Added

The Thales Luna Cloud HSM service is now available through Google Cloud Marketplace. Provisioning a Luna Cloud HSM service through Google Cloud Marketplace automatically generates a Thales Data Protection on Demand (DPoD) tenant and registers the user as the primary tenant administrator. The DPoD tenant provides access to features such as reporting and user and account management.

See the Thales Luna Cloud HSM service and Thales Data Protection on Demand documentation for more information.

The authentication method used by the 10.0 and 10.1 version of the Luna Cloud HSM client is being deprecated. Clients using this authentication will no longer be supported by the Luna Cloud HSM service after December 31, 2021. 

We recommend you upgrade your client to the latest version at your earliest convenience. See Upgrading your client for more information.

Added:

Thales Data Protection on Demand can support requests to restore a Luna Cloud HSM Service partition to a previous state. 

Partition snapshots are taken daily and stored for 7 days. A tenant administrator can submit a partition snapshot restore request to have a partition restored to a previous state. Users can request restoration of a partition to recover from catastrophic events such as accidental zeroization of the service partition. Partition rollbacks can take up to 48 hours to complete.

Restoring a partition will undo any changes made to the service partition since the backup date, this includes removing new objects from the service partition and resetting password changes. 

Please download and complete the Partition Snapshot Restoration Request Form and include it in your support request to Thales Customer Support Portal. 

See the Partition Snapshot Restoration Guide for more information.

CipherTrust Key Broker for Google Cloud EKM service users can now access their DPoD platform tenant. Users can log in to their tenant hostname URL to access DPoD platform features such as User Management, Tenant Management, and Reporting.

CipherTrust Key Broker for Google Cloud EKM service tenants do not have access to tenant features such as Subscriber Groups or Adding Services.

Added

Data Protection on Demand sends an email alert on service creation. Tenant Administrators and Application Owners in the subscriber group where the service is created receive an email alert on service creation. 

Added

The Point to Point Encryption service is now available as a free Technology Preview.

Provision the service through your Thales DPoD tenant to access a Luna Cloud HSM and a set of utilities for secure storage and generation of Base Derivation Keys (BDKs) and Derived Keys. The service provides the HSM capabilities required to decrypt electronic payment transactions first encrypted by a point-of-sale terminal. Service keys can initialize point-of-sales terminals and decrypt data originating from point-of-sales terminals. 

See the P2PE Service Documentation for more information about downloading and configuring the service. 

Added

There is a new version of GemEngine available from the Thales Support Portal with the KB article number KB0024584. 

The purpose of the this toolkit is to allow HSMs to install a working version of SafeNet's OpenSSL dynamic engine to be integrated with OpenSSL. 

This allows Luna Cloud HSMs to be used for key storage and crypto operations through OpenSSL. 

The toolkit can be used for:

1. Installing pre-built dynamic engines to be plugged into existing OpenSSL installations for various OpenSSL streams (Linux only).
2. Compiling and installing the gem dynamic OpenSSL engine against existing or new OpenSSL installations.
3. Compiling and installing OpenSSL from source including optional FIPS mode support along with the gem dynamic OpenSSL engine.
4. Integrating OpenSSL with 3rd party applications such as OpenSSH effectively using the HSM for crypto operations and storing keys. 

The toolkit includes a script named gembuild to help achieve the above goals.

Added

Thales Data Protection on Demand can support requests to configure a single Luna Cloud HSM Service Client to connect to multiple Luna Cloud HSM Services. A single set of Service Client credentials can be used for Key Migration between connected service partitions. 

Please download and complete the Client Connection to Multiple Services Request Form and include it in your support request to Thales Customer Support Portal. 

Added

There is a new patch available for the Luna service client CSP and KSP utilities available from the Thales Support Portal with the KB article number KB0024438/DOW0007000.  This patch resolves the following issues:

• HAPP-168   Performance Optimizations enabled in CSP for Luna7
• HAPP-326   Luna KSP CKA_EXTRACTABLE
• HAPP-492   certutil verifystore command shows error when keys and CSR created with CSP
• LUNA-7254  certutil issue: Not able to get the prompt back after running "certutil -store my" when KSP is registered
• LUNA-7595  KSP keygen slow
• LUNA-8100  citrix fas NTE_BAD_DATA from KSP
• LUNA-8808  CSP with CryptoUser
• LUNA-8938  citrix fas issue ckr_device_memory for KSP
• LUNA-12715 Update the KSP code to accept the new and old certificates
• LUNA-14732 CSP SHA2 signing error on Windows 10 Docker container (kspcmd utility)
• LUNA-15597 Luna KSP CKA_EXTRACTABLE test case for UC 10.4.0 regression test
• LUNA-17051 MS HGS integration
• LUNA-21611 CSP import PFX fix
• LHSM-41992 Microsoft HGS supported algorithms and flags are required for KSP
• LHSM-42509 repair ksp for citrix/fas app
• LHSM-42911 certutil crash wrt ksp and csp
• LHSM-42949 delete key via csp
• LUNA-21906 Improve KSP Resiliency/Recovery
• LUNA-21911 kspcmd.exe doesn't exit after registering slot

The patch includes a readme.txt file which provides instructions for updating your Luna service clients CSP and KSP utilities. 

Notes:

• NOTE 1. Ensure to set "FunctionBindLevel=2" in the Misc section of crystoki.ini for this release to work with clients UC 10.3 or earlier.
• NOTE 2. For Luna Cloud HSM Services, disable session cache in the registry as shown in the following REG file sample:

        Windows Registry Editor Version 5.00
        [HKEY_LOCAL_MACHINE\SOFTWARE\Safenet\SafeNetKSP\CurrentConfig]
        "SessionCacheEnabled"=dword:00000000

SHA Checksum:     e06cc15eb7906d6a2730f8cfac746a0e57b765896beea342d00590febb334cda

Removed

The PATCH /tenants/{id}/admin/reset and POST /tenants/{id}/admin/resetMfaToken operations have been removed from the DPoD Platform API.

Service provider administrators can no longer reset the password or MFA token of a user inside of a child tenant.  Users can use the self-service resources in the DPoD platform or submit requests to an available administrator. See User Management for more information.