Luna HSM Client 10.2.0
Luna HSM Client 10.2.0 was released in March 2020.
>Download Luna HSM Client 10.2.0 for Windows
>Download Luna HSM Client 10.2.0 for Linux
>Download Minimal Luna HSM Client 10.2.0 for Linux
NOTE This version of Luna HSM Client is compatible with Luna HSMs with firmware 6.2.1 and newer. Features that do not have client version dependencies will function without issue.
New Features and Enhancements
Luna HSM Client 10.2.0 includes the following new features and enhancements:
Luna HSM Client 10.2.0 Supports Both Luna HSMs and Luna Cloud HSM Services From Data Protection on Demand
Luna HSM Client can now be used with Luna Cloud HSM services provided by Thales Data Protection on Demand. This allows you to migrate keys from a password-authenticated Luna HSM partition to a Luna Cloud HSM service or vice-versa, set up High-Availability (HA) groups that include both password-authenticated Luna partitions and Luna Cloud HSM services, and operate your local (Luna PCIe HSM 7 and Luna USB HSM 7), remote (Luna Network HSM 7), and cloud HSM solutions on the same client workstation.
Refer to the following sections:
>Adding a Luna Cloud HSM Service
>Cloning Keys Between Luna 6, Luna 7, and Luna Cloud HSM, Password or Multifactor Quorum
New Luna HSM Client Operating System Support
Luna HSM Client 10.2.0 can be installed on the following new operating systems:
>Windows Server Core 2016/2019
>Red Hat Enterprise Linux 8 (including variants like CentOS 8)
Support for New Mechanisms Introduced in Luna HSM Firmware 7.4.2
Luna HSM Client 10.2.0 includes support for mechanisms first introduced in Luna HSM Firmware 7.4.2
3GPP Cryptography for 5G Mobile Networks
The new 3GPP crypto functions support the authentication and re-synchronization of a mobile device to the back-end authentication center (AUC). Milenage, Tuak and Comp128 algorithms are available and are relevant to 2/2.5G, 3G, 4G(LTE) and newer 5G mobile networks. The primary benefit of using the Luna HSM ensures that the subscribers key (Ki) is never exposed in the clear outside the security perimeter of a hardware security device. Optionally the Operators Variant string (OP) may also be encrypted under a storage key only found inside the HSM. See 3GPP Mechanisms for 5G Mobile Networks.
SM2/SM4 Support
SM2 is comparable to Elliptic Curve (EC) in terms of key structure though the signing algorithm is different. SM2 is required for sign/verify. There is a new key type CKK_SM2. SM4 is comparable to Advanced Encryption Standard (AES-128) in terms of key size though the encryption algorithm is different. SM4 is required for encrypt/decrypt (modes ECB, CBC, CBC-PAD). There is a new key type CKK_SM4. See SM2/SM4 Mechanisms.
SHA-3 Function Support
This provides a guide to using the SHA-3 crypto functions in the Luna HSM. The SHA-3 implementation conforms to the NIST publication FIPS PUB 202. The SHA-3 hash algorithm has been implemented in the K7 FW. This provides the ability to send message data to the Luna HSM in order to receive the SHA-3 digest of the data. The algorithm is implemented for digest bit lengths of 224, 256, 384 and 512 similar to the SHA-2 family of hash algorithms. Other mechanisms that make use of a digest include support for SHA-3 by either specifying the mechanism type or specifying mechanism parameters. See SHA-3 Mechanisms.
Supported Operating Systems
You can install the Luna HSM Client 10.2.0 on the following 64-bit operating systems:
| Operating System | Version |
|---|---|
| Windows | 10 |
| Windows Server Standard | 2019 |
| 2016 | |
| 2012 R2 | |
| Windows Server Core | 2019 |
| 2016 | |
| Red Hat Enterprise Linux (including variants like CentOS) | 8.0 |
| 7 | |
| 6 | |
| SuSe Linux (minimal client only) | 12.4 |
| 11.4 | |
| Ubuntu * | 14.04 |
| 18 |
* The Linux installer for Luna HSM Client software is compiled as .rpm packages. To install on a Debian-based distribution, such as Ubuntu, alien is used to convert the packages. We used build-essential:
apt-get install build-essential alien
If you are using a Docker container or another such microservice to install the Luna Minimal Client on Ubuntu, and your initial client installation was on another supported Linux distribution as listed above, you do not require alien. Refer to the product documentation for instructions. You might need to account for your particular system and any pre-existing dependencies for your other applications.
