Fortanix Data Security Manager (DSM) 4.34.2532 release provides an overview of improvements and resolved issues.
This release is superseded by the March 17, 2025, release.
WARNING
You are REQUIRED to upgrade Fortanix DSM to version 4.27 or 4.31 before upgrading to version 4.34.2532. If you want to upgrade Fortanix DSM to version 4.34.2532 from a version earlier than 4.27, please contact the Fortanix Support team at your earliest to validate the upgrade path.
Downgrade from 4.34.2532 to any prior version is not supported due to the DCAP migration.
You may observe delay (retries) in bringing up services post upgrade to DSM 4.34.2532 due to a new table creation in the database to support the new Key Expiry Alert feature. For more details, contact Fortanix Support.
For 1-node cluster, the upgrade path must be 4.27 to 4.31 and 4.31 to 4.34.2532.
For 3-node cluster, the upgrade path must be 4.27 to 4.34.2532.
NOTE
The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix support if you are planning an upgrade.
The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
If your Fortanix DSM version is 4.31 or later, then the HSM Gateway version must also be 4.31 or later. Similarly, if the HSM Gateway version is 4.31 or later, then your Fortanix DSM version must be 4.31 or later.
1. Improvements and Bug Fixes
-
Fortanix FX2200 appliances now uses Intel Software Guard Extensions (SGX) Data Center Attestation Primitives (DCAP) attestation instead of Intel Attestation Service (IAS) since IAS will be reaching the end of life by April 02, 2025 (JIRA: PROD-9335).
For more information, refer to Fortanix DSM Installation Guide. -
Fixed an issue that occurred when joining a DC-labeled node to a cluster (JIRA: DEVOPS-5422).
For a complete list of new features, enhancements to existing features, other improvements, bug fixes, and known issues, refer to the full description of the DSM 4.34 release notes.
2. Fortanix Data Security Manager Performance Statistics
2.1 Series 2
|
Key Types and Operations |
Throughput (Operations/second on a 3-node cluster re-using a single TLS session) |
|---|---|
|
|
|
|
AES 256: CBC Encryption/Decryption |
5,557/5,558 |
|
AES 256: GCM Encryption/Decryption |
5,518/5,489 |
|
AES 256: FPE Encryption/Decryption |
2,683/2,673 |
|
AES 256 Key Generation |
1,284 |
|
|
|
|
RSA 2048 Encryption/Decryption |
5,057/1,176 |
|
RSA 2048 Key Generation |
33 |
|
RSA 2048 Sign/Verify |
1,178/4,742 |
|
RSA 4096 Sign/Verify |
388/4,127 |
|
EC NISTP256 Sign/Verify |
1,172/668 |
|
|
|
|
Kyber ML-KEM Encapsulation |
1,249 |
|
Kyber ML-KEM Decapsulation |
1,211 |
|
|
|
|
LMS Key (Height, Node) |
|
|
L1 5, Node 24 |
203 |
|
L1 5, Node 32 |
170 |
|
L1 10, Node 24 |
9.2 |
|
L1 10, Node 32 |
7.2 |
|
|
|
|
Data Security Manager Plugin (Hello world plugin) |
2,294 (invocations/second) |
2.2 Azure Standard_DC8_v2
|
Key Types and Operations |
Throughput (Operations/second on a 3-node [Standard_DC8_v2] cluster re-using a single TLS session) |
|---|---|
|
AES 256: CBC Encryption/Decryption |
4,463/4,481 |
|
AES 256: GCM Encryption/Decryption |
4,425/4,457 |
|
AES 256: FPE Encryption/Decryption |
2,171/2,197 |
|
AES 256 Key Generation |
1,111 |
|
|
|
|
RSA 2048 Encryption/Decryption |
4,200/1,280 |
|
RSA 2048 Key Generation |
43 |
|
RSA 2048 Sign/Verify |
1,296/4,199 |
|
RSA 4096 Sign/Verify |
514/3,951 |
|
EC NISTP256 Sign/Verify |
977/559 |
|
|
|
|
Data Security Manager Plugin (Hello world plugin) |
2,030 (invocations/second) |
2.3 Series 2 JCE
|
Key Types and Operations |
Throughput (Operations/second on a 3-node cluster re-using a single TLS session) |
|---|---|
|
AES 256: CBC Encryption/Decryption |
5,050/5,059 |
|
AES 256 Key Generation |
1,304 |
|
|
|
|
RSA 2048 Key Generation |
33 |
|
RSA 2048 Sign/Verify |
989/2,621 |
|
RSA 4096 Sign/Verify |
369/2,411 |
|
EC NISTP256 Sign/Verify |
1,012/606 |
|
|
|
|
Data Security Manager Plugin (Hello world plugin) |
2,318 (invocations/second) |
2.4 Azure Standard DC8 JCE
|
Key Types and Operations |
Throughput (Operations/second on a 3-node [Standard_DC8 JCE] cluster re-using a single TLS session) |
|---|---|
|
AES 256: CBC Encryption/Decryption |
4,313/4,375 |
|
AES 256 Key Generation |
1,130 |
|
|
|
|
RSA 2048 Key Generation |
43 |
|
RSA 2048 Sign/Verify |
1,032/2,384 |
|
RSA 4096 Sign/Verify |
478/2,307 |
|
EC NISTP256 Sign/Verify |
862/522 |
|
|
|
|
Data Security Manager Plugin (Hello world plugin) |
2,057 (invocations/second) |
3. Installation
To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure) packages, Download Here.