[4.31] - August 06, 2024

Fortanix Data Security Manager (DSM) 4.31 comes with some exciting new features, improvements, and resolved issues.

WARNING

• You are required to upgrade Fortanix DSM to version 4.23 or 4.27 before upgrading to version 4.31.
• Downgrade from 4.31 to any prior version is not supported due to the Kubernetes version upgrade. 

NOTE

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.
• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
• If your Fortanix DSM version is 4.13 or later, then the HSM gateway version must also be 4.13 or later. Similarly, if the HSM Gateway version is 4.13 or later, then your Fortanix DSM version must be 4.13 or later.

1. New Features

• This release supports a new feature for DCAP (Data Center Attestation Primitives) clusters that allows Fortanix DSM system administrators to control the joining of new nodes to the cluster, ensuring that only trusted nodes can be added to this cluster. A new tab called TRUST CENTER is added to the System Administration → CLUSTER page where the system administrators can maintain the list of trusted CPU identities (IDs) (JIRA: PM-110).
  
  For more information, refer to the Fortanix Data Security Manager Installation Guide - On-Prem.

2. Other Improvements

• Updated the groups (sys/v1/groups) and apps (sys/v1/apps) API to support list limit and sorting (JIRA: PM-205).
• Implemented improvements to make Cassandra and sdkms pods tolerant of NotReady nodes (JIRA: DEVOPS-4938).
• Enabled null attestation as the default attestation method for DSM Non-SGX nodes (JIRA: DEVOPS-4819). For more details, refer to the Fortanix Data Security Manager Software Pre-Upgrade Checks – Manual.

3. Client Improvements

• Enhanced the EKM client to always use basic authentication tokens (API keys) for all the cryptographic operations to optimize the session management process (JIRA: PROD-8660).
• Updated the End User License Agreement (EULA) in the Windows client installer to reflect the latest terms and conditions (JIRA: PROD-8892).
• The Sequoia PGP client now supports generating keys of type nistp256, nistp384, nistp521, and rsa2k (JIRA: PM-381).

4. DSM-Accelerator Improvements and Bug Fixes

• DSM-Accelerator JCE Provider
  • A new variant of DSM-Accelerator JCE Provider Thin client is now created as a single unified JAR that contains the Fortanix dependencies (sdkms-client and dsm-accelerator) (JIRA: PROD-8857).
    For more details, refer to the following documents:
    
    • DSM Accelerator JCE Provider Deployment Guide
    • DSM Accelerator JCE Provider Downloads
  • Improved the key retrieval process in the DSM-Accelerator JCE Provider to utilize the cached data more efficiently (JIRA: PROD-8799).
  • Fixed the NoPadding scheme for the DSM-Accelerator JCE Provider where the ciphertext length correctly matches the input length (JIRA: ES-385).

5. Integrations and Use Cases

• Fortanix DSM now integrates with Databricks for seamless tokenization and detokenization operations (JIRA: ROQA-5580).
  For more information, refer to the Using Fortanix Data Security Manager with Databricks.

6. Quality Enhancements

• Upgraded Kubernetes to version 1.29.6 (JIRA: DEVOPS-4625).
  For more information, refer to the Administration Guide: Fortanix Data Security Manager (Release 4.31) Kubernetes Version Upgrade to 1.29 K8s.
• Updated the fluentd image to version 1.16.2-debian-1.1 (JIRA: DEVOPS-4867).
  

7. Bug Fixes

• Fixed a Cassandra timeout issue when loading the Fortanix DSM Dashboard for accounts with more than three million security objects (JIRA: ES-342).
• Fixed an issue where the user was unable to import a wrapped AES key into Fortanix DSM (JIRA: ES-374).
• Fixed an issue where the deactivation_date was not being set in copy-based key rotation (JIRA: PROD-7656).
• Fixed an issue where Fortanix DSM nodes were not entering the reboot cycle after being drained (JIRA: DEVOPS-4648).
• Fixed and issue where importing an ECSecP256K1 key into a hardware-protected Azure Premium Key Vault failed in the browser UI (JIRA: PROD-8808).
• Fixed an issue where linked keys were not being rotated correctly (JIRA: ROFR-4989).

8. Known Issues

• A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).
  Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.
• When you edit the starting time of a Key rotation policy for a security object with the value as single digit time, for example: 01:00 am, it shows an error “Invalid date/time selected. Please make sure you filled in a valid 12-hour time” (JIRA: ROFR-4786).
  Workaround: Re-enter the rotate start time by removing the “0” before the single digit time and enter a new time (for example, 01:00 am to 2:00 am).
• After downgrading Fortanix DSM to version 4.25, it still shows the Node size field with a null value for LMS keys that were added in DSM version 4.26, even though the Node size is not a supported parameter in the older version (JIRA: PROD-8278).
• Unable to create an LMS key with the following height combinations of 20 (JIRA: PROD-8248).
  
  • 5, 20, and vice versa.
• The hyperlink color for the field “Follow the instructions in” in the “Add Instance” form for Google Workspace Client-Side Encryption (CSE) still reflects the old link color value (JIRA: ROFR-4789).
  