Secure Boot Support
Luna HSM Client can be used on all supported OS platforms in the table above, with Secure Boot enabled. If you are using Luna HSM Client to access partitions on a Luna Network HSM 7 only, no drivers are required. On Windows, the drivers for all other Luna HSM variants and components (Luna PCIe HSM 7, Luna USB HSM 7, Luna Backup HSM 7, Luna Backup HSM G5, Luna PED) are signed by Thales for use with Windows Secure Boot. In both these cases, you can proceed with the standard Luna HSM Client Software Installation procedure.
On Linux, these drivers are compiled for the host OS during Luna HSM Client installation. If Secure Boot is enabled on the host system, these drivers must be signed as directed by the host OS provider:
>Secure Boot on Red Hat Enterprise Linux
Supported Cryptographic APIs
Applications can perform cryptographic operations using the following APIs:
>PKCS#11 2.20
>JCA within Oracle Java 7*/8*/9/10/11
*Luna HSM Client 10.1.0 and newer requires the advanced version of Oracle Java 7/8.
>JCA within OpenJDK 7/8/9/10/11
>OpenSSL
>Microsoft CAPI
>Microsoft CNG
Advisory Notes
This section highlights important issues you should be aware of before deploying Luna HSM Client 10.2.0.
Older Clients Can Fail to Complete One-Step NTLS with Newer Appliance Software
Red Hat Enterprise Linux 8 in FIPS Mode Requires Minimal Luna HSM Client
RHEL 8.x introduced system-wide cryptographic modes. The full Luna HSM Client installer is supported only when RHEL 8.x is in DEFAULT mode. If your RHEL 8.x OS is in FIPS mode, use the minimal Luna HSM Client.
Red Hat Enterprise Linux / CentOS 6 Support is Ended
Luna HSM Client 10.2.0 is the last version that will support RHEL 6 and related operating systems. If you plan to install future client updates, consider updating your clients to RHEL 7 or 8.
Support for 32-bit OS Platforms is Ended
Starting with Luna HSM Client 10.2.0, 32-bit libraries are no longer provided. If you have a 32-bit application or integration, remain with a previous client release
Older JAVA Versions Require Patch/Update
The .jar files included with Luna HSM Client 10.x have been updated with a new certificate, signed by the Oracle JCE root certificate. This certificate validation requires a minimum Oracle JDK/JRE version.
>If your application relies on Oracle Java 7 or 8, you must update to the advanced version provided by Oracle. You require (at minimum) version 7u131 or 8u121. Please refer to Oracle's website for more information: https://www.oracle.com/technetwork/java/java-se-support-roadmap.html
>If your application relies on IBM Java 7 or 8, you must install a patch from IBM before updating to Luna HSM Client 10.x (see APAR IJ25459 for details).
CKR_MECHANISM_INVALID Messages in Mixed Luna Cloud HSM Implementations
When using a Luna Cloud HSM service with Luna HSM Client, you might encounter errors like "CKR_MECHANISM_INVALID" or "Error NCryptFinalizeKey" during some operations in Hybrid HA and FIPS mode (3DES Issue). This can occur if firmware versions differ between a Luna HSM partition and a Luna Cloud HSM service in an HA group when you invoke a mechanism that is supported on one but not the other. Similarly, if one member is in FIPS mode, while the other is not, a mechanism might be requested that is allowed for one member, but not the other. For example, the ms2luna tool can fail when 3DES operations are invoked.
Resolved Issue LUNA-7585: Java DERIVE and EXTRACT flag settings for keys injected into the HSM
Formerly, the DERIVE and EXTRACT flags were forced to "true" in the JNI, which overrode any values passed by applications via Java. This was resolved in Luna HSM Client 7.3.0.
As of Luna HSM Client 7.3.0:
>The default values for the DERIVE and EXTRACT flags are set to "false" (were set to “true” in previous releases).
>JNI accepts and preserves values set by applications via the following Java calls:
LunaSlotManager.getInstance().setSecretKeysDerivable( true );
LunaSlotManager.getInstance().setPrivateKeysDerivable( true );
LunaSlotManager.getInstance().setSecretKeysExtractable( true );
LunaSlotManager.getInstance().setPrivateKeysExtractable( true );
NOTE If you have existing code that relies on the DERIVE and EXTRACT flags being automatically defined by the JNI for new keys, you will need to modify your application code to set the flag values correctly.
In cases where a derived key must be extractable, add the following line to the java.security file:
com.safenetinc.luna.provider.createExtractablePrivateKeys=true
