Luna Backup HSM 7 Firmware 7.7.1

Luna Backup HSM 7 firmware 7.7.1 was released in October 2020. It is the FIPS-validated firmware version recommended by Thales.

>Download Luna Backup HSM 7 Firmware 7.7.1

This version also comes ready to install with Luna Network HSM 7 appliance software 7.7.x. (see Updating the Appliance-Connected Luna Backup HSM 7 Firmware).

Refer to NIST certificate #4195 for FIPS 140-2 Level 3 certification:

https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4195

New Features and Enhancements

Luna Backup HSM 7 firmware 7.7.1 includes the following new features and enhancements:

Allows Backup/Restore of Luna 7.7.0 and Newer Partitions

Luna Backup HSM 7 firmware 7.7.1 is required to back up and restore to Luna HSM partitions using Luna HSM Firmware 7.7.0 or newer.

Advisory Notes

This section highlights important issues you should be aware of before deploying Luna Backup HSM 7 firmware 7.7.1.

Configuring the Luna Backup HSM 7 for FIPS Compliance

Luna Backup HSM 7 Firmware 7.7.1 and newer uses the same updated cloning protocol as Luna HSM Firmware 7.7.0 and newer. For the Luna Backup HSM 7 to be FIPS-compliant, it must restrict restore operations to application partitions that use the new protocol. This restriction is applied by setting HSM policy 55: Enable Restricted Restore to 1 on the backup HSM. The Luna Backup HSM 7 must be initialized and connected to a Luna HSM Client computer to set this policy.

When this policy is enabled on the Luna Backup HSM 7, objects that have been backed up from partitions using firmware older than Luna HSM Firmware 7.7.0 can be restored to Luna HSM Firmware 7.7.0 or newer (V0 or V1) partitions only.

NOTE   HSM policy 12: Allow non-FIPS algorithms, which is used to set FIPS-compliant mode on other Luna HSMs, does not apply to the Luna Backup HSM 7. Attempts to change this policy will fail with the error CKR_CANCEL.

To configure the Luna Backup HSM 7 for FIPS compliance

1.On the Luna HSM Client computer, run LunaCM.

2.Set the active slot to the Luna Backup HSM 7.

lunacm:> slot set -slot <slot_id>

3.Log in as Backup HSM SO.

lunacm:> role login -name so

4.Set HSM policy 55: Enable Restricted Restore to 1.

lunacm:> hsm changehsmpolicy -policy 55 -value 1

5.[Optional] Check that the Luna Backup HSM 7 is now in FIPS approved operation mode.

lunacm:> hsm showinfo

*** The HSM is in FIPS 140-2 approved operation mode. ***

Backup HSM Firmware 7.7.1 Cannot Restore to FM-Enabled Partitions With HSM Firmware 7.7.1 or Newer

If you are backing up FM-enabled HSMs (HSM policy 50: Allow Functionality Modules enabled), restore operations to a partition with Luna HSM Firmware 7.7.1 or newer using Luna Backup HSM 7 with firmware 7.7.1 fail with LUNA_RET_OPERATION_RESTRICTED, even if the target partition also has FMs enabled. You must update the Luna Backup HSM 7 to Luna Backup HSM 7 Firmware 7.7.2 or newer, and both the source and target partition must have partition policy 42: Allow CPv1 disabled. Refer to known issue LUNA-26981.

CKR_CONTAINER_OBJECT_STORAGE_FULL Error When Backing Up Release 5.x or 6.x Partitions to a Luna Backup HSM 7

When using the Luna Backup HSM 7 to backup objects from partitions hosted on HSMs running older firmware, differences in the size of the metadata associated with the objects may cause the backup partition to become full before all of the objects are backed up, resulting in the following error message before all of the objects have been backed up:

<CKR_CONTAINER_OBJECT_STORAGE_FULL>

If you receive this message when backing up a user partition, you can use the LunaCM partition resize command to resize the backup partition so that it has enough space to accommodate the remaining objects, then use the partition archive backup command with the -append option to add the skipped objects to the backup.