[5.7] DSM - May 25, 2026

Fortanix Data Security Manager (DSM) 5.7 comes with new features, general improvements, and resolved issues.

This release is superseded by the August 11, 2026, release.

WARNING

• Some of the security fixes included in this release may cause a degradation of the performance of RSA and EC cryptographic operations. If cryptographic operation performance is a concern, this release should be tested before deployment in production.

• If you want to upgrade Fortanix DSM to version 5.7, your current DSM version must be at least 5.4 Patch 4* or 5.6 Patch 2*.

• Downgrade from 5.7 to any prior version is not supported due to Kernel upgrades.

*The minimum required version is specific to your current major.minor version. You must first upgrade to the required patch level within your current version before proceeding to version 5.7.

NOTE

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.6 or later, then the HSM Gateway version must also be 5.6 or later. Similarly, if the HSM Gateway version is 5.6 or later, then your Fortanix DSM version must be 5.6 or later.

1. New Features

• Added support for Amazon Web Services (AWS) Key Management Service (KMS) on-demand key rotation for Customer Managed Keys, allowing key material to be rotated within the same AWS KMS key without creating new keys, using AWS KMS on-demand rotation APIs (JIRA: EXTREQ-1022). 

  

  For more information, refer to the following articles:

  • AWS KMS Group Setup

  • AWS KMS Group Setup - Using Easy Wizard 

• Added support for Amazon Web Services (AWS) European Sovereign Cloud (ESC) environments, enabling Bring Your Own Key (BYOK) workflows to meet EU data residency and compliance requirements (JIRA: EXTREQ-1582).

• Updated audit log export to use the cluster Fully Qualified Domain Name (FQDN) as the hostname for external log forwarding to SIEM (Security Information and Event Management) systems (Splunk and Syslog) replacing the static “sdkms” value to improve source cluster identification in multi-cluster environments (JIRA: EXTREQ-1532).

  

  For more information, refer to the following guides:

  • Logging

  • Alert Management

  • Sysadmin Settings - Log Management

2. Enhancements

• Improved Fortanix DSM security object rotation with the Rotate linked keys option so that all linked security objects now use the same key material as the source object. Previously, linked security objects were rotated independently, resulting in different key material. This update aligns rotation behavior with externally backed groups (JIRA: PM-615). 

• Improved the user experience when selecting HSM/External KMS group types by providing clearer feedback for unavailable options. An information icon is now displayed alongside restricted entries, indicating when a feature is not enabled for the account (JIRA: ROFR-5891). 

  

• Improved key rotation forms by introducing a combo box for selecting groups and security objects, making selection faster and easier (JIRA: ROFR-5862). 

  

• Improved error messages when updating key names in Fortanix DSM during rotation or copy operations, providing clearer feedback when the operation fails (JIRA: PROD-10763). 

  

3. Other Improvements

• Enhanced Software Mode (non-SGX) Cluster Master Key (CMK) security by unifying key protection under the Deployment Key Store (DKS) and deprecating the Cluster Deployment Key (CDK) mechanism. DKS now supports external HSM-backed entropy and key material per key version, with migration support from existing CDK configurations (JIRA: PM-562).

  For more information, refer to the following guides:

  • CDK Protection Using DKS

  • CDK to DKS Migration

  • CMK Rotation – Fortanix DSM Version 5.6 and Above

• Added support for ML-DSA signing and verification of pre-processed messages, including the external μ variant, in accordance with FIPS 204 (JIRA: EXTREQ-1629).

• Added support for LMOTS_SHA256_N24_W4 parameter set for LMS-based cryptographic operations, including key generation, signature creation, and signature verification. In DSM 5.7, the key generation with winternitz_width parameter set is supported only through the Fortanix DSM REST API (JIRA: EXTREQ-1597).

• Added support for ML-KEM–based hybrid key exchange in TLS 1.3 (for example, X25519MLKEM768) extending existing support for post-quantum key exchange groups (JIRA: EXTREQ-1571). 

• Added support for limiting Azure Log Analytics external logging configurations to a maximum of six per Fortanix DSM account (JIRA: PROD-11285).

4. API Updates

• Added support for AWS KMS native rotation of symmetric keys by introducing key material-level mapping (key_material_mapping,) in AWS-backed groups, enabling mapping of either AWS KMS keys or individual key materials to sobjects (JIRA: EXTREQ-1022).

  The following enhancements are introduced in the Create Group API (POST /sys/v1/groups):

  • Added key_material_mapping field with supported values:

    • AwsKeyContainerMapsToSobject (default, existing behavior)

    • AwsKeyMaterialMapsToSobject  

  • Enabled support for representing multiple key materials per AWS KMS key using:

    • key_material_id

    • key_material_index

  • Added origin field in AWS key details (response-only) to indicate key origin and enforce rotation behavior.

