Luna HSM Firmware 7.7.2
Luna HSM Firmware 7.7.2 was released in December 2021. It includes bug fixes and updated FIPS compliance requirements. This version is no longer available for download; Thales recommends using Luna HSM Firmware 7.8.1 or newer.
New Features and Enhancements
Luna HSM firmware 7.7.2 includes the following new features and enhancements:
ECIES Hardware Acceleration using Curve25519
Luna HSM firmware 7.7.2 adds enhanced performance for ECIES using Curve25519.
ECIES AES-CTR ICB Derivation
Luna HSM firmware 7.7.2 adds the derivation of the Initial Counter block (ICB) for ECIES AES-CTR encryption scheme to support the 5G 3GPP TS 33.501 standard, for processing of Subscription Concealed Identifier (SUCI) de-concealment requests. See CKM_ECIES.
This feature also requires minimum Luna HSM Client 10.3.0, or Luna HSM Client 10.4.0 for JCPROV.
Key Wrapping/Unwrapping with AES GCM
Luna HSM firmware 7.7.2 supports wrap/unwrap operations using the CKM_AES_GCM mechanism.
Validate Integrity of Functionality Modules
The FMSW_GetImage API call returns a pointer to a Functionality Module image and a pointer to the size of the image, to assist the verification of FMs in compliance with industry and national standards. See FMSW_GetImage API to validate an FM.
Updated Bootloader
The bootloader 1.1.5, when contained in an HSM release, or when added by patch, provides important security updates. It does not affect the Common Criteria validated status of the HSM, as indicated by the report at the following link
MaintenanceReport (commoncriteriaportal.org)
Valid Update Paths
You can update the Luna HSM firmware to version 7.7.2 from the following previous versions:
>7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.2.0, 7.3.0, 7.3.3, 7.4.0, 7.4.1, 7.7.0, 7.7.1-20
Advisory Notes
This section highlights important issues you should be aware of before deploying HSM firmware 7.7.2.
Minimum Password Length is Increased to 8 Characters
Luna HSM Firmware 7.7.2 and newer enforces minimum 8-character passwords and challenge secrets, to comply with FIPS requirements. The previous limit was 7 characters. If you were using a 7-character password prior to upgrading the firmware, that password continues to work. Future password changes will use the new 8-character minimum.
If you have an existing HA group whose member partitions use a 7-character password/challenge secret, you must change all members to use a minimum 8-character password before adding a new member that uses Luna HSM Firmware 7.7.2 or newer.
RSA Keygen Mechanism Remapping on Luna 7.7.1 or Newer Partitions Requires Minimum Luna HSM Client 10.4.0
Luna HSM Firmware 7.7.1 or newer partitions that have been individually set to FIPS mode using the new partition policy 43 require Luna HSM Client 10.4.0 or newer to automatically remap older RSA mechanisms as described in RSA Mechanism Remap for FIPS Compliance.
Special Considerations for Luna HSM Firmware 7.7.0 and Newer
Luna HSM Firmware 7.7.0 introduces new capabilities, features, and other significant changes that affect the operation of the HSM. Due to some of these changes, you must be aware of some special considerations before updating to Luna HSM Firmware 7.7.0 or newer. For more information, refer to Special Considerations for Luna HSM Firmware 7.7.0 and Newer before proceeding with the update.
3DES Usage Counter
For Luna HSM Firmware 7.7.0 and newer, triple-DES keys have a usage counter that limits each key instance to encrypting a maximum of 2^16 8-byte blocks of data when the HSM is in FIPS mode (HSM policy 12: Allow non-FIPS algorithms is set to 0). When the counter runs out for a key instance, that key instance can no longer be used for encryption or wrapping or deriving or signing, but can still be used for decrypting and unwrapping and verifying pre-existing objects.
The CKA_BYTES_REMAINING attribute is available when HSM policy 12: Allow non-FIPS algorithms is set to 0, but cannot be viewed if that policy is set to 1.
The attribute is preserved during backup/restore using a Luna Backup HSM 7; restoring puts the counter back to whatever value it had before backup.
The attribute is not preserved through backup/restore using a Luna Backup HSM G5; restoring sets the counter to like-new state (no usage).
FIPS Changes in Luna HSM Firmware 7.7.0 and Newer
New restrictions have been added to some mechanisms when the HSM is in FIPS mode (HSM policy 12: Allow non-FIPS algorithms set to OFF), to comply with FIPS SP800-131a Rev2, published in March 2019.
Mechanisms not permitted to wrap objects in FIPS mode
The following mechanisms are not permitted to wrap objects in FIPS mode (unwrap operations are permitted):
Mechanisms not permitted to sign data in FIPS mode
The following mechanisms are not permitted to sign data in FIPS mode (verify operations are permitted):
