---
title: "[5.4] - October 31, 2025"
slug: "5-4-october-31-2025"
updated: 2026-08-19T06:27:43Z
published: 2026-08-19T06:27:43Z
canonical: "support.fortanix.com/5-4-october-31-2025"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# [5.4] - October 31, 2025

Fortanix Data Security Manager (DSM) 5.4 comes with new features, general improvements, and resolved issues.

This release is superseded by the [December 12, 2025](/v1/docs/5-4-patch-2-december-12-2025), release.

> [!WARNING]
> WARNING
> 
> - If you want to upgrade Fortanix DSM to version 5.4, your current DSM version must be at least 5.2 Patch 1.
> - Downgrade from 5.4 to any prior version is not supported due to Kernel upgrades.

> [!NOTE]
> NOTE
> 
> - Your content goes hereThe Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.
> - The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
> - If your Fortanix DSM version is 5.2 or later, then the HSM Gateway version must also be 5.2 or later. Similarly, if the HSM Gateway version is 5.2 or later, then your Fortanix DSM version must be 5.2 or later.

## 1. New Features

- Fortanix DSM now allows Account Administrators to configure System for Cross-domain Identity Management (SCIM) integration with Microsoft Entra ID as identity provider (IdP), enabling automated lifecycle management of users, including provisioning and de-provisioning **(JIRA: EXTREQ-1015)**.

![Screenshot (2404).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821509839380)

*For more information, refer to* [*SCIM-Based User Synchronization with Fortanix DSM*](/v1/docs/scim-based-user-synchronization-with-fortanix-dsm)*.*
- Added support for Microsoft Entra ID Single Sign-On (SSO) integration using Security Assertion Markup Language (SAML) for authenticating to Fortanix DSM **(JIRA: PROD-10797)**.

![Screenshot (2405).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821481645332)

*For more information, refer to* [*Using Fortanix DSM with Microsoft Entra ID*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-entra-id)*.*
- Added support for secure manufacturing and boot flow for Fortanix FX3400 appliances to enable key provenance attestation for Fortanix DSM on-premises deployments **(JIRA: PM-215)**. *For more information, refer to the* [*Fortanix DSM Installation Guide - On-prem*](/v1/docs/fortanix-data-security-manager-installation-guide-on-prem#431-setup-deployment-specific-configuration-file)*.*
- Oracle Cloud Infrastructure (OCI) Vault keys can now be managed through Fortanix DSM using externally backed groups (**JIRA: PM-256**). The following operations can be performed:

*For more information, refer to the* [*Fortanix DSM with Oracle Cloud Infrastructure Guides*](/v1/docs/fortanix-dsm-with-oracle-cloud-infrastructure)*.*
  - Create OCI externally backed groups with an API key pair.
  - Import and copy keys (Bring Your Own Key) into OCI Vault.
  - Enable or disable keys in OCI Vault.
  - Update OCI keys’ `freeform_ tags` (as DSM `custom_metadata`)
  - Rotate keys in OCI Vault.
  - Rotate a key in OCI Vault to the value of an existing Fortanix DSM key.
  - Schedule or cancel OCI Vault key versions for deletion
- Added support to configure a **Key undo policy** for a FIPS-backed Fortanix DSM group **(JIRA: EXTREQ-1428)**.

![Screenshot (2406).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821481646356)

![Screenshot (2407).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821509843604)

## 2. Improvements

- The Fortanix DSM UI for Custom Account Roles now displays the Custom Role ID, allowing administrators to easily view and copy the ID for use in configurations or integrations **(JIRA: PM-606)**.

![Screenshot (2408).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821481647892)
- Updated the following in the Fortanix DSM account and group-level **Client Configuration** → **KMIP** tab **(JIRA: PM-537)**:

![Screenshot (2409).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821509845140)

![Screenshot (2410).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821509846420)

*For more information, refer to the following guides:*
  - Updated the label “**Default to creating keys with Export permission**” to “**Implicit Export permission in KMIP operations**”.
  - The “**Implicit Export permission in KMIP operations**” flag is now enabled by default.
  - [*User's Guide: Account Client Configurations*](/v1/docs/fortanix-dsm-account-client-configurations#23-kmip-clients)
  - [*User's Guide: Group Client Configurations*](/v1/docs/fortanix-dsm-group-client-configurations#23-kmip-clients)
  - [*What KMIP coverage do we provide*](/v1/docs/what-kmip-coverage-do-we-provide)
- Added a copy button next to the security object name in the detailed view of a security object **(JIRA: ROFR-5695)**.

