HSM Client 10.5.0

HSM Client 10.5.0 was released in July 2022. It includes bug fixes and security updates.

>Download HSM Client 10.5.0 for Windows

>Download HSM Client 10.5.0 for Linux

>Download Minimal HSM Client 10.5.0 for Linux

New Features and Enhancements

HSM Client 10.5.0 includes the following new features and enhancements:

Universal Cloning

Cloning (or migration) of keys and objects between Thales HSMs, has been enhanced as follows.

Updated encryption

Cloning encryption is now ECC-based (formerly RSA) and separates session-key negotiation from the use of session keys for migrating/transfering keys and objects within the security perimeter of the cryptographic module with the following advantages:

>Consolidate HSM resources with secure and transparent exchanges of cryptographic material among mixed authentication modes:

multifactor quorum-authenticated and

password-authenticated partitions.

>Transfer keys to an entirely new domain, providing full interoperability between on-premises Luna Cloud HSM partitions and Luna Cloud HSM services.

Enhanced cipher suite options

Multiple cipher suites are available for cloning.

>Ciphers can be individually enabled or disabled by command.

>The protocol negotiates the strongest common suite enabled on source and target.

Multiple domains

Extended Domain Management widens the scope of key-migration/key-cloning operations, while maintaining the cryptographic module's security perimeter.

>Up to three domains can be associated with a partition.

>Domains can be labeled for ease of management, and the labels can be changed for convenience.

>Password-authenticated cloning domains (text string) and multifactor quorum-authenticated domains (PED key secret) can be mixed on a single partition.

>Keys and objects can be shifted from one domain (that you control) to another (that you control).

Session Key Lifetime Management

>Negotiated sessions have a finite lifetime (minimizing possibility of abuse), while being renegotiated with no burden to your applications.

>Multiple keys/objects can be transferred at one time, from one partition to another without requiring key-negotiation for each transfer (compare with prior behavior).

See Universal Cloning.

HSM Client Dynamic UserID Loading

As of HSM Client 10.5.0, the configuration of multiple users will be supported which allows multiple partition slots to be accessed from a single client instance. This allows customers to add multiple UserID's (a combination of unique AuthTokenClientID, AuthTokenClientSecret, AuthTokenConfigURI) without the need to restart the application after the addition of a new UserID. This will enable a service provider to configure multiple UserID's without impacting the service any of the other users in the same client instance.

The ability to load multiple partitions to the same UserID without impacting service to other users will also be supported. If an attempt is made to add the same partition ID to a different user that will be ignored and a Warning log will be generated.

More info can be found here: Dynamic Partition Loading for Luna Cloud HSM Services

Configurable Mutex Folder on Linux

The Linux version of HSM Client 10.5.0 allows the administrator to set a custom folder for temporary files. Previously these files were written to /tmp, but some services could be disrupted when the /tmp folder was cleared. The new default folder is <install_dir>/lock, but if access rights to this directory are restricted, you can set a custom location by editing the MutexFolder entry of the Misc section of Chrystoki.conf.

See Configuration File Summary.

Supported Operating Systems

You can install HSM Client 10.5.0 on the following operating systems:

Operating System Version Secure Boot Supported
Windows 10 Yes
Windows Server Standard 2022 Yes
2019 Yes
2016 Yes
Windows Server Core 2022 Yes
2019 Yes
2016 Yes
Red Hat-based Linux (including variants like CentOS)

8.0, 8.1, 8.2, 8.3, 8.4, 8.5 (†)

7 No
Red Hat Universal Base Image (UBI) 8.8 No
Ubuntu * 21.04 No
20.04 No
18.04 No
Debian 11 No
10 No
9 No
8 No

* The Linux installer for HSM Client software is compiled as .rpm packages. To install on a Debian-based distribution, such as Ubuntu, alien is used to convert the packages. We used build-essential:

apt-get install build-essential alien

If you are using a Docker container or another such microservice to install the Luna Minimal Client on Ubuntu, and your initial client installation was on another supported Linux distribution as listed above, you do not require alien. Refer to the product documentation for instructions. You might need to account for your particular system and any pre-existing dependencies for your other applications.

RHEL and CentOS 8.0-8.5 with their original kernels. See also Red Hat Enterprise Linux 8 in FIPS Mode Requires Minimal HSM Client.

