---
title: "[5.8] DSM - June 26, 2026"
slug: "5-8-dsm-june-26-2026"
updated: 2026-08-22T06:49:47Z
published: 2026-08-22T06:49:47Z
canonical: "support.fortanix.com/5-8-dsm-june-26-2026"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# [5.8] DSM - June 26, 2026

Fortanix Data Security Manager (DSM) 5.8 comes with new features, general improvements, and resolved issues.

This release is superseded by the[](/v1/docs/5-8-dsm-patch-1-saas-only-july-14-2026) [August 21, 2026](/v1/docs/5-8-dsm-patch-2-august-21-2026), release.

> [!WARNING]
> WARNING
> 
> - **Some of the security fixes included in prior releases may cause a degradation of the performance of RSA and EC cryptographic operations. If cryptographic operation performance is a concern, this release should be tested before deployment in production.**
> - If you want to upgrade Fortanix DSM to version 5.8, your current DSM version must be at least 5.4 Patch 4* or 5.6 Patch 2*.
> - Downgrade from 5.8 to any prior version is not supported due to Kernel upgrades.
> 
> *******The minimum required version is specific to your current major.minor version. You must first upgrade to the required patch level within your current version before proceeding to version 5.8.**

> [!NOTE]
> NOTE
> 
> - The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.
> - The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
> - If your Fortanix DSM version is 5.7 or later, then the HSM Gateway version must also be 5.7 or later. Similarly, if the HSM Gateway version is 5.7 or later, then your Fortanix DSM version must be 5.7 or later.

## 1. New Features

- Added support for Quorum approval policy for **Secure Node Join** in the System Administration account, enabling approval of new nodes joining the cluster to require approval from a configured quorum of system administrators instead of a single administrator **(JIRA: EXTREQ-1336)**.

![Screenshot (4109).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/50716267094932)

*For more information, refer to the following articles:*
  - [*Sysadmin Settings - Quorum Policy*](/v1/docs/fortanix-data-security-manager-sysadmin-settings-guide-quorum-approval)
  - [*Fortanix DSM Secure Node Join*](/v1/docs/fortanix-dsm-secure-node-join)
  - [*Fortanix DSM Installation Guide - On-Premises*](/v1/docs/fortanix-data-security-manager-installation-guide-on-prem).

## 2. Enhancements

- Added support in Fortanix DSM user interface (UI) for configuring private claim validation for JSON Web Token (JWT) application authentication, enabling administrators to create and edit Rego-based policies that evaluate private JWT claims during application authentication **(JIRA: PM-684)**.

![Screenshot (4172).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/50716267095060)

*For more information, refer to* [*Fortanix DSM Authentication*](/v1/docs/dsm-authentication#46-json-web-token-jwt)*.*
- Added support to the Fortanix DSM UI for generating LMS keys using the LMOTS_SHA256_N24_W4 parameter set by specifying the `winternitz_width` parameter during key creation **(JIRA: PM-688)**.

![Screenshot (4173).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/50716274212116)

*For more information, refer to* [*Fortanix DSM Key Lifecycle Management*](/v1/docs/fortanix-data-security-manager-key-lifecycle-management#212-generate-security-objects)*.*
- Added support for Azure Monitor Log Ingestion API logging configurations, enabling DSM audit logs to be ingested into Azure Monitor using the Log Ingestion API as an alternative to the legacy Azure Log Analytics Data Collector API **(JIRA: EXTREQ-1652)**.

> [!NOTE]
> NOTE
> 
> This feature has only API support in the current release.
- Added support for preserving specific characters during Version 2 format-preserving tokenization (`format_v2`), while allowing other unknown characters to be selectively stripped or rejected, providing finer-grained control over token formatting **(JIRA: PM-660)**.
- Updated the Terms and Conditions link on the Fortanix DSM On-Prem sign-up page to reflect the latest DSM On-Prem License Agreement **(JIRA: PROD-11334)**.

![image (76).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/50711046782100)

## 3. Other Improvements

- Enhanced trial account enforcement by preventing crypto applications and administrative applications in expired trial accounts from authenticating and creating new sessions after trial expiration, helping reduce resource consumption **(JIRA: PROD-11151)**.
- Updated the `sdkms-cluster remove` command to require the `--version` parameter. This change ensures consistent node removal behavior during Fortanix DSM upgrades by using the specified DSM package version instead of automatically determining the version from the node being removed **(JIRA: RODE-403)**.

