---
title: "[5.0] - May 27, 2025"
slug: "5-0-may-27-2025"
updated: 2026-08-19T06:30:37Z
published: 2026-08-19T06:30:37Z
canonical: "support.fortanix.com/5-0-may-27-2025"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# [5.0] - May 27, 2025

Fortanix Data Security Manager (DSM) 5.0 comes with some exciting new features, general improvements, and resolved issues.

This release is superseded by the [June 24, 2025](/v1/docs/5-0-patch-1-june-24-2025), release.

> [!WARNING]
> WARNING
> 
> - You are **REQUIRED** to upgrade Fortanix DSM to version **4.36 Patch 1** before upgrading to version 5.0. If you want to upgrade Fortanix DSM to version 5.0 from a version earlier than **4.36 Patch 1**, please contact the Fortanix Support team at your earliest to validate the upgrade path.
> - Downgrade from 5.0 to any prior version is not supported due to an upgrade of the appliance operating system.

> [!NOTE]
> NOTE
> 
> - If you are using a custom sudo user, ensure that the default **administrator** user is enabled with root privileges **before upgrading to Fortanix DSM version 5.0**. The **administrator** user must be able to log in with a password and be part of the sudo group.
> - During the upgrade, the `/etc/sudoers` file is overwritten, which can result in the loss of sudo access for the custom sudo user.
> - The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.
> - The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
> - If your Fortanix DSM version is 4.31 or later, then the HSM Gateway version must also be 4.31 or later. Similarly, if the HSM Gateway version is 4.31 or later, then your Fortanix DSM version must be 4.31 or later.

## 1. New Features

- Fortanix DSM now introduces a global dark mode user interface (UI) theme as part of the visual alignment with the Fortanix Armor platform **(JIRA: PM-465)**. ![Screenshot (1675).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/37609147494548)

## 2. Improvements

- Users can now log in using any case variation of their email address when logging in to Fortanix DSM using Single Sign-On (SSO) **(JIRA: PM-498)**.

## 3. Other Improvements

- The Fortanix DSM restore scripts are now enhanced to support Secure File Transfer Protocol (SFTP)-based backup repositories for improved compatibility with storage solutions **(JIRA: PM-430)**.
- Improved the performance of the `GetAllUsers` API to reduce the latency for accounts with a large number of groups **(JIRA: PROD-9500)**.
- Improved the query of keys in KMIP `Locate`**(JIRA: PROD-10177)**.
- Added checks for the Extended Key Usage extension in Key Attestation Authority sharing APIs **(JIRA: PROD-9941)**.

## 4. API Updates

- This release does not have any API changes.

## 5. Integrations and Use Cases

- Added support for Fortanix DSM integration with Quadient Inspire Designer. *For more details, refer to the* [*Fortanix DSM with Quadient Inspire Designer Integration Guide*](/v1/docs/fortanix-dsm-with-quadient-inspire-designer)*.*

## 6. Client Improvements

- Added client-side failover support to the Fortanix DSM Java Cryptography Extension (JCE) Provider to retry requests on alternate endpoints upon request timeout **(JIRA: PM-204)**. *For more details, refer to the* [*Clients: Java Cryptography Extension (JCE) Provider*](/v1/docs/fortanix-dsm-clients-java-cryptography-extension-jce-provider#80-client-side-failover)*.*

## 7. DSM Accelerator New Features and Bug Fixes

- **DSM Accelerator Webservice:**
  - Fixed an issue causing latency deviation in the first request to the Fortanix DSM Accelerator Webservice after an `/auth` request **(JIRA: PROD-10270)**.

## 8. Quality Enhancements

- Fortanix DSM and DSM clients now run on and support Ubuntu 24.04 LTS, as Ubuntu 20.04 LTS is approaching end-of-life **(JIRA: PM-501)**.
- Upgraded the FX2200 Series 2 BIOS version to F16 and CPU microcode to `0xFA`**(JIRA: DEVOPS-5600)**.
- Upgraded Sensu to version 6.12.0-7321 **(JIRA: PROD-9944)**.

## 9. Security Improvements

- Updated Intel SGX attestation verification logic to correctly interpret potential future attestation evidence and endorsements from Intel. As of the publication date of these release notes, Intel has not published any evidence or endorsements that would cause security issues with the previous logic **(JIRA: RTE-308, RTE-450, RTE-447)**.

## 10. Bug Fixes

- Fixed an issue where if an app belongs to more than 1000 groups, adding a new group to the app fails **(JIRA: ES-499)**.
- Fixed an issue where the `create` operation for security object creation did not work for the Azure Managed HSM plugin **(JIRA: PROD-7078)**.
- Fixed Fortanix DSM UI performance issues when loading groups and apps if an account has more than 1000 groups and apps **(JIRA: ES-500)**.

## 11. Known Issues

- Upgrading from Fortanix DSM 5.0 and later could cause package upload failures from the DSM UI, resulting in HTTP 400 or HTTP 500 errors **(JIRA: ES-599)**.
- The **COPY KEY** dialog box does not filter the HSM/External KMS groups as expected when **Import key to HSM/External KMS** check box is selected, if there are more than 1,000 groups in the account **(JIRA: ROFR-5167)**.
- Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation **(JIRA: PROD-9409)**. **Workaround**: To delete the invited user, contact Fortanix Support or perform the following steps:
  - If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:
    - Change the user's account role to "Account Member".
    - Remove the group memberships one by one using the user interface.
    - Delete the user.
- The `sudo get_csrs --rotate` command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname **(JIRA: PROD-9542)**.
- When you run `sudo get_csrs --rotate` command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod resulting in two certificate pairs which can lead to unexpected results **(JIRA: PROD-9570)**.
- Deleting replica keys in groups with key history policies only results in a soft-delete of the keys **(JIRA: PROD-9925)**. **Workaround**: Users should avoid deleting keys that are associated with a key-undo policy.
- When creating a group-level Quorum approval policy, users with the “Custom account roles permissions” are not listed in the user list **(JIRA: ROFR-5253**). **Workaround**: Assign the **Get External Roles** permission to allow the users to be listed in the quorum policy.
- Unable to save Account Cryptographic policy with the below permissions **(JIRA: ROFR-5254)**.

```plaintext
"Create Account Security Object Policies",
"Set Approval Request Expiry",
"Get All Users"
```

