption/Decryption | 4,489/4,583 |
AES 256: GCM Encryption/Decryption | 4,567/4,369 |
AES 256: FPE Encryption/Decryption | 2,425/2,416 |
AES 256 Key Generation | 1,219 |
|
|
RSA 2048 Encryption/Decryption | 4,107/1,130 |
RSA 2048 Key Generation | 34 |
RSA 2048 Sign/Verify | 1,114/4,064 |
RSA 4096 Sign/Verify | 377/3,521 |
EC NISTP256 Sign/Verify | 1,122/639 |
|
|
Kyber ML-KEM Encapsulation | 1,164 |
Kyber ML-KEM Decapsulation | 1,088 |
|
|
LMS Key (Height, Node) |
|
L1 5, Node 24 | 31.17 |
L1 5, Node 32 | 26.02 |
L1 10, Node 24 | 1.01 |
L1 10, Node 32 | 0.82 |
|
|
Data Security Manager Plugin (Hello world plugin) | 1,730 (invocations/second) |
9.2 Azure Standard_DC8_v2
Key Types and Operations | Throughput (Operations/second on a 3-node [Standard_DC8_v2] cluster re-using a single TLS session) |
|---|---|
AES 256: CBC Encryption/Decryption | 3,539/3,514 |
AES 256: GCM Encryption/Decryption | 3,495/3,520 |
AES 256: FPE Encryption/Decryption | 2,160/2,136 |
AES 256 Key Generation | 1,045 |
|
|
RSA 2048 Encryption/Decryption | 3,400/1,239 |
RSA 2048 Key Generation | 44 |
RSA 2048 Sign/Verify | 1,217/3,296 |
RSA 4096 Sign/Verify | 516/3,120 |
EC NISTP256 Sign/Verify | 978/575 |
|
|
Data Security Manager Plugin (Hello world plugin) | 1,845 (invocations/second) |
9.3 Series 2 JCE
Key Types and Operations | Throughput (Operations/second on a 3-node cluster re-using a single TLS session) |
|---|---|
AES 256: CBC Encryption/Decryption | 4,209/4,179 |
AES 256 Key Generation | 1,216 |
|
|
RSA 2048 Key Generation | 33 |
RSA 2048 Sign/Verify | 944/2,200 |
RSA 4096 Sign/Verify | 320/1,760 |
EC NISTP256 Sign/Verify | 991/622 |
|
|
Data Security Manager Plugin (Hello world plugin) | 1,905 (invocations/second) |
9.4 Azure Standard DC8 JCE
Key Types and Operations | Throughput (Operations/second on a 3-node [Standard_DC8 JCE] cluster re-using a single TLS session) |
|---|---|
AES 256: CBC Encryption/Decryption | 3,580/3,602 |
AES 256 Key Generation | 1,075 |
|
|
RSA 2048 Key Generation | 45 |
RSA 2048 Sign/Verify | 961/1,877 |
RSA 4096 Sign/Verify | 427/1,655 |
EC NISTP256 Sign/Verify | 863/533 |
|
|
Data Security Manager Plugin (Hello world plugin) | 1,837 (invocations/second) |
10. Fortanix Data Security Manager Accelerator Performance Statistics
10.1 Runtime Environment
NOTE
The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
DSM Accelerator was run in the runtime environment listed below for performance testing.
Item | Specification |
|---|---|
Number of Cores | 4 |
CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
RAM | 2 GiB |
VM Type | Standard D4ds v4 Azure VM |
Docker Runtime Configuration |
|
10.2 DSM Accelerator Webservice
NOTE
The performance numbers below are captured with a single node; if you need higher performance or throughput, then we recommend adding multiple nodes.
Key Types and Operations | Throughput (Operations/second on a 1-node cluster re-using a single TLS session) |
|---|---|
AES 256: CBC Encryption/Decryption | 21,381/20,712 |
AES 256: GCM Encryption/Decryption | 22,057/21,736 |
AES 256: FPE Encryption/Decryption | 9,464/9,470 |
10.3 Additional Modes
Key Types and Operations | Throughput (Operations/second on a 1-node cluster re-using a single TLS session) |
|---|---|
AES 256: CBCNOPAD Encryption and Decryption | 21,336/21,441 |
AES 256: CFB Encryption/Decryption | 22,013/21,471 |
AES 256: CTR Encryption/Decryption | 21,853/21,728 |
AES 256: OFB Encryption/Decryption | 22,221/21,864 |
AES 256: CCM Encryption/Decryption | 21,720/21,216 |
11. Installation
To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure/VMWare) packages, Download Here.