Added

There is a new patch available for the Luna service client CSP and KSP utilities available from the Thales Support Portal with the KB article number KB0024438/DOW0007000.  This patch resolves the following issues:

• HAPP-168   Performance Optimizations enabled in CSP for Luna7
• HAPP-326   Luna KSP CKA_EXTRACTABLE
• HAPP-492   certutil verifystore command shows error when keys and CSR created with CSP
• LUNA-7254  certutil issue: Not able to get the prompt back after running "certutil -store my" when KSP is registered
• LUNA-7595  KSP keygen slow
• LUNA-8100  citrix fas NTE_BAD_DATA from KSP
• LUNA-8808  CSP with CryptoUser
• LUNA-8938  citrix fas issue ckr_device_memory for KSP
• LUNA-12715 Update the KSP code to accept the new and old certificates
• LUNA-14732 CSP SHA2 signing error on Windows 10 Docker container (kspcmd utility)
• LUNA-15597 Luna KSP CKA_EXTRACTABLE test case for UC 10.4.0 regression test
• LUNA-17051 MS HGS integration
• LUNA-21611 CSP import PFX fix
• LHSM-41992 Microsoft HGS supported algorithms and flags are required for KSP
• LHSM-42509 repair ksp for citrix/fas app
• LHSM-42911 certutil crash wrt ksp and csp
• LHSM-42949 delete key via csp
• LUNA-21906 Improve KSP Resiliency/Recovery
• LUNA-21911 kspcmd.exe doesn't exit after registering slot

The patch includes a readme.txt file which provides instructions for updating your Luna service clients CSP and KSP utilities. 

Notes:

• NOTE 1. Ensure to set "FunctionBindLevel=2" in the Misc section of crystoki.ini for this release to work with clients UC 10.3 or earlier.
• NOTE 2. For Luna Cloud HSM Services, disable session cache in the registry as shown in the following REG file sample:

        Windows Registry Editor Version 5.00
        [HKEY_LOCAL_MACHINE\SOFTWARE\Safenet\SafeNetKSP\CurrentConfig]
        "SessionCacheEnabled"=dword:00000000

SHA Checksum:     e06cc15eb7906d6a2730f8cfac746a0e57b765896beea342d00590febb334cda

Removed

The PATCH /tenants/{id}/admin/reset and POST /tenants/{id}/admin/resetMfaToken operations have been removed from the DPoD Platform API.

Service provider administrators can no longer reset the password or MFA token of a user inside of a child tenant.  Users can use the self-service resources in the DPoD platform or submit requests to an available administrator. See User Management for more information.

Added

• Version 10.3 of the HSM service client is now available for download from Thales Data Protection on Demand. This client supports hybrid usage of both Luna Cloud HSM services and the Luna HSM product line, as detailed in the HSM on Demand Client User Guide. See Upgrading your Luna Cloud HSM Service Client for more information about updating your Luna Cloud HSM service client.

Bugs Found

• LUNA-14009 - Executing cmu verifyhsm does not prompt the user to enter a challenge string. Always specify a challenge string using cmu verifyhsm -challenge <string>.
• LUNA-13907 - Requesting a certificate using cmu requestcertificate using the wrong attribute to specify the private key returns an incorrect error message. Use the -privateouid to specify a private key on a Luna Cloud HSM service.
• LUNA-13780 - Executing cmu import to import a DSA key fails. Use an RSA public key instead.
• LUNA-13761 - Executing cmu selfsigncertificate with no arguments specified, on Linux, cmu fails to prompt the user for the relevant object handles/OUIDs. Always specify the object handles/OUIDs using -publichandle and -privatehandle or -publicouid and -privateouid.
• LUNA-12822 - ckmdeo option Get OUID (39) returns OUIDs with extra zeroes appended. Use option Get Attribute (24) to view the correct OUID.
• LUNA-11269 - In HA configurations, where a Luna Cloud HSM service is configured as a standby, some events (such as when a connection drops and recovers due to a timeout when contacting the service) are not recorded in the HA log file.
• SH-5595 - Deriving X9.42 DH2 keys returns CKR_OBJECT_HANDLE_INVALID. We recommend you avoid upgrading your Luna Cloud HSM service client until the issue is resolved. 
• SH-4194 - Executing cmu getpkc to confirm a public key can fail. Execute the ckdemo Display Object (27) function to confirm the key pairs origins and security in the HSM. If the CKA_NEVER_EXTRACTABLE attribute is present it confirms that the private key was created in the HSM and has never been extracted.

