Release Notes

Product Description

CipherTrust Manager is the center of the CipherTrust Data Security Platform. It serves as the central point for managing configuration, policy and key material for data discovery, encryption, on-premise and cloud based use cases. It is the successor to both the Thales eSecurity (formerly Vormetric) DSM and the Gemalto (formerly SafeNet) KeySecure platforms.

Product Abbreviations

Release Description

This release is available on the Customer Support Portal in the following formats:

• An upgrade file for physical k570 and k470 CipherTrust Manager devices, and existing k170v Virtual CipherTrust Manager instances.

  Warning

  2.9.x is not supported on Thales TCT k160 devices.

• An OVA image file for deploying a new Virtual CipherTrust Manager on VMWare vSphere or Nutanix AHV.

• A VHDX image file for deploying a new Virtual CipherTrust Manager on Microsoft Hyper-V.

• A QCOW2 image file for deploying a new Virtual CipherTrust Manager on OpenStack.

In addition, 2.9.x Virtual CipherTrust Manager is available on the following public clouds:

• Amazon Web Services: SafeNet Cloud Provisioning System

• Google Cloud

• Microsoft Azure: Available as a BYOL image in the Microsoft Azure Marketplace

• Oracle Cloud

• IBM Cloud

  • An OVA image file for deploying a new Virtual CipherTrust Manager on IBM Cloud VMWare.

  • A QCOW2 image file for deploying a new Virtual CipherTrust Manager IBM Cloud Virtual Private Cloud Gen2.

2.9.x contains a number of new features, enhancements, and resolved issues. For the list of known issues, refer to Known Issues.

Features and Enhancements

Release 2.9.2

The 2.9.2 release includes an internal client upgrade to maintain compatibility with the Thales Data Protection On Demand (DPoD) Luna Cloud HSM service root-of-trust integration past January 28, 2025. Details on the Luna Cloud HSM compatibility change are available in knowledge base article KB0028422. The CipherTrust Manager change is tracked internally under reference number KY-85448.

This release is available as an upgrade file. The upgrade can be applied directly on CipherTrust Manager versions 2.9.x, 2.8.x, 2.7.x, and 2.6.x.

This release does not address all security vulnerabilities discovered after the release of 2.9.0 minor version. To obtain current security fixes, upgrade to the latest LTS patch or feature release.

Release 2.9.1

The 2.9.1 release includes some security fixes and stability fixes described in the resolved issues list. This release is available as an upgrade file. The upgrade can be applied directly on CipherTrust Manager versions 2.9.x, 2.8.x, 2.7.x, and 2.6.x.

Release 2.9.0

Platform

• Added support for AWS Regional STS Endpoint in AWS connection manager.

• Added support for Open ID Connect (OIDC) connections to authenticate CTE agents in connection manager.

  Note

  This is an additional, separate connection from the OIDC connection used to authenticate CipherTrust Manager users.

• Changes to the OIDC connection to authenticate CipherTrust Manager users.

  • Added the ability to pre-create OIDC users before the user logs in to CipherTrust Manager.

  • Due to stability and performance enhancements, this feature is fully supported and no longer a technical preview.

  • Support for GET method to start an OIDC login flow.

• Added support for a Syslog connection available to the ksadmin user to forward host logs. Host logs are very detailed messages at the base operating system level.

• The certificate duration for Azure Cloud and Salesforce Cloud connection managers is made configurable. The default duration is 730 days.

• Expansion of log forwarder features:

  • Added support for Loki connections in connection manager.

  • TLS is also now available for Loki connections.

  • Added support for Elastic Search connection in connection manager.

  • Support of Syslog added in log forwarders.

  • Added support for Syslog connections in connection manager.

    Note

    Upgraded CipherTrust Manager instances can have existing syslog connections through Admin Setting, which continue to be supported as an additional Syslog connection. Syslog servers configured as log forwarders can forward client audit records, while syslog servers configured through Admin Settings cannot.
    These two syslog connections are separate from the syslog connection available to the ksadmin user to forward host logs.

  • Due to design stability, log forwarders are now fully supported and no longer technical preview.

• Certificate revocation check request timeout for Web (cert user login) and NAE/KMIP clients is made configurable.

• Added support to renew CA CRL automatically on expiration.

• Support added to configure maximum TLS version on interfaces.

• Support added for "y-" prefixed custom attributes for migration of keys from KeySecure to the CipherTrust Manager.

• Updated ksctl to allow configuration of trusted certificates.

• Added ability to auto-generate server certificates on restart if certificate signing request (CSR) parameters or CA is changed.

• Added support for including a Subject Alternative Name in CSR in CipherTrust Manager UI.

• Domain backup now includes users and groups.