![Screenshot (2411).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/42821509847060)

## 3. Other Improvements

- Disallow transforming a non-exportable BIP32 key into an exportable key. Transformed objects now inherit the export restrictions of their parent, ensuring the original export restrictions are preserved **(JIRA: PROD-10562)**.

## 4. API Updates

- Added the following SCIM v2.0 endpoints to support this integration **(JIRA: PM-490)**:
  - `POST /Users`: Create a user in Fortanix DSM using SCIM.
  - `GET /Users/{user_id}`: Retrieve the user’s details using the user ID that was generated in Fortanix DSM.
  - `GET /Users`: Retrieve a list of users provisioned in Fortanix DSM.
  - `PATCH /Users/{user_id}`: Update a user's attributes.
  - `DELETE /Users/{user_id}`: Delete a user using the user ID that was generated in Fortanix DSM.

> [!NOTE]
> NOTE
> 
> The local-parts for these API endpoints are case-sensitive.
- The following API changes support OCI Vault integration for Bring Your Own Key (BYOK) through Externally Backed Groups **(JIRA: PM-256)**.
  - Integration Credential APIs:
    - Introduced a new `IntegrationCredential` object to manage external credential configurations. For now, only OCI credentials are supported.
      - `POST /sys/v1/credentials`: Create a new credential.
      - `GET /sys/v1/credentials`: List all credentials.
      - `GET /sys/v1/credentials/{cred_id}`: Retrieve credential details.
      - `PATCH /sys/v1/credentials/{cred_id}`: Update a credential.
      - `DELETE /sys/v1/credentials/{cred_id}`: Delete a credential.
      - `POST /sys/v1/credentials/{cred_id}/rotate`: Rotate the credential.
      - NOTE
  - Key Collections Listing API:
    - `POST /sys/v1/groups/hmg/scan_collections`: A new API for listing external KMS vaults, key rings, and so on. The current release supports listing OCI Vaults only.
      - This API requires the new `ASSIGN_CREDENTIALS` permission in addition to the normal permissions (For example, `CREATE_EXTERNAL_GROUPS`) required to create an externally backed group.
  - Security Object Update:
    - Added a new Boolean field `allow_credential_use` to specify whether a Security Object can be associated with a credential object.
- Updated the `PATCH /crypto/v1/keys/{key_id}` API to support unlinking parent-subkey relationships in `KeyLinks` of an `Sobject` (**JIRA: PM-576**).

## 5. Integration and Use Cases

- Added support to integrate Fortanix DSM with the External Secrets Operator (ESO) to securely fetch and manage secrets such as API keys, passwords, and certificates from Fortanix DSM and make them available to Kubernetes workloads **(JIRA: EXTREQ-483)**.

*For more details, refer to* [*Using Data Security Manager with External Secret Operator*](/v1/docs/fortanix-dsm-with-external-secret-operator)*.*

## 6. Client New Features and Improvements

- The `TemplateAttribute` field in the `ReKey` request is now optional in the Fortanix DSM KMIP client (**JIRA: PM-616**).
- Added support for a custom Certificate Authority (CA) certificate for server authentication in the Sequoia-PGP client (**JIRA: PM-619**). *For more information, refer to* [*Clients: Sequoia-PGP*](/v1/docs/fortanix-dsm-clients-sequoia-pgp#40-configuration)*.*
- Added support for PGP key rotation in the Sequoia-PGP client (**JIRA: PM-367**). *For more information, refer to* [*Clients: Sequoia-PGP*](/v1/docs/fortanix-dsm-clients-sequoia-pgp#58-example-usage-rotate-a-pgp-key)*.*

## 7. DSM Accelerator New Features and Bug Fixes

- **DSM Accelerator Webservice:**
  - Added support for combined authentication for inbound application (app) connections in Fortanix DSM Accelerator Webservice, requiring both a TLS client certificate and an in-band credential in REST API requests (**JIRA: PM-556**). *For more information, refer to the* [*DSM Accelerator Webservice Developer Guide*](/v1/docs/dsm-accelerator-webservice-developer-guide)*.*
  - Fortanix DSM Accelerator Webservice now supports batch APIs (`crypto/v1/keys/batch`) to perform encryption and decryption operations using key names (**JIRA: PM-487**). *For more information, refer to the* [*DSM Accelerator Webservice Developer Guide*](/v1/docs/dsm-accelerator-webservice-developer-guide)*.*
  - Fixed the issue where the Mutual Transport Layer Security (mTLS) client in Fortanix DSM Accelerator Webservice ignored the custom CA file specified using the `--ca-file <CA-FILE>` command-line option or the `CA_FILE` environment variable during certificate verification (**JIRA: ES-559**).