Bugs Fixed

• SH-4987 - The displayed serial numbers of self-signed certificates created using cmu selfsigncertificate now match the input serial number.

Added 

• Subscriber tenant administrators can complete the Add Service Elections Form, a separate commitment from the Initial Service Elections Form, to demonstrate additional service commitments to their service provider.

Bugs Found

• DPS-6769 - The Salesforce Key Broker service does not update the Last Modified At and Modified By columns in the Service Details tables when service secrets are updated.

Bugs Fixed

• DPS-6737 DPoD Terms of Service now display correctly in the Safari browser. The DPoD Terms of Service are always available from the support portal. 
• DPS-6761 - If the DPoD user interface cannot display the Salesforce Secret Type, the DPoD user interface will display the Salesforce value. 

Changed

• Non-FIPS Luna Cloud HSM service firmware has been updated to version 1.4.2. Firmware version 1.4.2 provides various performance improvements and is an enabler for future marketplace services. See Luna Cloud HSM Services for more information about FIPS and non-FIPS services.

Deprecated

• The DPoD platform will remove the ability for a service provider administrator to reset a tenant administrators account password. Tenant administrators can use the self-service password reset from the DPoD tenant login screen or request that a sibling tenant administrator reset their password.

Bugs Fixed

• SH-4366 - Firmware version 1.4.2 for non-FIPS Luna Cloud HSM services disallows the creation of a key with both the "public" and "sensitive" attribute combination.  

Added

• Added the company name as a mandatory criteria for tenant creation.

Added

• Thales Data Protection on Demand now includes an HSM on Demand with Key Export service. The HSM on Demand with Key Export provides users with remote access to an HSM with private key exporting. For more information see HSM on Demand with Key Export.

Added

• The DPoD service client is now fully compatible with CipherTrust Manager version 2.1, allowing Luna Cloud HSM services to act as the root of trust for CipherTrust Manager Instances. 
• The Service Provider Tenant Service Report, a report on all Tenants and the Services they are consuming, is now available for Service Provider Tenants in the DPoD platform. See Reporting for more information about the new report.
• The External Marketplace Name and External Marketplace Account Id columns have been added to all Service Provider reports in the DPoD platform.

Added

• Service Provider Administrator Platform Credentials. Platform credentials allow Service Provider Administrators to access and mange tenants, users, and reports using the DPoD API.

Changed

• "HSM on Demand Services" are now "Luna Cloud HSM Services"
• "Key Management on Demand Services" are now "CipherTrust Key Management Services"

Added

• The CipherTrust Key Broker for Google Cloud EKM service is now available. Register for the service through the Google Marketplace to gain access to an HSM secured key encryption key for use as a wrapping key in Google Cloud EKM. Access the service documentation for more information about the CipherTrust Key Broker for Google Cloud EKM service.

Bugs Found

• EKMS-652 - The Add Key Ring button is disabled in the CipherTrust Key Broker for Google Cloud EKM service if you attempt to create a Key Ring without first adding an EKM Policy. Create an EKM Policy before adding a Key Ring.
• EKMS-659 - The CipherTrust Key Broker for Google Cloud EKM dashboard URL shows a 404.  Access the CipherTrust Key Broker for Google Cloud EKM log in page and enter the FQDN of your CipherTrust Key Broker for Google Cloud EKM dashboard to log in.
• DPS-5823 - New service clients created in the North America (NA) environment cannot connect to a service on Windows Server 2012r2 operating systems.