Supported Cryptographic APIs

Applications can perform cryptographic operations using the following APIs:

>PKCS#11 2.20


>Microsoft CAPI

>Microsoft CNG

>Supported Java versions:

Open JDK 7 up to Open JDK 17

Oracle Java 7 up to JDK 17

IBM Java 7, 8 and 11

Advisory Notes

This section highlights important issues you should be aware of before deploying HSM Client 10.5.0.

Backup/USB/PCIe Drivers Not Installed on Windows 10 or Windows Server 2022 Unless Device is Connected

Due to changes in Windows 10 and Server 2022, device drivers are not installed unless the USB or PCIe device is connected to the client workstation. If you plan to use a Luna Backup HSM 7, Luna Backup HSM G5, Luna USB HSM 7, or Luna PCIe HSM with these operating systems, use one of the following workarounds:

>Connect the Luna device to the workstation (or install the Luna PCIe HSM card) before installing the HSM Client software

>After installing the HSM Client software:

a.Connect the Luna device(s) to the workstation (or install the Luna PCIe HSM card)

b.Run LunaHSMClient.exe.

c.Select the devices you want to install drivers for.

d.Click Modify.

CentOS 8.4 Missing Dependency

Due to a missing dependency on CentOS 8.4 [specifically the symlink (libnsl.so.1) to libnsl was removed], when installing HSM Client 10.5.0 or newer, you must install an additional rpm package first:

Run yum install libnsl before invoking the install.sh script.

CSP/KSP Registrations Can Fail if Windows Update Missing

CSP or KSP registration includes a step that verifies the DLLs are signed by our certificate that chains back to the DigiCert root of trust G4 (in compliance with industry security standards).

This step can fail if your Windows operating system does not have the required certificate. If you have been keeping your Windows OS updated, you should already have that certificate.

If your HSM Client host is connected to the internet, use the following commands to update the certificate manually:

certutil -urlcache -f http://cacerts.digicert.com/DigiCertTrustedRootG4.crt DigiCertTrustedRootG4.crt

certutil -addstore -f root DigiCertTrustedRootG4.crt

To manually update a non-connected host

1. Download the DigiCert Trusted Root G4 ( http://cacerts.digicert.com/DigiCertTrustedRootG4.crt DigiCertTrustedRootG4.crt ) to a separate internet-connected computer.

2.Transport the certificate , using your approved means, to the Luna Client host into a <downloaded cert path> location of your choice

3.Add the certificate to the certificate store using the command:

certutil -addstore -f root <downloaded cert path>

Red Hat Enterprise Linux 8 in FIPS Mode Requires Minimal HSM Client

RHEL 8.x introduced system-wide cryptographic modes. The full HSM Client installer is supported only when RHEL 8.x is in DEFAULT mode. If your RHEL 8.x OS is in FIPS mode, use the minimal HSM Client.

Support for Windows Server 2012 R2 is Ended

HSM Client 10.3.0 is the last version that will support Windows Server 2012 R2.

Red Hat Enterprise Linux / CentOS 6 Support is Ended

HSM Client 10.2.0 is the last version that will support RHEL 6 and related operating systems. If you plan to install future client updates, consider updating your clients to RHEL 7 or 8.

Support for 32-bit OS Platforms is Ended

Starting with HSM Client 10.2.0, 32-bit libraries are no longer provided. If you have a 32-bit application or integration, remain with a previous client release or migrate to 64-bit platform.

Older JAVA Versions Require Patch/Update

The .jar files included with HSM Client 10.x have been updated with a new certificate, signed by the Oracle JCE root certificate. This certificate validation requires a minimum Oracle JDK/JRE version.

>If your application relies on Oracle Java 7 or 8, you must update to the advanced version provided by Oracle. You require (at minimum) version 7u131 or 8u121. Please refer to Oracle's website for more information: https://www.oracle.com/technetwork/java/java-se-support-roadmap.html

>If your application relies on IBM Java 7 or 8, you must install a patch from IBM before updating to HSM Client 10.x (see APAR IJ25459 for details).

CKR_MECHANISM_INVALID Messages in Mixed Luna Cloud HSM Implementations

When using a Luna Cloud HSM service with HSM Client, you might encounter errors like "CKR_MECHANISM_INVALID" or "Error NCryptFinalizeKey" during some operations in Hybrid HA and FIPS mode (3DES Issue). This can occur if firmware versions differ between a Luna HSM partition and a Luna Cloud HSM service in an HA group when you invoke a mechanism that is supported on one but not the other. Similarly, if one member is in FIPS mode, while the other is not, a mechanism might be requested that is allowed for one member, but not the other. For example, the ms2luna tool can fail when 3DES operations are invoked.