*For more information, refer to* [*Fortanix DSM Software Upgrade*](/v1/docs/fortanix-data-security-manager-software-upgrade)*.*
- Added support for Module-Lattice-Based Digital Signature Algorithm (ML-DSA) keys in the PKCS#10 Certificate Signing Request (CSR) Plugin, allowing users to generate CSRs for ML-DSA key pairs stored in Fortanix DSM **(JIRA: PM-673)**.
- Improved performance of SHA-3 hash calculation **(JIRA: PROD-9479)**.

## 4. API Updates

- Added support for Azure Monitor Log Ingestion API logging configurations by introducing Data Collection Rule (DCR)-based integration settings and Azure credential objects, enabling DSM audit logs to be ingested into Azure Monitor using the Log Ingestion API as an alternative to the legacy Azure Log Analytics Data Collector API **(JIRA: EXTREQ-1652)**.

This enhancement affects the following APIs:
  - `POST /sys/v1/credentials`: Create Credential
  - `PATCH /sys/v1/credentials/{credential_id}`: Update Credential
  - `PATCH /sys/v1/accounts/{account_id}`: Update Account
- Added support for configuring a Quorum approval policy for **Secure Node Join** in the System Administration account, enabling new node additions to a cluster `AllowList` to require approval from a configured quorum of system administrators **(JIRA: EXTREQ-1336)**.

This enhancement affects the following APIs:
  - `PATCH /admin/v1/cluster/node_identities/{name}`: Update Node Identity
  - `PATCH /admin/v1/cluster`: Configure Cluster
  - `POST /admin/v1/cluster/join`: Join Cluster
- Added support for the `passthrough_specific` input processing option in Version 2 tokenization keys (`format_v2`), allowing specific characters to be preserved during tokenization while other unknown characters can be configured to be stripped or rejected **(JIRA: PM-660)**.

This enhancement affects the following APIs:
  - `POST /crypto/v1/keys`: Create Security Object
  - `PATCH /crypto/v1/keys/{kid}`: Update Security Object
- Enhanced the OpenAPI documentation to support configurable DSM endpoint URLs, allowing users to specify and test API requests against their own DSM environments directly from the API documentation “**Try Me**“ interface **(JIRA: PROD-11483)**.

## 5. Client New Features, Improvements, and Bug Fixes

- Added support for the ML-DSA algorithm in Fortanix CNG library **(JIRA: EXTREQ-1625)**.
- Added Certificate Authentication support for Fortanix PKCS#11 library on Microsoft Windows **(JIRA: PM-678)**.

*For more information, refer to the* [*PKCS#11 Developers Guide*](/v1/docs/fortanix-dsm-clients-pkcs11-library#611-configuration-file-format)*.*
- Provided a workaround for a panic or crash observed in PKCS#11 flow when using OpenSSL provider with PQC algorithms **(JIRA: PM-679)**.

*For more information, refer to the* [*PKCS#11 Developers Guide*](/v1/docs/fortanix-dsm-clients-pkcs11-library#611-configuration-file-format)*.*
- Enhanced server certificate revocation validation failures observed on certain legacy Windows systems due to incorrect certificate chain order **(JIRA: ES-633)**.
- Fixed PKCS#11 library hangs observed during API requests made to DSM when connectivity to DSM was interrupted, improving keepalive duration and timeout handling **(JIRA: ES-687)**.

## 6. DSM Accelerator New Features

- Added PKCS#8 AES-CBC encrypted private key support to Fortanix DSM Accelerator Webservice mTLS client configuration, enabling the use of encrypted client keys for mTLS configuration **(JIRA: PM-676)**.

*For more information, refer to the* [*DSM Accelerator Webservice Developer Guide*](/v1/docs/dsm-accelerator-webservice-developer-guide#76-mutual-tls-mtls-based-exports)*.*

## 7. Integration and Use Cases

- Added support for Azure Managed HSM external key management, enabling Azure Managed HSM to perform cryptographic operations using keys securely managed and protected in Fortanix DSM **(JIRA: PM-613)**.

*For more information, refer to* [*Fortanix DSM with Azure Key Vault Managed HSM External Key Management*](/v1/docs/fortanix-dsm-with-azure-key-vault-managed-hsm-external-key-management).
- Enhanced the Salesforce BYOK plugin to support Salesforce External Client Apps as an alternative to Connected Apps, enabling continued integration with Salesforce as the platform transitions away from username or password-based OAuth 2.0 authentication flows **(JIRA: EXTREQ-1551)**.

*For more information, refer to* [*Exporting Fortanix DSM Keys to Cloud Providers for BYOK - Salesforce*](/v1/docs/exporting-fortanix-dsm-keys-to-cloud-providers-for-byok-salesforce)*.*

## 8. Quality Enhancements

- The third-party software upgrade list can be found [*here*](/v1/docs/list-of-third-party-software-installed-5-8).