**Workaround**: Add the `Update Account Security Object Policies` permission to the Custom account role to enable saving the Account Cryptographic policy.
- After upgrading Fortanix DSM to version 5.0 or later, Network Time Protocol (NTP) checks in Sensu may fail even if NTP is correctly synchronized across the cluster (**JIRA: RODE-168**).

> [!NOTE]
> NOTE
> 
> Use the following command to override the alert:
> 
> ```plaintext
> check-ntp.rb -u ok -w ${WARN_LEVEL} -c ${CRITICAL_LEVEL}" \
> ```

## 12. Fortanix Data Security Manager Performance Statistics

> [!NOTE]
> NOTE
> 
> As part of this major release, the underlying operating system of Fortanix DSM has been upgraded from Ubuntu 20.04 to Ubuntu 24.04, which includes a significant Linux kernel update from version 5.4.0 to 6.8.0, along with multiple software package updates.
> 
> Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations.
> 
> The Fortanix engineering team is actively investigating this issue and evaluating potential mitigations.

### 12.1 Series 2

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,784/5,879 |
| AES 256: GCM Encryption/Decryption | 5,875/5,997 |
| AES 256: FPE Encryption/Decryption | 4,736/4,613 |
| AES 256 Key Generation | 1,114 |
|  |  |
| RSA 2048 Encryption/Decryption | 5,517/2,009 |
| RSA 2048 Key Generation | 42 |
| RSA 2048 Sign/Verify | 1,988/5,513 |
| RSA 4096 Sign/Verify | 641/5,001 |
| EC NISTP256 Sign/Verify | 2,595/1,745 |
|  |  |
| Kyber ML-KEM Encapsulation | 1,135 |
| Kyber ML-KEM Decapsulation | 1,113 |
|  |  |
| LMS Key (Height, Node) |  |
| L1 5, Node 24 | 173 |
| L1 5, Node 32 | 140 |
| L1 10, Node 24 | 6.06 |
| L1 10, Node 32 | 4.82 |
|  |  |
| BIP32 Key Derive as Transient Hardened Child Key | 888 |
| BIP32 Sign | 888 |
|  |  |
| ECDSA: EC SecP256K1 Key Generation | 1,132 |
| ECDSA Sign | 1,132 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,376 (invocations/second) |

---

### 12.2 Azure Standard_DC8_v2

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8_v2] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 3,562/3,567 |
| AES 256: GCM Encryption/Decryption | 3,597/3,524 |
| AES 256: FPE Encryption/Decryption | 3,143/3,081 |
| AES 256 Key Generation | 944 |
|  |  |
| RSA 2048 Encryption/Decryption | 3,423/1,634 |
| RSA 2048 Key Generation | 37 |
| RSA 2048 Sign/Verify | 1,651/3,490 |
| RSA 4096 Sign/Verify | 535/3,236 |
| EC NISTP256 Sign/Verify | 2,065/1,481 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,357 (invocations/second) |

---

### 12.3 Series 2 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,470/5,485 |
| AES 256 Key Generation | 1,181 |
|  |  |
| RSA 2048 Key Generation | 42 |
| RSA 2048 Sign/Verify | 1,511/2,774 |
| RSA 4096 Sign/Verify | 584/2,638 |
| EC NISTP256 Sign/Verify | 1,842/1,372 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,379 (invocations/second) |

---

### 12.4 Azure Standard DC8 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8 JCE] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 3,651/3,569 |
| AES 256 Key Generation | 982 |
|  |  |
| RSA 2048 Key Generation | 36 |
| RSA 2048 Sign/Verify | 1,205/1,897 |
| RSA 4096 Sign/Verify | 482/1,839 |
| EC NISTP256 Sign/Verify | 1,374/1,113 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,460 (invocations/second) |

---

## 13. Fortanix Data Security Manager Accelerator Performance Statistics

### 13.1 Runtime Environment

> [!NOTE]
> NOTE
> 
> The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
> 
> DSM Accelerator was run in the runtime environment listed below for performance testing.

| **Item** | **Specification** |
| --- | --- |
| Number of Cores | 4 |
| CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
| RAM | 2 GiB |
| VM Type | Standard D4ds v4 Azure VM |
| Docker Runtime Configuration | `sudo docker run -d --network host --memory=1g --memory-swap=2g --log-driver json-file --log-opt max-size=100m` |

---

### 13.2 DSM Accelerator Webservice

> [!NOTE]
> NOTE
> 
> The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 21,023/20,936 |
| AES 256: GCM Encryption/Decryption | 22,494/22,063 |
| AES 256: FPE Encryption/Decryption | 9,382/9,335 |

---

### 13.3 Additional Modes

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBCNOPAD Encryption/Decryption | 21,905/21,536 |
| AES 256: CFB Encryption/Decryption | 22,582/21,910 |
| AES 256: CTR Encryption/Decryption | 22,462/22,020 |
| AES 256: OFB Encryption/Decryption | 22,553/22,074 |
| AES 256: CCM Encryption/Decryption | 22,224/21,792 |

---

## 14. Installation

To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure/VMWare) packages, [Download Here](/v1/docs/dsm-installation-packages-on-prem).