• Registration of new KMIP client certificates now uses DN matching instead of fingerprint pinning.

• Added ECDSA signing and verification support for REST interface.

• Added support for custom attribute to KeyVersionModifyRequest.

• Support of certificate-based authentication for users created inside the domain.

• The default setting of the system generated auto key rotation scheduler for new deployments is now disabled. However, in the previous releases, it was enabled.

• Changes to the internal Loki Grafana log aggregation microservice:

  • Added a configurable retention period.

  • Due to stability and performance enhancements, this feature is fully supported and no longer technical preview.

• Technical preview: Ability to anchor a new child domain to a Luna Network HSM partition. All keys and secrets within an HSM-anchored domain are wrapped and unwrapped by the HSM itself.

• Support for upgrading the Luna PCIe Hardware Security Module on board the Thales CipherTrust Manager k570. You can now upgrade the firmware on this HSM to 7.7.0.

Limitations

• To fetch all keys, it is recommended to use KeyNamesRequest instead of KeyQueryRequest. The KeyQueryRequest response time is proportional to the number of keys on the CipherTrust Manager, hence may lead to a timeout exception on the client side.

• The CipherTrust Manager logs forwarded to Syslog server are limited to a size of 1024 bytes. After this size, the log message is truncated. However, you can use a Syslog log forwarder instead of the Syslog server to view the complete logs. The log forwarders support log messages larger than 1024 bytes.

• Currently, the log forwarders are not configured to use the system's proxy configuration. If proxy is configured, the log forwarders bypass the proxy servers.

• The backup and restore of users and groups in a domain only works among the domains of different CipherTrust Managers. This feature does not support backup and restore among different domains of the same CipherTrust Manager.

• During client renewal, if another client (which has Auth mode set to DN) already exists in the system with a matching subject DN, the client renewal may fail. This applies to external or local CA clients. For external CA certificates, delete the client to be renewed and register a new client with a new certificate and different subject DN.
  However, for local CAs, it is not required to delete the client to be renewed, rather set the do_not_modify_subject_dn field to false. Refer to Renewing Local CA Clients for details.

Deprecated Feature(s)

The CipherTrust Manager version 2.9 onward:

• The 'global' user doesn't get generated on restart.

• The 'global' user cannot be created.

  While upgrading to CipherTrust Manager 2.9, the 'global' user gets deleted.

  In CipherTrust Manager 2.8 and 2.9 mixed cluster environment, if a 'global' user exists, you cannot login as a 'global' user.

  While upgrading to CipherTrust Manager 2.9 or in mixed cluster environment, if a 'global' user is deleted, the keys owned by the 'global' user will be accessible to the 'Key admin' or 'admin' groups. The NAE/KMIP users can also access these keys.

Application Data Protection

• Added support for access policies that allow you to select how to display data in a RESTful API call during the reveal operation based on the user. The data can be revealed as:

  • Plaintext

  • CipherText

  • Masked Value

  • Error/Replacement Value

• Added licensing enforcement for DPG.

CCKM

• Technical preview: Support for Luna HSM as a key source for BYOK and cache-only keys in Salesforce cloud.

• Added support for management of Oracle Cloud Infrastructure (OCI) resources using the GUI.

• Added support for management of Azure secrets and certificates using REST API.

• Capability to persist permitted operations and tags for Azure keys after the key rotation.

• Added capability to provide an existing key to act as the Key Encryption Key (KEK) when you create a Google External Key Manager (EKM) endpoint. Multiple Google EKM endpoints cannot share the same KEK at the same time.

• Added support for the Azure Key Vault Managed HSM cloud service.

CTE

• Added capability to share CTE resources across domains. Refer to Sharing Resources Across Domains for details.

• Added support for Multifactor Authentication (MFA) to the MFA-capable CTE for Windows clients. In MFA, access to the requested data is granted only after the requester satisfies two or more authentication criteria. Refer to Multifactor Authentication for details.

• Added capability to configure cluster node preference. Refer to Configuring Cluster Node Preference for details.

• Added option to suspend rekey on a client group level.

• Enhanced the Thales Security Intelligence Splunk app to include CipherTrust Manager dashboards.

DDC

• Salesforce Data Store Support. Supports scanning sensitive data in Salesforce Standard, Custom, and Big objects in your production and sandbox environments.

• Search Precision Support in Built-in Infotypes. Discovers sensitive data objects based on the High or Low search precisions.

• Auditing Scan Execution and Reports Generation Events. Logs Scan execution and Reports generation actions in the Server records (audit).

Resolved Issues

This table lists the issues resolved in 2.9.1.

This table lists the issues resolved in 2.9.0.

Advisory Notes

This section highlights important issues you should be aware of before deploying the CipherTrust Manager. There is also a full list of known issues associated with the release.