## 9. Security Fixes

- Updated Linux kernel from 6.8.0-117 to 6.8.0-124 to improve system stability and ensure alignment with the latest upstream kernel fixes **(JIRA: RODE-511)**.

## 10. Bug Fixes

- Fixed an issue that prevented user’s from updating custom Certificate Authority (CA) certificates for **Splunk** integrations in **Log Management** through the Fortanix DSM UI, resulting in an incorrect certificate validation error for valid PEM-formatted certificates **(JIRA: ES-641)**.
- Fixed an issue where health check requests to the `/health` endpoint on port 4445 could return an HTTP 502 response from the Fortanix DSM proxy service, causing health check failures despite the service being available **(JIRA: RODE-395)**.
- Fixed an issue where HTTP-based health checks to the `/health` endpoint returned an **HTTP 404** response, preventing external load balancers from receiving a successful health check status **(JIRA: RODE-383)**.
- Fixed an issue that could cause inaccurate time calculations within enclaves, affecting time-dependent operations **(JIRA: ES-603)**.
- Fixed an issue that could cause Azure Bring Your Own Key (BYOK) key rotation operations to fail and trigger `sdkms` pod instability, resulting in errors when viewing key links **(JIRA: ES-608)**.
- Fixed an issue where bearer tokens generated using a previous application API key could not be used to perform operations during the configured grace period after the API key was regenerated using the Fortanix DSM UI using the **REGENERATE** option in the application’s detailed view **(JIRA: EXTREQ-1688)**.
- Fixed an issue where the Rotate to Existing Key dialog box did not return all matching keys in search results when Fortanix DSM contained a large number of keys **(JIRA: ROFR-5930)**.
- Fixed an issue where the digest algorithm for Leighton-Micali Signature (LMS) keys appeared as empty in the Fortanix DSM UI and as null in API responses instead of SHA256 **(JIRA: PROD-11444)**.
- Fixed an issue that could generate erroneous audit log entries reporting "App failed to authenticate, application id: Unknown" for failed KMIP authentication attempts, resulting in invalid application lookups in the Audit Logs UI **(JIRA: ES-632)**.

## 11. Known Issues

- If a Fortanix DSM software download initiated through a URL (UI or API) is interrupted (for example, due to a page refresh or network issue), retrying the download may fail with: `Another download is still in progress (HTTP 409).` The previous attempt may continue to be treated as active, and the state is not cleared automatically **(JIRA: PROD-11136)**. **Workaround:** Use alternative methods such as uploading the build from a local file through the DSM UI, using CLI upload, or downloading the build directly on the cluster node (for example, with `wget`).
- On VMware nodes, `/etc/resolv.conf` may be cleared after a reboot, resulting in missing nameserver entries. Although the `/etc/network/interfaces` configuration is correct, any manual updates to `/etc/resolv.conf` are overwritten after a reboot or when the CoreDNS pod restarts **(JIRA: RODE-373)**.

**Workaround**:

Perform the following steps:
  1. Run `sudo apt purge netplan.io`.
  2. If the file is removed or CoreDNS continues to have issues, manually update the nameserver entries in `/etc/resolv.conf`.
  3. Restart networking: `sudo systemctl restart networking`.
  4. Delete the CoreDNS pods to allow them to restart.
- When creating a System Administration **Quorum approval policy** in DSM on a cluster where Secure Node Join is not enabled, the policy summary dialog may incorrectly display **Secure node join** as selected under **Operations that require Quorum approval**. This is a display issue only and does not affect policy enforcement **(JIRA: ROFR-5978)**.
- When users edit a quorum approval policy configured with multiple reviewers, DSM may display the **Using second factor security key is required to approve requests** check box as unchecked in the **Quorum approval policy** screen, even though multi-factor authentication (MFA) enforcement continues to work as expected **(JIRA: PROD-11444)**.
- A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account **(JIRA: ROFR-4998)**. **Workaround**: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.
- The **COPY KEY** dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (**JIRA: ROFR-5167**)
- Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation **(JIRA: PROD-9409)**. **Workaround**: To delete the invited user, contact Fortanix Support or perform the following steps:
  - If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:
    - Change the user's account role to "Account Member".
    - Remove the group memberships one by one using the user interface.
    - Delete the user.
- The `sudo get_csrs --rotate` workflow does not support changing existing DNS hostnames configured in the service URL or Subject Alternative Name (SAN) entries **(JIRA: PROD-9542)**.

