1. Overview
This article provides an overview of the new features and improvements in the Fortanix Data Security Manager (DSM) Accelerator 5.5 release.
2. New Features and Improvements
DSM Accelerator Webservice:
Added support for PKCS#8 password-protected private keys in Fortanix DSM Accelerator Webservice TLS server configuration, enabling secure TLS setup with encrypted keys using password or flag-based configuration (JIRA: EXTREQ-1467).
For more information, refer to the DSM Accelerator Webservice Developer Guide.
Added certificate-based client application (app) authentication for Fortanix DSM Accelerator Webservice, allowing Fortanix DSM apps to authenticate using a client certificate instead of an API key (JIRA: EXTREQ-1541).
For more information, refer to the DSM Accelerator Webservice Developer Guide.
Added secure Database Master Key (DMK) caching for Oracle Transparent Data Encryption (TDE), integrating with Fortanix DSM Accelerator Webservice to improve resiliency and performance (JIRA: PM-519).
DSM Accelerator PKCS#11:
Updated Fortanix DSM Accelerator PKCS#11 to achieve feature parity with Fortanix DSM Accelerator Webservice, including key algorithm and mode support, key caching, RSA wrap or unwrap operations, policy awareness, client certificate–based authentication, and cached key prioritization (JIRA: PM-579).
For more information, refer to the DSM Accelerator PKCS#11 Developer Guide.
3. Fortanix Data Security Manager Accelerator Performance Statistics
3.1 Runtime Environment
NOTE
The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
DSM Accelerator was run in the runtime environment listed below for performance testing.
Item | Specification |
|---|---|
Number of Cores | 4 |
CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
RAM | 2 GiB |
VM Type | Standard D4ds v4 Azure VM |
Docker Runtime Configuration |
|
3.2 DSM Accelerator Webservice
NOTE
The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.
Key Types and Operations | Throughput (Operations/second on a 1-node cluster re-using a single TLS session) |
|---|---|
AES 256: CBC Encryption/Decryption | 20,147/20,095 |
AES 256: GCM Encryption/Decryption | 21,564/21,243 |
AES 256: FPE Encryption/Decryption | 9,314/9,355 |
3.3 Additional Modes
Key Types and Operations | Throughput (Operations/second on a 1-node cluster re-using a single TLS session) |
|---|---|
AES 256: CBCNOPAD Encryption/Decryption | 21,599/21,555 |
AES 256: CFB Encryption/Decryption | 21,786/21,011 |
AES 256: CTR Encryption/Decryption | 21,854/21,169 |
AES 256: OFB Encryption/Decryption | 21,671/21,087 |
AES 256: CCM Encryption/Decryption | 21,876/21,199 |