Improvements have been made to the Luna Cloud HSM Service creation time.
When Max Session Objects goes over 100 the user will now receive the following error message: CKR_MAX_OBJECT_COUNT_EXCEEDED.
Previously there was no session object limit set therefore there was no message sent to the user.
Bugs Found
FW 2.0 has now been FIPS approved.
The NIST Certificate verifying that FW 2.0 is now FIPS approved can be found in this Cryptographic Module Validation Program link.
The firmware versions for Luna Cloud HSM Services operating in FIPS and non-FIPS NA and EU environments have been updated. The new firmware versions based on region and FIPS mode are as follows:
In addition to the new releases, FW 2.0.1 also includes the following bug fixes:
The firmware versions for Luna Cloud HSM Services operating in NA and EU non-FIPS environments have been updated. The current firmware version based on region and FIPS mode are as follows:
Universal Cloning
Universal Cloning (CPv4) is now a supported feature when combining UC 10.5.0 and Firmware 2.0. Universal Cloning can be used for key migration to any trusted Thales HSMs that also support the Universal Cloning protocol.
In order to use the Universal Cloning feature, the following must be true:
NOTE: You can only clone between initialized partitions, and they must have the same cloning domain (secret), which is provided at the time of initialization.
More info can be found here: Universal Cloning.
In UC 10.4, a bug was found when using CKLog in Linux with a Luna Cloud HSM client package. The output was spammed with "LunaNamedSystemMutex: open() failed: No such file or directory".
In the UC 10.5 client, the new mutex folder will use the /lock directory which solves this issue.
Version 10.5 of the HSM client is now available for download from Thales Data Protection on Demand for Luna Cloud HSM services. This client supports hybrid usage of both Luna Cloud HSM services and the Luna HSM product line, as detailed in the Luna Cloud HSM Client User Guide. See Upgrade Client for more information about upgrading your client.
Added
Universal Cloning (CPv4) will be a supported feature in UC 10.5.0 but only when used with Firmware 2.0. Universal Cloning can be used for key migration to any trusted Thales HSMs that also support the Universal Cloning protocol.
In order to use the Universal Cloning feature, the following must be true:
NOTE: You can only clone between initialized partitions, and they must have the same cloning domain (secret), which is provided at the time of initialization.
More info can be found here: Universal Cloning
As of UC 10.5, the configuration of multiple users will be supported which allows multiple partition slots to be accessed from a single client instance. This allows customers to add multiple Luna Cloud HSM service UserID's (a combination of unique AuthTokenClientID, AuthTokenClientSecret, AuthTokenConfigURI) without the need to restart the application after the addition of a new UserID. This will enable a service provider to configure multiple UserID's without impacting the service any of the other users in the same UC instance.
The ability to load multiple partitions to the same UserID without impacting service to other users will also be supported. If an attempt is made to add the same partition ID to a different user that will be ignored and a Warning log will be generated.
More info can be found here: UC Dynamic UserID
For more information about client features and enhancements and client advisory notes see 10.5 Client Customer Release Notes. See Known and Resolved Issues for more information about existing problems and available workarounds.
UC 10.5.0 will be available in production by 09/09/2022.
Universal Cloning (CPv4) will be a supported feature in UC 10.5.0 but only when used with Firmware 2.0. Universal Cloning can be used for key migration to any trusted Thales HSMs that also support the Universal Cloning protocol.
In order to use the Universal Cloning feature, the following must be true:
NOTE: You can only clone between initialized partitions, and they must have the same cloning domain (secret), which is provided at the time of initialization.
As of UC 10.5, the configuration of multiple users will be supported which allows multiple partition slots to be accessed from a single client instance. This allows customers to add multiple UserID's (a combination of unique AuthTokenClientID, AuthTokenClientSecret, AuthTokenConfigURI) without the need to restart the application after the addition of a new UserID. This will enable a service provider to configure multiple UserID's without impacting the service any of the other users in the same UC instance.
The ability to load multiple partitions to the same UserID without impacting service to other users will also be supported. If an attempt is made to add the same partition ID to a different user that will be ignored and a Warning log will be generated.
More info can be found here: "Dynamic Partition Loading for Luna Cloud HSM Services"
A new certificate issuer will be used in the European data center for Luna Cloud HSM clients as of August 16th.
A knowledge base article with a full description of the change is available here. The article contains important information on mandatory changes for users on 10.0 or 10.1 client versions.
This change introduces a new endpoint for validating the certificate status. Please ensure that operating systems hosting the client are able to validate the server certificate status (OCSP/CRL) using port 80.
Ensure that these certificate revocation lists (CRLs) are accessible from the client machine prior to the planned change in August 2022 to guarantee continuity of service.
Current CRL: http://crl.godaddy.com/gdig2s1-3235.crl
New CRL: http://crl.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crl
Platform CRL: http://crl3.digicert.com/ssca-sha2-g7.crl