## 8. Quality Enhancements

- Upgraded Kernel to Linux version 6.8.0.86.87 **(JIRA: RODE-304)**.
- Upgraded fluentd to version 1.19 **(JIRA: RODE-321)**.
- Upgraded Sensu to version 6.13.0-7379 **(JIRA: RODE-75)**.

## 9. Bug Fixes

- Fixed an issue where deriving SLIP10 keys failed if a Cryptographic policy was set at the Fortanix DSM account or group level **(JIRA: PROD-10767)**.
- Fixed an issue where copying SLIP10 keys was not supported **(JIRA: PROD-10767)**.
- Fixed an issue where Fortanix DSM signing requests in the Quorum approval user interface (UI) did not display the description provided by the request creator to approvers **(JIRA: ROFR-5636)**.
- Fixed an issue where, after upgrading Fortanix DSM to version 5.0, Network Time Protocol (NTP) checks in Sensu failed even if NTP is correctly synchronized across the cluster **(JIRA: RODE-168)**.
- Fixed an issue where upgrading from Fortanix DSM 5.0 and later could cause package upload failures from the DSM UI, resulting in HTTP 400 or HTTP 500 errors (**JIRA: ES-599**).

## 10. Known Issues

- A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account **(JIRA: ROFR-4998)**. **Workaround**: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.
- The **COPY KEY** dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (**JIRA: ROFR-5167**)
- Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation **(JIRA: PROD-9409)**. **Workaround**: To delete the invited user, contact Fortanix Support or perform the following steps:
  - If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:
    - Change the user's account role to "Account Member".
    - Remove the group memberships one by one using the user interface.
    - Delete the user.
- The `sudo get_csrs --rotate` command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname **(JIRA: PROD-9542)**.
- When you run `sudo get_csrs --rotate` command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results **(JIRA: RODE-97)**.
- Deleting replica keys in groups with Key undo policies is reversible using the undo operation **(JIRA: PROD-9925)**. **Workaround**: Users should avoid deleting keys that are associated with a key-undo policy.
- The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (**JIRA: PROD-10441**). **Workaround**: Set the retention period to 2 days or longer under **Settings→ LOG MANAGEMENT → Retention periodfor Audit Logs** to ensure recent audit log entries are visible.
- Unable to perform Kubernetes CA rotation successfully (**JIRA: RODE-62**). **Workaround**: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.
- After upgrading Fortanix DSM to version 5.0 or later, Network Time Protocol (NTP) checks in Sensu may fail even if NTP is correctly synchronized across the cluster (**JIRA: RODE-168**).

> [!NOTE]
> NOTE
> 
> Use the following command to override the alert:
> 
> ```plaintext
> check-ntp.rb -u ok -w ${WARN_LEVEL} -c ${CRITICAL_LEVEL}" \
> ```

- When installing **Fortanix DSM 5.2** or **Fortanix DSM 5.4 software** on VM-based Marketplace images (AWS, Azure, or VMware) in an air-gapped environment, the installation may fail. This issue occurs because the system contains a reference to the upstream Ubuntu repository file (**JIRA: RODE-337**). **Workaround**:
  - **Fresh installation:**
    1. Before creating a cluster:
      1. Move the upstream Ubuntu repository file: `mv /etc/apt/sources.list.d/ubuntu.sources /tmp/`.
      2. Run the package update command: `apt-get update`.
      3. Verify that no upstream Ubuntu repository references appear in the output.
    2. Proceed with cluster creation: `sdkms-cluster create`.
  - **Upgrade from DSM 5.2 or 5.4:**
    1. Before clicking **Submit** to start the upgrade:
      1. Move the upstream Ubuntu repository file: `mv /etc/apt/sources.list.d/ubuntu.sources /tmp/`.
      2. Run the package update command: `apt-get update`.
      3. Verify that no upstream Ubuntu repository references appear in the output.
    2. Click **Submit** to start the DSM upgrade.
- When upgrading to Fortanix DSM version 5.7, the `sdkms` pod becomes stuck in the `ContainerCreating` state (**JIRA: ES-637**). **Workaround:** Edit the `sdkms` deployment and remove the following to continue the upgrade:

```plaintext
- mountPath: /root/enclave-runner
   name: enclave-runner
```

and

```plaintext
- hostPath:
    path: /var/opt/fortanix/swdist/data/v3522/config/chart/charts/infra/enclave-runner
    type: File
   name: enclave-runner
```

## 11. Fortanix Data Security Manager Performance Statistics

> [!NOTE]
> NOTE
> 
> Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations.

