Luna HSM Firmware 7.1.0
Luna HSM firmware 7.1.0 was released in December 2017.
>Download Luna Network HSM 7 Appliance Software 7.1.0 (includes Luna HSM Firmware 7.1.0 update)
>Download Luna HSM Firmware 7.1.0 (firmware only)
New Features and Enhancements
Luna HSM firmware 7.1.0 includes the following new features and enhancements:
The HSM or Partition SO can save a copy of their organization's preferred HSM or partition policy settings to a template. They can then use this template to configure policy settings when initializing other HSMs or partitions.
This can save time and effort when deploying multiple HSMs or partitions. It also ensures consistency across your HSMs and partitions, which helps to simplify future audit and compliance requirements.
Configurable Policies for Export of Private Keys
The Partition SO can use partition policies to control whether or not the private keys in a given partition can be exported off the HSM. The ability to export private keys is particularly useful in use cases such as smart card & identity issuance, secure manufacturing, etc.
This gives organizations the ability to support a wider variety of use cases with their HSM, and also provides Partition SOs with more flexibility overall.
Curve 25519 Available in FIPS Mode
Curve 25519 is now available for use in FIPS mode.
Valid Update Paths
You can update the Luna HSM firmware to version 7.1.0 from the following previous versions:
This section highlights important issues you should be aware of before deploying HSM firmware 7.1.0.
Resolved Issue LKX-3338
Thales has identified an issue with asymmetric digest-and-sign, or digest-and-verify mechanisms when the data length exceeds 64KB, for all SHAxxx_RSA_xxx, SHAxxx_DSA and SHAxxx_ECDSA mechanisms.
>Simple (i.e. not combined with digest) RSA/ECDSA/DSA sign/verify operations are NOT affected, and work as expected for all HSM models.
>This issue only affects HSMs with standard- and enterprise-level performance (*700 and *750 models). Maximum-performance (*790) models are not affected.
CKA_EXTRACTABLE=FALSE on New Private Keys
Using Luna HSM firmware 7.1.0 or newer, private keys now have their CKA_EXTRACTABLE attribute set to FALSE by default when they are created. Your applications must specify a value of 1 (TRUE) for this attribute on private keys you wish to wrap and export in Key Export mode.
A patch for the Luna Java Provider (LunaProvider) on 32-bit and 64-bit Linux client systems is available from the Thales Customer Support Portal.