• Added support for verifying additional JWT private claims by introducing private_claims_policy in SignedJwtCredential, enabling configurable Rego-based policies with optional additional_logging for audit context (JIRA: PM-521).

  This enhancement affects the following APIs:

  • POST /sys/v1/apps: Create a new Fortanix DSM application

  • PATCH /sys/v1/apps/:app_id: Update a Fortanix DSM application

  • GET /sys/v1/apps/:app_id/credential: Get a Fortanix DSM application’s credential details.

• Added support for configuring the Winternitz width parameter for LMS (HSS) keys by introducing winternitz_width in LmsOptions, enabling selection of w=4  or w=8 (JIRA: EXTREQ-1597).

  This enhancement affects the following APIs:

  • POST /crypto/v1/keys: Create a new security object

  • PUT /crypto/v1/keys: Import a security object

• Added support for ML-DSA signature mode selection using MlDsaMode, including MlDsaExternalMu, enabling External Mu workflows where the mu value is provided using the hash field (JIRA: EXTREQ-1629).

  This enhancement affects the following APIs:

  • POST /crypto/v1/keys/sign: Sign one or more keys

  • POST /crypto/v1/keys/verify: Verify with one or more public keys

• Added support in the existing cluster TLS configuration Admin API for additional post-quantum hybrid key exchange groups in TLS 1.3 server configuration, enabling administrators to configure X25519_MLKEM_768, SECP256R1_MLKEM_768, and SECP384R1_MLKEM_1024 for enhanced handshake security (JIRA: EXTREQ-1571). 

• Added additional security-related headers to API responses as a defense-in-depth mechanism (JIRA: PROD-11214).

5. Client New Features, Improvements, and Bug Fixes

• Added support for configuring HSM Gateway health check ports using the /etc/default/ftx-hmg configuration file. You can now optionally specify custom HTTP/HTTPS health check ports, which are applied when the service starts (JIRA: PROD-11197).

  For more information, refer to HSM Gateway.

• Added support for importing wrapped key pair into Fortanix DSM using the Fortanix PKCS#11 library (JIRA: ES-615).

• Upgraded the Fortanix PKCS#11 library from 3.0 to 3.2 and added support for ML-DSA algorithm (JIRA: EXTREQ-1518).

  For more information, refer to PKCS#11 Library.

• Enhanced Fortanix PKCS#11 library error handling to return more specific and appropriate error codes (JIRA: EXTREQ-1222).

• Enhanced the Fortanix PKCS#11 library with the following (JIRA: PROD-11233):

  • Added sanity checks for C_SignInit.

  • Fixed no CKF_RW_SESSION scenario in C_GetSessionInfo.

• Fixed an issue in the Fortanix PKCS#11 library on Linux where the last intermediate certificate was missed during server certificate chain revocation checks(JIRA: ES-620). 

• Fixed an issue in the Fortanix PKCS#11 library on Windows where the last intermediate certificate was missed during server certificate chain revocation checks (JIRA: ES-621).

6. Integration and Use Cases

• Added an Azure DevOps extension on the Visual Studio Marketplace that enables pipelines to securely retrieve secrets from Fortanix DSM at runtime, eliminating the need to store secrets in pipeline configurations (JIRA: EXTREQ-750). 

  For more information, refer to Fortanix DSM with Azure DevOps. 

7. Quality Enhancements

• The third-party software upgrade list can be found here.

8. Bug Fixes

• Fixed an issue where the Rotate Linked Keys option was missing after the first rotation, preventing subsequent rotations of linked security objects (JIRA: EXTREQ-1671).

• Fixed an issue where the DSM user interface (UI) displayed an incorrect CKA_ID value for keys. The UI now reflects the correct value as returned by the PKCS#11 interface (JIRA: ES-609).

• Fixed an issue that caused intermittent delays in key export operations leading to response times exceeding 60 seconds for some requests causing inconsistent latency across applications (JIRA: ES-601).

• Fixed an issue where the REDIRECT toggle in Fortanix DSM System Administration Settings → INTERFACES was automatically enabled after renewing cluster certificates (JIRA: ES-605).

• Fixed an issue in the DSM group’s ADD USERS workflow where adding users before the existing user list is fully loaded could unintentionally remove users from the group (JIRA: ES-592). 

• Fixed an issue where Fortanix DSM security object activity logs intermittently displayed a blank page (JIRA: ES-629).

9. Security Fixes

• Fixed a security issue to improve session management and overall account protection (JIRA: PROD-11225).

• Fixed an issue where certain validation checks for enclave build artifacts were not consistently executed (JIRA: PROD-11281). 

• Fixed platform security hardening issues related to Linux kernel protections (JIRA: RODE-496).

• Updated Linux kernel from 6.8.0-111 to 6.8.0-117 to improve system stability and ensure alignment with the latest upstream kernel fixes (JIRA: RODE-494).

