[4.37] - March 28, 2025

Fortanix Data Security Manager (DSM) SaaS 4.37 comes with some exciting new features, general improvements, and resolved issues.

NOTE

This release is for SaaS only and is not available for on-premises installations. Updates in this release will be part of a future on-premises release.

1. New Features

• Fortanix DSM can now be configured to send audit log entries to Azure Log Analytics for centralized monitoring (JIRA: PM-112).
  For more information, refer to User’s Guide: Logging.

• Fortanix DSM now supports the generation of a new post-quantum cryptography (PQC) key type called eXtended Merkle Signature Scheme (XMSS) key, which can be used for signature generation and verification (JIRA: PM-103).
  For more information, refer to User's Guide: Fortanix Data Security Manager Key Lifecycle Management.

• Fortanix DSM now supports the option to disallow keys with unknown operations in the Key Management Interoperability Protocol (KMIP) client configuration settings. This enhancement provides system administrators with greater flexibility in filtering keys so that the unsupported operations for those selected key types are ignored during processing the KMIP request. This feature can be enabled by navigating to the CLIENT CONFIGURATION → KMIP tab and selecting the required keys in the Ignore unknown key operations for section (JIRA: PM-408).
  Additionally, the existing Allow secrets with unknown operations check box has been removed to allow users to select multiple security object types for unknown operations.
  For more information, refer to the following guides:

  • User's Guide: Account Client Configurations

  • User's Guide: Group Client Configurations

2. Improvements

• Fortanix DSM now supports the standard algorithms for Module-Lattice-Based Digital Signature Algorithm (ML-DSA) and Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) as the Post-Quantum Cryptography (PQC) methods and they replace the previously available ML-DSA (beta) and ML-KEM (beta) security objects. Existing beta ML-DSA and ML-KEM security objects are not backward compatible with the new standardized implementations. Additionally, the Experimental tag has been removed (JIRA: PM-413).
  For more information, refer to User's Guide: Fortanix Data Security Manager Key Lifecycle Management.

• When performing normal rotation, linked key rotation, or rotate to DSM key in Azure Key Vault or GCP KMS, specifying the Azure Key Name or GCP Key ID is optional as they are automatically inherited from the previous key version (JIRA: PM-475).
  For more information, refer to the following guides:

  • Fortanix DSM - Azure Key Vault BYOK (Bring Your Own Key)

  • Fortanix DSM - Google Cloud Platform BYOK (Bring Your Own Key) 

• Fortanix DSM can now generate Elliptic Curve (EC) keys over curve X448 through the DSM user interface (UI) (JIRA: ROFR-5247).
  For more information, refer to User's Guide: Fortanix Data Security Manager Key Lifecycle Management.

• Added support for reCAPTCHA verification when resetting your forgotten password using the Forgot your password? link on the Fortanix DSM UI during sign-in (JIRA: PM-370).
  For more information, refer to User's Guide: Sign Up for Fortanix Data Security Manager SaaS.

• The users with host administration permissions can now create, configure, and manage Fortanix DSM Filesystem Encryption policies for Windows clients using the FILE DECRYPTION POLICY tab in DSM UI to manage and control access to services, users, processes, and groups on the Windows client effectively (JIRA: FSE-132).
  For more information, refer to Filesystem Encryption for Windows as a Service Using Fortanix Data Security Manager - Setup and Usage.

3. Other Improvements

• Fortanix DSM now supports cookie as the transport mechanism for session tokens during authentication (JIRA: PM-184).
  Instead of storing session tokens in local storage, Fortanix DSM utilizes secure, HTTP-only cookies, enhancing security and ensuring better protection against unauthorized access.

  NOTE

  Users who were logged in before the Fortanix DSM 4.37 release will be logged out and may receive an unauthorized access message. They must log in again to initiate a new session.

  For more information, refer to User's Guide: Authentication.

4. API Updates

• Added an additional enum variant for Azure Log Analytics to the LoggingConfig and LoggingConfigRequest, which in turn affects the add_logging_configs, mod_logging_configs, and del_logging_configs in the patch  "/sys/v1/accounts/:acct_id" (update account) API to support for Azure Log Analytics integration in Fortanix DSM (JIRA: PM-112).

• After finalizing the ML-KEM (FIPS 203) and ML-DSA (FIPS 204) specifications, Fortanix DSM deprecated the MlKemBeta and MlDsaBeta key types and replaced them with MlKem and MlDsa, which correspond to the FIPS 203 and FIPS 204 specifications, respectively (JIRA: PM-413).

5. Client Improvements

• Added support to specify a target group when creating or importing a key in the Sequoia-PGP client (JIRA: PM-402).
  For more information, refer to Clients: Sequoia PGP.

• Added support for adding custom metadata when creating or importing a key in the Sequoia-PGP client (JIRA: PM-403).
  For more information, refer to Clients: Sequoia PGP.

• Added support for publishing the Windows signed binary to the Chocolatey package manager in the Sequoia-PGP client (JIRA: PM-453).
  For more information, refer to Sequoia-PGP.

• Updated the SAP Data Custodian (DC) BYOK plugin to enhance validation, improve parameter handling, and provide better clarity in the key import process (JIRA: PM-420).

• The SAP Data Custodian BYOK plugin now supports importing Fortanix DSM keys (AES and RSA) into Data Custodian groups or rotating them if they are already imported in AWS and non-AWS keystore providers (JIRA: PM-426).
  For more information, refer to User’s Guide: Plugin Library.

6. DSM Accelerator New Features and Bug Fixes

• DSM Accelerator Webservice:

  • Added support for encryption and decryption using the RSA keys in Fortanix DSM Accelerator Webservice (JIRA: PM-395).
    For more information, refer to DSM Accelerator Webservice Developer Guide.

  • Resolved a performance issue in Fortanix DSM Accelerator Webservice for AWS Nitro, where one node in the cluster issued export requests more frequently even when the cache Time-To-Live (TTL) was configured longer (JIRA: PROD-10043).

  • Fixed an issue in Fortanix DSM Accelerator Webservice for AWS Nitro where, in cluster mode, it failed to export security objects if the locally cached bearer token had expired (JIRA: PROD-10051).

• DSM Accelerator JCE Provider:

  • Added support for encryption and decryption using the RSA keys in Fortanix DSM Accelerator JCE Provider (JIRA: PM-395).
    For more information, refer to DSM Accelerator JCE Provider Developer Guide.

7. Bug Fixes

• Fixed an issue where the rotation of Secret-type security object failed when the Deactivation date was set in the group's Key metadata policy(JIRA: ES-382).

8. Known Issues

• The create operation for security object creation does not work for the Azure Managed HSM plugin (JIRA: PROD-7078).

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname (JIRA: PROD-9542).

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod resulting in two certificate pairs which can lead to unexpected results (JIRA: PROD-9570).

• Deleting replica keys in groups with key history policies only results in a soft-delete of the keys (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• When creating a group-level Quorum approval policy, users with the “Custom account roles permissions” are not listed in the user list (JIRA: ROFR-5253).
  Workaround: Assign the Get External Roles permission to allow the users to be listed in the quorum policy.

• Unable to save Account Cryptographic policy with below permissions (JIRA: ROFR-5254).

  "Create Account Security Object Policies",
  "Set Approval Request Expiry",
  "Get All Users"

  Workaround: Add the Update Account Security Object Policies permission to the Custom account role to enable saving the Account Cryptographic policy.