HSM Client 10.9.3

HSM Client 10.9.3 was released in April 2026. It includes bug fixes and security updates.

CAUTION! Read the Advisory Notes before installing this update, to be aware of important changes that may require your attention.

AES GCM Handles Decryptions Greater than 64KB

AES GCM decryption on Luna HSM 7, using Luna HSM Firmware 7.9.3 and newer, can accept input messages of size greater than 64KB. The increase is transparent, requiring no change in command usage. Requires both Luna HSM Firmware 7.9.3 or newer and HSM Client 10.9.3 or newer. See Advisory Notes.

CKM_AES_KW can be used with and without CKA_VALUE_LEN

In compliance with PKCS#11 v2.40, v3.1 and v3.2, the AES key wrap (CKM_AES_KW) the template for the new key SHALL specify CKA_VALUE_LEN when neither the key type of the unwrapped key nor the unwrapping mechanism unambiguously determine the length of the unwrapped key. This has been the functionality in Luna HSMs.
PKCS#11 v3.0 deviates from that trend and CKA_VALUE_LEN is not needed for AES Key Wrap — the size can be inferred from the wrapped data itself. Using Luna HSM Firmware 7.9.3 or newer and HSM Client 10.9.3 or newer, the Luna HSM does not require specifying the length of the unwrapped AES or ARIA key if it can be uniquely determined from the wrapped data itself. See Using CKM_AES_KW with and without CKA_VALUE_LEN.

Requires Luna HSM Firmware 7.9.3 or newer and optionally uses HSM Client 10.9.3 or newer for updated client-side tool selections.

Selectable IV length for AES-GCM

When encrypting data with AES-GCM [such as when using option 40 in CKDemo], IV length can be modified [example in CKDemo selecting ( 98) Options, and then option 29] to alternate between:

>"Default" (which remains 16 bytes for continuity with previous behavior) and

>"Selectable", for added flexibility.

Requires Luna HSM Firmware 7.9.3 or newer and optionally uses HSM Client 10.9.3 or newer for updated client-side tool selections.

NOTE A feature description that mentions only the newer client requires the new client.

A feature that says it requires a version of firmware requires that version, and might require both the mentioned firmware and the mentioned client versions (or newer) for the feature to work correctly.

You can remain with an earlier client and still use the firmware features that do not explicitly require newer client. In those cases, the contribution from the client side is the convenience of having those features visible in updated client tools (CKDemo, multitoken, CMU...).

Supported Operating Systems

You can install HSM Client 10.9.3 on the following operating systems:

Operating System	Version	Secure Boot Supported
Windows	11	Yes
Windows Server Standard	2025	Yes
	2022	Yes
	2019	Yes
	2016	Yes
Windows Server Core	2022	Yes
	2019	Yes
	2016	Yes
Red Hat Enterprise Linux (RHEL)	10, 10.1
	9.0, 9.2, 9.4, 9.6, 9.7**also 9.7 on ARM64 for minimal client
	8.9, 8.10**
Red Hat Universal Base Image (UBI)	10	No
Red Hat Universal Base Image (UBI)	9.0, 9.2, 9.4, 9.6, 9.7	No
Ubuntu *	24.04.1
Ubuntu *	22.04
Debian	13
	12
	11

* The Linux installer for HSM Client software is compiled as .rpm packages. To install on a Debian-based distribution, such as Ubuntu, alien is used to convert the packages. We used build-essential:

apt-get install build-essential alien

If you are using a Docker container or another such microservice to install the Luna Minimal Client on Ubuntu, and your initial client installation was on another supported Linux distribution as listed above, you do not require alien. Refer to the product documentation for instructions. You might need to account for your particular system and any pre-existing dependencies for your other applications.

** RHEL and CentOS 9.x with its original kernel.

Supported Cryptographic APIs

Applications can perform cryptographic operations using the following APIs:

>PKCS#11 2.20

>OpenSSL

>Microsoft CAPI

>Microsoft CNG

>Supported Java versions:

•Open JDK 8 up to Open JDK 25

•Oracle Java 8 up to JDK 25

•IBM Java 8 and 11

Advisory Notes

This section highlights important issues you should be aware of before deploying HSM Client 10.9.3.

AES GCM Decryption Slower in FIPS 140 Configuration for >64KB

The FIPS 140 configuration setting requires that a large encrypted message, which is automatically divided into 64KB chunks for decryption, does not expose any of the pieces in plaintext before reassembly as the complete decrypted version. When FIPS 140 configuration is enabled, any object or message larger than 64KB is processed in a way that keeps all packets securely encrypted until the final one is received. This decreases potential attack options, but can increase decryption time for larger messages. Existing commands and calls are unchanged from the user perspective - the HSM determines what is needed, based on the FIPS 140 setting and the size of your message. Applies to Luna HSM Firmware 7.9.3 and newer and HSM Client 10.9.3 and newer.

Security and Permissions for NTLS Keys Using Luna HSM Client 10.9.0 and Newer

As part of Thales' secure development practices, access controls for NTLS private key files have been strengthened to reduce exposure of private key material and promote security best practices by default. The originator/owner of the NTLS private key (the admin user) has full access permissions to the NTLS key files stored on your client. By default, other users and groups are excluded.

If your operations require other users or groups to invoke the NTLS key files, then do the following.

After installing the client on a new host, or after updating from a pre-10.9.0 version of HSM Client:

>use the security access-control tools of your client operating system to grant specific, minimum access permission to only those users and groups that need it to function properly;

>add only the privileges they need: "r" (read privileges) to run applications as a user, "r/w" (read/write privileges) for registration and admin purposes.