• Disabled AF_ALG kernel module and rebuilt kernel across all platform configurations to improve system security posture and stability (JIRA: RODE-478).

10. Known Issues

• If a Fortanix DSM software download initiated through a URL (UI or API) is interrupted (for example, due to a page refresh or network issue), retrying the download may fail with:
  Another download is still in progress (HTTP 409).
  The previous attempt may continue to be treated as active, and the state is not cleared automatically (JIRA: PROD-11136).
  Workaround:
  Use alternative methods such as uploading the build from a local file through the DSM UI, using CLI upload, or downloading the build directly on the cluster node (for example, with wget).

• On VMware nodes, /etc/resolv.conf may be cleared after a reboot, resulting in missing nameserver entries. Although the /etc/network/interfaces configuration is correct, any manual updates to /etc/resolv.conf are overwritten after a reboot or when the CoreDNS pod restarts (JIRA: RODE-373).

  Workaround:

  Perform the following steps:

  1. Run sudo apt purge netplan.io.

  2. If the file is removed or CoreDNS continues to have issues, manually update the nameserver entries in /etc/resolv.conf.

  3. Restart networking: sudo systemctl restart networking.

  4. Delete the CoreDNS pods to allow them to restart.

• When DSM contains hundreds of keys, the Rotate to Existing Key dialog may not return all matching keys in the search results (JIRA: ROFR-5930).

• For LMS keys, the digest algorithm may appear as empty in the DSM UI and as null in API responses instead of SHA256 (JIRA: PROD-11335). 

• When users edit a quorum approval policy configured with multiple reviewers, DSM may display the Using second factor security key is required to approve requests check box as unchecked in the Quorum approval policy screen, even though multi-factor authentication (MFA) enforcement continues to work as expected (JIRA: ROFR-5940).

• When using an external load balancer configured with HTTP-based health checks on port 4445 (for example, GET /sys/v1/health or /health), the endpoint returns an HTTP 404 (Not Found) response starting from DSM version 5.2 (JIRA: RODE-383).

• A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).

  Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167)

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate workflow does not support changing existing DNS hostnames configured in the service URL or Subject Alternative Name (SAN) entries (JIRA: PROD-9542). 

  This issue occurs when:

  • get_csrs --rotate is used to generate CSRs, and

  • install_certs --rotate is used to install certificates where existing DNS/SAN hostnames (single or multiple) are modified or replaced.

  For example, if the existing service URL hostname is dsm.fortanix.net, changing it to a different hostname while using certificate rotation is not supported. 

  Workaround:

  • Do not use the --rotate option when changing existing DNS/SAN hostnames.

  • If certificate rotation is required with SAN certificates, retain the existing DNS entries and append additional DNS entries instead of replacing or modifying the current ones.

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results (JIRA: RODE-97).

• Deleting replica keys in groups with Key undo policies is reversible using the undo operation (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
  Workaround: Set the retention period to 2 days or longer under Settings→ LOG MANAGEMENT  → Retention periodfor Audit Logs to ensure recent audit log entries are visible.

• Unable to perform Kubernetes CA rotation successfully (JIRA: RODE-62).
  Workaround: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.

• When Fortanix DSM contains a large number of objects (for example, ~1000 groups, plugins, apps, and users, and ~11,000 security objects), certain UI pages may load slower than usual (JIRA: PROD-11135).
  Workaround: There is currently no direct workaround. As a mitigation, it is recommended to reduce the number of objects displayed using filters or pagination and use APIs for bulk operations instead of UI navigation in large-scale environments.

• When upgrading to Fortanix DSM version 5.7, the sdkms pod becomes stuck in the ContainerCreating state (JIRA: ES-637). 
  Workaround: Edit the sdkms deployment and remove the following to continue the upgrade:

  - mountPath: /root/enclave-runner
     name: enclave-runner

  and

  - hostPath:
      path: /var/opt/fortanix/swdist/data/v3522/config/chart/charts/infra/enclave-runner
      type: File
     name: enclave-runner

11. Fortanix Data Security Manager Performance Statistics

NOTE

Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations. Fortanix is actively investigating this issue and evaluating potential mitigations. At this time, performance benchmark results against Fortanix 4.x releases should not be directly compared to results against 5.x releases.

11.1 Series 3

NOTE

The numbers provided for Series 3 - Khyber ML-KEM, LMS, and BIP32 are for 1-node S3 clusters; for multiple nodes, these numbers can be multiplied by the number of nodes added.

11.2 Series 3 JCE

11.3 Series 2

11.4 Azure Standard_DC8s_v3

11.5 Series 2 JCE

11.6 Azure Standard DC8 JCE

12. Fortanix Data Security Manager Accelerator Performance Statistics

12.1 Runtime Environment

NOTE

The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

12.2 DSM Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

12.3 Additional Modes