This issue occurs when:

For example, if the existing service URL hostname is `dsm.fortanix.net`, changing it to a different hostname while using certificate rotation is not supported.

**Workaround**:
  - `get_csrs --rotate` is used to generate CSRs, and
  - `install_certs --rotate` is used to install certificates where existing DNS/SAN hostnames (single or multiple) are modified or replaced.
  - Do not use the `--rotate` option when changing existing DNS/SAN hostnames.
  - If certificate rotation is required with SAN certificates, retain the existing DNS entries and append additional DNS entries instead of replacing or modifying the current ones.
- When you run `sudo get_csrs --rotate` command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results **(JIRA: RODE-97)**.
- Deleting replica keys in groups with Key undo policies is reversible using the undo operation **(JIRA: PROD-9925)**. **Workaround**: Users should avoid deleting keys that are associated with a key-undo policy.
- The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (**JIRA: PROD-10441**). **Workaround**: Set the retention period to 2 days or longer under **Settings→ LOG MANAGEMENT → Retention periodfor Audit Logs** to ensure recent audit log entries are visible.
- Unable to perform Kubernetes CA rotation successfully (**JIRA: RODE-62**). **Workaround**: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.
- When Fortanix DSM contains a large number of objects (for example, ~1000 groups, plugins, apps, and users, and ~11,000 security objects), certain UI pages may load slower than usual (**JIRA: PROD-11135**). **Workaround**: There is currently no direct workaround. As a mitigation, it is recommended to reduce the number of objects displayed using filters or pagination and use APIs for bulk operations instead of UI navigation in large-scale environments.
- When upgrading to Fortanix DSM version 5.7, the `sdkms` pod becomes stuck in the `ContainerCreating` state (**JIRA: ES-637**). **Workaround:** Edit the `sdkms` deployment and remove the following to continue the upgrade:

```plaintext
- mountPath: /root/enclave-runner
   name: enclave-runner
```

and

```plaintext
- hostPath:
    path: /var/opt/fortanix/swdist/data/v3522/config/chart/charts/infra/enclave-runner
    type: File
   name: enclave-runner
```

## 12. Fortanix Data Security Manager Performance Statistics

> [!NOTE]
> NOTE
> 
> Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations. Fortanix is actively investigating this issue and evaluating potential mitigations. At this time, performance benchmark results against Fortanix 4.x releases should not be directly compared to results against 5.x releases.

### 12.1 Series 3

> [!NOTE]
> NOTE
> 
> The numbers provided for **Series 3** - Khyber ML-KEM, LMS, and BIP32 are for 1-node S3 clusters; for multiple nodes, these numbers can be multiplied by the number of nodes added.

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 19,160/19,020 |
| AES 256: GCM Encryption/Decryption | 19,166/19,086 |
| AES 256: FPE Encryption/Decryption | 14,169/13,368 |
| AES 256 Key Generation | 2,365 |
|  |  |
| RSA 2048 Encryption/Decryption | 14,500/1,746 |
| RSA 2048 Key Generation | 36 |
| RSA 2048 Sign/Verify | 1,736/15,388 |
| RSA 4096 Sign/Verify | 495/11.360 |
|  |  |
| EC NISTP256 Key Generation | 1,463 |
| EC NISTP256 Sign/Verify | 2,985/1,611 |
| EC secP256K1 Key Generation | 1,428 |
| EC secP256K1 Sign/Verify | 2,684/1,432 |
|  |  |
| Kyber ML-KEM Encapsulation | 1,702 |
| Kyber ML-KEM Decapsulation | 1,713 |
|  |  |
| LMS Key (Height, Node) |  |
| L1 5, Node 24 | 114.5 |
| L1 5, Node 32 | 87.4 |
| L1 10, Node 24 | 3.6 |
| L1 10, Node 32 | 2.7 |
|  |  |
| BIP32 Key Derive as Transient Hardened Child Key | 440 |
| BIP32 Sign | 440 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 3,090 (invocations/second) |

---

### 12.2 Series 3 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,891/5,946 |
| AES 256 Key Generation | 1,843 |
|  |  |
| RSA 2048 Key Generation | 13 |
| RSA 2048 Sign/Verify | 549/2,927 |
| RSA 4096 Sign/Verify | 160/2,380 |
|  |  |
| EC NISTP256 Key Generation | 751 |
| EC NISTP256 Sign/Verify | 913/515 |
| EC secP256K1 Key Generation | 696 |
| EC secP256K1 Sign/Verify | 806/460 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 3,110 (invocations/second) |