Installation Directory Changes

Using HSM Client 10.9.3 or newer, header files have been moved away from the Samples directory to a more appropriate SDK directory when the SDK option is selected during client installation to enforce a clear separation in the HSM Client installation.[

Windows:

C:/Program Files/SafeNet/LunaClient/
	sdk/

		include/
			<header files that provide specifications of Thales and non APIs, esp. for using the PKCS#11 interface>
		external/
			<third party headers>
			RSA/
		lib/
		samples/ (moved within sdk; and removed "p11samples" subdirectory for consistency)
			<include directory moved>
			<lib directory moved>
			src/ <rename source to src>
				move header files from here to include/
			makefiles/
			ecc_examples/
		README.txt
	fmsdk/ (moved from samples/)
		include/
		lib/
		samples/
	...

Linux/AIX:

/usr/safenet/lunaclient/
	sdk/
		include/
			<header files that provide specifications of Thales and non APIs, esp. for using the PKCS#11 interface>
		external/
			<third party headers>
			RSA/
		samples/ (moved within sdk)
			<include directory moved>
			src/ <rename source to src>
				move header files from here to include/
			makefiles/
			ecc_examples/
		README.txt
	...
/usr/safenet/lunafmsdk/ (unchanged)
	include/
	lib/
	samples/

The "cmu verifyhsm" Command Fails with 10.7.2

The "cmu verifyhsm"fails with client 10.7.2. This is no longer an issue with client 10.8.0.

Backup/USB/PCIe Drivers Not Installed on Windows 10 or Windows Server 2022 Unless Device is Connected

Due to changes in Windows 10 and Server 2022, device drivers are not installed unless the USB or PCIe device is connected to the client workstation. If you plan to use a Luna Backup HSM 7, Luna Backup HSM G5, Luna USB HSM 7, or Luna PCIe HSM 7 with these operating systems, use one of the following workarounds:

>Connect the Luna device to the workstation (or install the Luna PCIe HSM 7 card) before installing the HSM Client software

>After installing the HSM Client software:

a.Connect the Luna device(s) to the workstation (or install the Luna PCIe HSM 7 card)

b.Run LunaHSMClient.exe.

c.Select the devices you want to install drivers for.

d.Click Modify.

CentOS 8.4 Missing Dependency

Due to a missing dependency on CentOS 8.4 [specifically the symlink (libnsl.so.1) to libnsl was removed], when installing HSM Client 10.5.0 or newer, you must install an additional rpm package first:

Run yum install libnsl before invoking the install.sh script.

CSP/KSP Registrations Can Fail if Windows Update Missing

CSP or KSP registration includes a step that verifies the DLLs are signed by our certificate that chains back to the DigiCert root of trust G4 (in compliance with industry security standards).

This step can fail if your Windows operating system does not have the required certificate. If you have been keeping your Windows OS updated, you should already have that certificate.

If your HSM Client host is connected to the internet, use the following commands to update the certificate manually:

certutil -urlcache -f http://cacerts.digicert.com/DigiCertTrustedRootG4.crt

certutil -addstore -f root DigiCertTrustedRootG4.crt

To manually update a non-connected host

1. Download the DigiCert Trusted Root G4 (http://cacerts.digicert.com/DigiCertTrustedRootG4.crt) to a separate internet-connected computer.

2.Transport the certificate, using your approved means, to the HSM Client host into a <downloaded cert path> location of your choice

3.Add the certificate to the certificate store using the command:

certutil -addstore -f root <downloaded cert path>

Support for Windows Server 2012 R2 is Ended

HSM Client 10.3.0 is the last version that will support Windows Server 2012 R2.

Red Hat Enterprise Linux / CentOS 6 Support is Ended

HSM Client 10.2.0 is the last version that will support RHEL 6 and related operating systems. If you plan to install future client updates, consider updating your clients to RHEL 7 or 8.

Support for 32-bit OS Platforms is Ended

Starting with HSM Client 10.2.0, 32-bit libraries are no longer provided. If you have a 32-bit application or integration, remain with a previous client release or migrate to 64-bit platform.

Older JAVA Versions Require Patch/Update

The .jar files included with HSM Client 10.x have been updated with a new certificate, signed by the Oracle JCE root certificate. This certificate validation requires a minimum Oracle JDK/JRE version.

>If your application relies on Oracle Java 7 or 8, you must update to the advanced version provided by Oracle. You require (at minimum) version 7u131 or 8u121. Please refer to Oracle's website for more information: https://www.oracle.com/technetwork/java/java-se-support-roadmap.html

>If your application relies on IBM Java 7 or 8, you must install a patch from IBM before updating to HSM Client 10.x (see APAR IJ25459 for details).

CKR_MECHANISM_INVALID Messages in Mixed Luna Cloud HSM Implementations

When using a Luna Cloud HSM service with HSM Client, you might encounter errors like "CKR_MECHANISM_INVALID" or "Error NCryptFinalizeKey" during some operations in Hybrid HA and FIPS mode (3DES Issue). This can occur if firmware versions differ between a Luna HSM partition and a Luna Cloud HSM service in an HA group when you invoke a mechanism that is supported on one but not the other. Similarly, if one member is in FIPS mode, while the other is not, a mechanism might be requested that is allowed for one member, but not the other. For example, the ms2luna tool can fail when 3DES operations are invoked.



	SUPPORT	LEGAL
Luna Cloud HSM Documentation © Copyright 2001-2026, Thales Group Last Updated: 2026-09-10 14:19:37 GMT-05:00	Customer Release Notes Customer Support Portal Support Contacts	End User License Agreement Document Information