  
• The sync key API returns a “400 status code and response error” if its short-term access token expires during the synchronization of a group linked to AWS KMS (JIRA: PROD-3903).
  Workaround: Increase the timeout of the temporary session token beyond the expected duration of the sync key operation.
• exclude does not work in the proxy configuration for operations such as attestation (JIRA: PROD-3311).
• If an Azure key is rotated and then soft-deleted, only one version of the key is soft-deleted (JIRA: PROD-6947).
  Workaround: Perform a key scan in DSM to synchronize the key state with Azure.
• The create operation for security object creation does not work for the Azure Managed HSM plugin (JIRA: PROD-7078).
• Copying an RSA or EC key from a normal DSM group to an AWS KMS-backed DSM group does not work as expected and results in an error (JIRA: PROD-7787).
  Workaround: Export the RSA or EC key from the normal DSM group and import it into the AWS KMS-backed DSM group.
• The Fortanix DSM user interface (UI) fails to load groups beyond 1000. Therefore, any security object associated with a group beyond 1000 will not be displayed (JIRA: ROFR-4378).
• The admin applications (apps) cannot retrieve the details for GET /users/{uuid} and instead returns the error "Inappropriate authorization for the requested operation" (JIRA: PROD-9212).
  Workaround: Use GET /users/{uuid} using the system administrator credentials to retrieve the user ID details.
• If the email configuration is incorrect, clicking RESEND VERIFICATION EMAIL on the Fortanix DSM user interface (UI) will result in a 500 Internal Server Error from the resend_confirm_email API (JIRA: PROD-9243).
  
  TIP

  Before enforcing email confirmation, ensure the System Administrator's email has been confirmed. Otherwise, if the email configuration is incorrect, the administrator might get locked out of the system.
  Workaround: Email verification is not enforced for the entire cluster; therefore, only a few users must verify their emails. If the email configuration is incorrect, their accounts will remain accessible and not be blocked.

9. Fortanix Data Security Manager Performance Statistics

9.1 Series 2

Key Types and Operations	Throughput (Operations/second on a  3-node cluster re-using a single TLS session)
AES 256: CBC Encryption/Decryption	4,489/4,583
AES 256: GCM Encryption/Decryption	4,567/4,369
AES 256: FPE Encryption/Decryption	2,425/2,416
AES 256 Key Generation	1,219
RSA 2048 Encryption/Decryption	4,107/1,130
RSA 2048 Key Generation	34
RSA 2048 Sign/Verify	1,114/4,064
RSA 4096 Sign/Verify	377/3,521
EC NISTP256 Sign/Verify	1,122/639
Kyber ML-KEM Encapsulation	1,164
Kyber ML-KEM Decapsulation	1,088
LMS Key (Height, Node)
L1 5, Node 24	31.17
L1 5, Node 32	26.02
L1 10, Node 24	1.01
L1 10, Node 32	0.82
Data Security Manager Plugin (Hello world plugin)	1,730 (invocations/second)

________________________________________________________________________________________________________________

9.2 Azure Standard_DC8_v2

Key Types and Operations	Throughput (Operations/second on a  3-node [Standard_DC8_v2] cluster re-using a single TLS session)
AES 256: CBC Encryption/Decryption	3,539/3,514
AES 256: GCM Encryption/Decryption	3,495/3,520
AES 256: FPE Encryption/Decryption	2,160/2,136
AES 256 Key Generation	1,045
RSA 2048 Encryption/Decryption	3,400/1,239
RSA 2048 Key Generation	44
RSA 2048 Sign/Verify	1,217/3,296
RSA 4096 Sign/Verify	516/3,120
EC NISTP256 Sign/Verify	978/575
Data Security Manager Plugin (Hello world plugin)	1,845 (invocations/second)

________________________________________________________________________________________________________________

9.3 Series 2 JCE

Key Types and Operations	Throughput (Operations/second on a  3-node cluster re-using a single TLS session)
AES 256: CBC Encryption/Decryption	4,209/4,179
AES 256 Key Generation	1,216
RSA 2048 Key Generation	33
RSA 2048 Sign/Verify	944/2,200
RSA 4096 Sign/Verify	320/1,760
EC NISTP256 Sign/Verify	991/622
Data Security Manager Plugin (Hello world plugin)	1,905 (invocations/second)

________________________________________________________________________________________________________________

9.4 Azure Standard DC8 JCE

Key Types and Operations	Throughput (Operations/second on a  3-node [Standard_DC8 JCE] cluster re-using a single TLS session)
AES 256: CBC Encryption/Decryption	3,580/3,602
AES 256 Key Generation	1,075
RSA 2048 Key Generation	45
RSA 2048 Sign/Verify	961/1,877
RSA 4096 Sign/Verify	427/1,655
EC NISTP256 Sign/Verify	863/533
Data Security Manager Plugin (Hello world plugin)	1,837 (invocations/second)

10. Fortanix Data Security Manager-Accelerator Performance Statistics

10.1 Runtime Environment

NOTE

• The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
• DSM-Accelerator was run in the runtime environment listed below for performance testing.

Item	Specification
Number of Cores	4
CPU	Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz
RAM	2 GiB
VM Type	Standard D4ds v4 Azure VM
Docker Runtime Configuration	docker run -d --network host --memory=1g --memory-swap=2g --log-driver json-file --log-opt max-size=100m

________________________________________________________________________________________________________________

10.2 DSM-Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then we recommend adding multiple nodes.

Key Types and Operations	Throughput (Operations/second on a 1-node cluster re-using a single TLS session)
AES 256: CBC Encryption/Decryption	21,381/20,712
AES 256: GCM Encryption/Decryption	22,057/21,736
AES 256: FPE Encryption/Decryption	9,464/9,470

________________________________________________________________________________________________________________

10.3 Additional Modes

Key Types and Operations	Throughput (Operations/second on a 1-node cluster re-using a single TLS session)
AES 256: CBCNOPAD Encryption and Decryption	21,336/21,441
AES 256: CFB Encryption/Decryption	22,013/21,471
AES 256: CTR Encryption/Decryption	21,853/21,728
AES 256: OFB Encryption/Decryption	22,221/21,864
AES 256: CCM Encryption/Decryption	21,720/21,216

11. Installation

To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure/VMWare) packages, Download Here.