KeySecure Classic Hardware No Longer Supported

CipherTrust Manager firmware is no longer supported on KeySecure Classic k450 and k460 hardware from version 2.8.0 and onward. Refer to Migrate from KeySecure Classic for information on migrating KeySecure Classic data to CipherTrust Manager hardware.

SMB Connection

The Host and Port fields must be specified together, or do not specify any of them. If Host and Portare not specified while creating an SMB connection, these fields cannot be added later.

Recommendation for Secure Initialization Vector in DESede CBC, AES CBC, and AES GCM Encryption Requests

When generating a new AES or DESede key CipherTrust Manager currently generates and stores a Default IV associated with the new key. This is mainly used to support specific legacy integrations and applications.

We strongly recommend future crypto applications use a secure, unique initialization vector (IV) for each AES CBC, AES GCM, and DESede CBC encryption request, rather than relying on a default IV provided by CipherTrust Manager for the security of your data. For example, unpredictable, unique IVs for AES CBC requests protect against oracle attack techniques such as ROBOT, DROWN, POODLE, and BEAST.

We recommend to use CipherTrust Manager's random number generation to produce secure IVs, or you can provide your own IV with each AES CBC, AES GCM or DESede CBC encryption request following the security guidelines for constructing secure IVs in NIST SP800-38A and NIST SP800-38D.

In the KMIP interface, always set the RandomIV object in the Cryptographic Parameters attribute to true or provide your own secure IV in the Request Payload as an IV/Counter/Nonce object.

In the REST and NAE interfaces, use CipherTrust Manager's random number generation to produce secure IVs for cryptographic requests, or provide your own secure IV.

Some Key States Change After Upgrade

After upgrade from 2.4 some key states are remapped as a result of harmonizing NAE-only key states. In most cases, the allowed operations for a key remain the same before and after upgrade, so key usage is not disrupted.

As you cannot upgrade directly from 2.4 to 2.9, these changes take effect when you first upgrade from 2.4 to an intermediate minor version, 2.5, 2.6, or 2.7.

• When a key has an NAE state of Retired and the deactivation date is set in the future, the key is set to Deactivated immediately upon upgrade. No cryptographic operations are allowed.

• When a key has an NAE state of Restricted and Protect Stop Date is set in future, the key is set to Active and the Protect Stop Date is set to the current time. Decryption, signature verification, unwrapping, and MAC verification are allowed.

• When a key has an NAE state of Active and Activation Date is not set, the activation date is set to the current time. All cryptographic operations are allowed.

• When a key has an NAE state of Active and Activation Date is set in the future, the key is set to a Pre-Active state and the Activation Date is retained. No cryptographic operations are allowed until the Activation Date is reached.

• When a key has a state of Deactivated before upgrade, its state will be unchanged after upgrade. However, the allowed operations for the Deactivated state change for 2.5. The key loses its ability to decrypt, verify signatures, unwrap, and verify MACs. You can re-activate the key after upgrade and set the ProtectStop date to restore those operations.

System Upgrade and Downgrade Supported Releases

System upgrades have been tested from releases 2.6.x, 2.7.x, and 2.8.x. Upgrades from lower 2.9.x versions to 2.9.x patches have also been tested.

CipherTrust Manager 2.9.x can be downgraded to 2.8.x. For release-specific upgrade/downgrade information, refer to the release notes for your release.

Refer to the System Upgrade page for instructions to perform an upgrade or downgrade on a single device.

Refer to the Cluster Upgrade section for instructions to perform an upgrade on a cluster of devices.

Restoring a backup from release 1.5.0 or later is supported; however, restoring a newer backup to an older version is never supported.

Clusters with a Large Number of Transactions

Clusters that support a large number of transactions should have audit logging disabled and only syslog should be used for capturing audit logs. This significantly reduces cluster wide traffic and disk usage. This is a cluster wide setting and needs to be set on only one node in the cluster. Use the ksctl properties command to disable audit logging.

To disable local audit logging

Set the property ENABLE_RECORDS_DB_STORE to false using the ksctl command:

$ ksctl properties modify -n ENABLE_RECORDS_DB_STORE -p false

If configured, Audit logs will be still be sent to a syslog server.

Protect the ksadmin Private SSH Key

The private SSH key for the ksadmin account is critical to system security and must be carefully protected. Failure to do so could allow an attacker to compromise the system.

TLS/SSL Must be Enabled in a Production System

As it may be useful for troubleshooting, it is possible to disable TLS/SSL for the NAE interface. This will lead to an insecure system. Therefore, TLS/SSL should always be enabled for a production system.

Key Usage Mask Selection

If you want to perform any operation (for example, Wrap/Unwrap) from the NAE/KMIP connector, set the usage mask explicitly for that operation while creating keys through UI.