### 11.1 Series 2

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,804/5,840 |
| AES 256: GCM Encryption/Decryption | 5,812/5,821 |
| AES 256: FPE Encryption/Decryption | 4,709/4,716 |
| AES 256 Key Generation | 1,188 |
|  |  |
| RSA 2048 Encryption/Decryption | 5,476/1,981 |
| RSA 2048 Key Generation | 43 |
| RSA 2048 Sign/Verify | 1,977/5,540 |
| RSA 4096 Sign/Verify | 579/4,991 |
|  |  |
| EC NISTP256 Key Generation | 937 |
| EC NISTP256 Sign/Verify | 2,585/1,677 |
| EC secP256K1 Key Generation | 842 |
| EC secP256K1 Sign/Verify | 1,904/1,145 |
|  |  |
| Kyber ML-KEM Encapsulation | 1,124 |
| Kyber ML-KEM Decapsulation | 1,084 |
|  |  |
| LMS Key (Height, Node) |  |
| L1 5, Node 24 | 169 |
| L1 5, Node 32 | 135 |
| L1 10, Node 24 | 5.84 |
| L1 10, Node 32 | 4.7 |
|  |  |
| BIP32 Key Derive as Transient Hardened Child Key | 888 |
| BIP32 Sign | 888 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,527 (invocations/second) |

---

### 11.2 Azure Standard_DC8s_v3

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8s_v3] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 4,464/4,496 |
| AES 256: GCM Encryption/Decryption | 4,499/4,484 |
| AES 256: FPE Encryption/Decryption | 3,800/3,788 |
| AES 256 Key Generation | 1,455 |
|  |  |
| RSA 2048 Encryption/Decryption | 4,354/1,880 |
| RSA 2048 Key Generation | 61 |
| RSA 2048 Sign/Verify | 1,890/4,376 |
| RSA 4096 Sign/Verify | 581/4,035 |
|  |  |
| EC NISTP256 Key Generation | 1,133 |
| EC NISTP256 Sign/Verify | 2,259/1,512 |
| EC secP256K1 Key Generation | 975 |
| EC secP256K1 Sign/Verify | 1,691/1,045 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 3,759 (invocations/second) |

---

### 11.3 Series 2 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,532/5,540 |
| AES 256 Key Generation | 1,192 |
|  |  |
| RSA 2048 Key Generation | 42 |
| RSA 2048 Sign/Verify | 1,501/2,985 |
| RSA 4096 Sign/Verify | 570/2,824 |
|  |  |
| EC NISTP256 Key Generation | 945 |
| EC NISTP256 Sign/Verify | 1,828/1,339 |
| EC secP256K1 Key Generation | 837 |
| EC secP256K1 Sign/Verify | 1,464/999 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,526 (invocations/second) |

---

### 11.4 Azure Standard DC8 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8 JCE] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 4,468/4,466 |
| AES 256 Key Generation | 1,573 |
|  |  |
| RSA 2048 Key Generation | 61 |
| RSA 2048 Sign/Verify | 1,391/2,379 |
| RSA 4096 Sign/Verify | 527/2,267 |
|  |  |
| EC NISTP256 Key Generation | 1,144 |
| EC NISTP256 Sign/Verify | 1,585/1,179 |
| EC secP256K1 Key Generation | 957 |
| EC secP256K1 Sign/Verify | 1,277/876 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 3,774 (invocations/second) |

---

## 12. Fortanix Data Security Manager Accelerator Performance Statistics

### 12.1 Runtime Environment

> [!NOTE]
> NOTE
> 
> The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
> 
> DSM Accelerator was run in the runtime environment listed below for performance testing.

| **Item** | **Specification** |
| --- | --- |
| Number of Cores | 4 |
| CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
| RAM | 2 GiB |
| VM Type | Standard D4ds v4 Azure VM |
| Docker Runtime Configuration | `sudo docker run -d --network host --memory=1g --memory-swap=2g --log-driver json-file --log-opt max-size=100m` |

---

### 12.2 DSM Accelerator Webservice

> [!NOTE]
> NOTE
> 
> The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 20,647/20,595 |
| AES 256: GCM Encryption/Decryption | 22,088/21,656 |
| AES 256: FPE Encryption/Decryption | 9,427/9,381 |

---

### 12.3 Additional Modes

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBCNOPAD Encryption/Decryption | 22,078/21,757 |
| AES 256: CFB Encryption/Decryption | 22,124/21,584 |
| AES 256: CTR Encryption/Decryption | 22,150/21,592 |
| AES 256: OFB Encryption/Decryption | 22,011/21,666 |
| AES 256: CCM Encryption/Decryption | 22,154/21,558 |

---

## 13. Installation

To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure) packages, [Download Here](/v1/docs/dsm-installation-packages-on-prem).

## Attachments

- [DSM_5.4_Release_Note.pdf](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_5.4_Release_Note.pdf)