1. Overview
This article provides an overview of general improvements and resolved issues in the Fortanix Data Security Manager (DSM) Accelerator 4.21 release.
2. New Features/Improvements
DSM Accelerator Webservice:
Added support for encrypt operation using a key name for DSM Accelerator Webservice (JIRA: PROD-7192).
For more details, refer to Developer’s Guide: DSM Accelerator Webservice
DSM Accelerator JCE Provider:
Added support for the encrypt, decrypt, sign, and verify operations using a key name for DSM Accelerator Webservice (JIRA: PROD-7192).
Added support for encrypt operation using a key name for DSM Accelerator JCE Provider (JIRA: PROD-7178).
Added support for tokenization key generation in the DSM Accelerator JCE Provider (JIRA: PROD-7064).
Consolidated the DSM Accelerator JCE provider and Java SDK and published API documentation for consolidated DSM Java client (JCE and Java SDK) (JIRA: PM-70).
For more details, refer to Developer’s Guide: DSM Accelerator JCE Provider.
3. Bug Fixes
DSM Accelerator Webservice:
Fixed an issue where the DSM Accelerator Webservice did not work as expected when a rotated key that was deactivated before
cache_ttlexpiry was still able to perform encrypt and decrypt operations aftercache_ttlexpiry (JIRA: PROD-7241).Fixed an issue where the status code for DSM Accelerator Webservice showed 500 instead of 400 for batch sign Curve Ed25519/X25519 which is not supported (JIRA: PROD-7007).
4. Fortanix Data Security Manager Accelerator Performance Statistics
4.1 Runtime Environment
NOTE
The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
DSM Accelerator was run in the runtime environment listed below for performance testing.
Item | Specification |
|---|---|
Number of Cores | 4 |
CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
RAM | 16 GiB |
Docker Runtime Configuration |
|
4.2 DSM Accelerator Webservice
NOTE
The performance numbers below are captured with a single node; if you need higher performance or throughput, then we recommend adding multiple nodes.
Key Types and Operations | Throughput (Operations/second on a 1-node cluster) |
|---|---|
AES 256: CBC Encryption/Decryption | 15,899/15,934 |
AES 256: GCM Encryption/Decryption | 15,988/16,390 |
AES 256: FPE Encryption/Decryption | 4,859/4,757 |
4.3 Additional Modes
Key Types and Operations | Throughput (Operations/second on a 1-node cluster) |
|---|---|
AES 256: CBCNOPAD Encryption/Decryption | 16,409/16,563 |
AES 256: CFB Encryption/Decryption | 16,047/16,376 |
AES 256: CTR Encryption/Decryption | 16,704/16,716 |
AES 256: OFB Encryption/Decryption | 16,832/16,817 |
AES 256: CCM Encryption/Decryption | 15,790/16,112 |