Upgrading DDC

After you upgrade to version 2.9 you will not be able to downgrade it to any of the previous versions.

Clusters with DDC

• Only one CipherTrust Manager node in the cluster can have DDC activated. To access DDC, create a new DNS entry to point to the active CipherTrust Manager node.

• DDC functionality cannot be accessed through the CipherTrust Manager FQDN. DDC requests sent to an inactive CipherTrust Manager node fail (and return the impression that DDC fails randomly).

DDC Licensing

Overlapping licenses are not supported (except for the trial license).

DDC Reports

Support for Legacy Reports

Starting from scans run with CM version 2.9.0, the data objects listed in the reports for SMB/CIFS data stores will be displayed with a new prefix.

• old prefix: share://server\share\folder1\folder2\file.txt

• new prefix: \\server\share\folder1\folder2\file.txt

Compatibility

This section documents known compatibility topics to be considered before deploying the CipherTrust Manager.

TLS Compatibility

This table identifies the supported TLS versions for each of the CipherTrust Manager interfaces. The default minimum value reflects the default minimum_tls_version setting. This setting controls the lowest acceptable TLS version allowed for connections to the interface.

By default, CipherTrust Manager accepts the following ciphersuites for TLS 1.2+ connections:

• TLS_AES_256_GCM_SHA384 (TLSv1.3)

• TLS_CHACHA20_POLY1305_SHA256 (TLSv1.3)

• TLS_AES_128_GCM_SHA256 (TLSv1.3)

• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS Deprecation Notices

• Use of TLS 1.0 and 1.1 protocols is deprecated. This support will be discontinued in a future release. Upgrade all applications connecting to CipherTrust Manager interfaces to TLS 1.2 or higher as soon as feasible.

• Use of the following CBC-based ciphersuites is deprecated, and support will be discontinued in a future release:

  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

  • TLS_RSA_WITH_AES_256_CBC_SHA

  • TLS_RSA_WITH_AES_128_CBC_SHA

Client Platforms

The following client Platforms are supported by the CipherTrust Manager.

CipherTrust Application Data Protection

• ProtectApp JCE: minimum version 8.6.1

• ProtectApp .NET: minimum version 8.11.0

• ProtectApp ICAPI: minimum version 8.10.0

• ProtectApp Oracle TDE: minimum version 8.9.0

• ProtectApp SQL EKM: minimum version 8.3.2

CipherTrust Cloud Key Manager

Minimum version 1.6.3.20532

CipherTrust Database Protection

• ProtectDB Oracle: minimum version 8.8.0

• ProtectDB SQL: minimum version 8.9.0

• ProtectDB DB2: minimum version 8.7.0

• Transformation Utility: minimum version 8.4.3

CipherTrust Transparent Encryption

Minimum version 7.0.0

CipherTrust Transparent Encryption UserSpace

Minimum version 9.0.0

CipherTrust Vaulted Tokenization

• Tokenization Manager: minimum version 8.7.1

• Vaultless Tokenization Manager: minimum version 8.8.0

CipherTrust Batch Data Transformation

Minimum version 2.2.0.2816

CipherTrust Vaultless Tokenization

Minimum version 2.5.2.19

CipherTrust Teradata Protection

Minimum version 6.4.0.12

ProtectFile

Minimum version:

• ProtectFile Windows 8.12.3

• ProtectFile Linux 8.12.3, 8.12.4p02 (for migration to CTE)

The latest three GA versions of ProtectFile are tested with CipherTrust Manager. Older versions are expected to work, but they are not tested explicitly.

ProtectV

Minimum version 4.7.3

Data Discovery and Classification Agents

Linux minimum kernel version is 2.6.

There are no changes in Agent requirements if you are upgrading from CM 2.4 to 2.5.1. If you are upgrading from a version older than 2.4 please refer to Upgrading Agents.

TDP Version Compatibility

Data Discovery and Classification requires TDP 3.1.6.

Known Issues

This section lists the issues known to exist in the product at the time of release.

CipherTrust Manager

CipherTrust Application Data Protection

CipherTrust Cloud Key Manager

{
    "name": "Google CSE policy",
    "allow": true,
    "effect": "allow",
    "resources":["kylo::cckm:"],
    "actions": ["GoogleWorkspaceCSE"],
    "conditions": [],
    "obligations": [],
    "includeDescendantAccounts": false
}

{
    "policy": "<policy-id>",
    "principalSelector": { "cust":{ "groups": [ "CCKM Admins" ] }},
    "jurisdiction": ""
}

CipherTrust Database Protection

CipherTrust Data Discovery and Classification

CipherTrust Transparent Encryption

ProtectApp

ProtectFile