---

### 12.3 Series 2

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 6,199/6,163 |
| AES 256: GCM Encryption/Decryption | 6,052/6,191 |
| AES 256: FPE Encryption/Decryption | 4,647/4,652 |
| AES 256 Key Generation | 1,292 |
|  |  |
| RSA 2048 Encryption/Decryption | 5,364/865 |
| RSA 2048 Key Generation | 21 |
| RSA 2048 Sign/Verify | 862/5,357 |
| RSA 4096 Sign/Verify | 260/4,318 |
|  |  |
| EC NISTP256 Key Generation | 841 |
| EC NISTP256 Sign/Verify | 1,424/812 |
| EC secP256K1 Key Generation | 767 |
| EC secP256K1 Sign/Verify | 1,155/659 |
|  |  |
| Kyber ML-KEM Encapsulation | 1,237 |
| Kyber ML-KEM Decapsulation | 1,131 |
|  |  |
| LMS Key (Height, Node) |  |
| L1 5, Node 24 | 138 |
| L1 5, Node 32 | 109 |
| L1 10, Node 24 | 4.9 |
| L1 10, Node 32 | 3.8 |
|  |  |
| BIP32 Key Derive as Transient Hardened Child Key | 586 |
| BIP32 Sign | 586 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,573 (invocations/second) |

---

### 12.4 Azure Standard_DC8s_v3

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8s_v3] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 4,503/4,512 |
| AES 256: GCM Encryption/Decryption | 4,484/4,506 |
| AES 256: FPE Encryption/Decryption | 3,614/3,630 |
| AES 256 Key Generation | 1,521 |
|  |  |
| RSA 2048 Encryption/Decryption | 4,050/780 |
| RSA 2048 Key Generation | 21 |
| RSA 2048 Sign/Verify | 768/4,151 |
| RSA 4096 Sign/Verify | 240/3,419 |
|  |  |
| EC NISTP256 Key Generation | 791 |
| EC NISTP256 Sign/Verify | 1,221/712 |
| EC secP256K1 Key Generation | 720 |
| EC secP256K1 Sign/Verify | 1,053/596 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 3,771 (invocations/second) |

---

### 12.5 Series 2 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,704/5,691 |
| AES 256 Key Generation | 1,304 |
|  |  |
| RSA 2048 Key Generation | 21 |
| RSA 2048 Sign/Verify | 769/2,869 |
| RSA 4096 Sign/Verify | 259/2,500 |
|  |  |
| EC NISTP256 Key Generation | 829 |
| EC NISTP256 Sign/Verify | 1,153/720 |
| EC secP256K1 Key Generation | 752 |
| EC secP256K1 Sign/Verify | 998 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,512 (invocations/second) |

---

### 12.6 Azure Standard DC8 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8 JCE] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 4,398/4,390 |
| AES 256 Key Generation | 1,521 |
|  |  |
| RSA 2048 Key Generation | 21 |
| RSA 2048 Sign/Verify | 675/2,305 |
| RSA 4096 Sign/Verify | 225/2,047 |
|  |  |
| EC NISTP256 Key Generation | 799 |
| EC NISTP256 Sign/Verify | 1,014/637 |
| EC secP256K1 Key Generation | 712 |
| EC secP256K1 Sign/Verify | 892/546 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 892/546 |

---

## 13. Fortanix Data Security Manager Accelerator Performance Statistics

### 13.1 Runtime Environment

> [!NOTE]
> NOTE
> 
> The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

| **Item** | **Specification** |
| --- | --- |
| Number of Cores | 4 |
| CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
| RAM | 2 GiB |
| VM Type | Standard D4ds v4 Azure VM |
| Docker Runtime Configuration | `sudo docker run -d --network host --memory=1g --memory-swap=2g --log-driver json-file --log-opt max-size=100m` |

---

### 13.2 DSM Accelerator Webservice

NOTE The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 20,074/20,067 |
| AES 256: GCM Encryption/Decryption | 21,322/20,784 |
| AES 256: FPE Encryption/Decryption | 9,277/9,250 |

---

### 13.3 Additional Modes

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBCNOPAD Encryption/Decryption | 21,187/20,895 |
| AES 256: CFB Encryption/Decryption | 21,270/20,824 |
| AES 256: CTR Encryption/Decryption | 21,295/20,907 |
| AES 256: OFB Encryption/Decryption | 21,330/20,941 |
| AES 256: CCM Encryption/Decryption | 21,239/20,812 |

---

## 14. Installation

To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure) packages, [Download Here](/v1/docs/dsm-installation-packages-on-prem).

## Attachments

- [DSM_5.8_Release_Note.pdf](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_5.8_Release_Note.pdf)