Luna HSM Firmware 7.8.1
Luna HSM firmware 7.8.1 was released in November 2022. It includes bug fixes and improvements.
>Download Luna HSM Firmware 7.8.1 for PCIe HSM
New Features and Enhancements
Luna HSM firmware 7.8.1 includes the following new features and enhancements:
Key Translation Function for 5G
Key Translation function- allows to securely import subscriber authentication keys into a 5G authentication platform (UDM).
The mechanism is used with the C_WrapKey command to receive a cryptogram from the client and re-encrypt it using a different key and/or mechanism; the result is then returned to the client.
See Luna Key Translation.
Choose Whether a Password Change Logs Out All Sessions
An option to the role changepw and role resetpw commands allows you to choose whether
>the change/reset operation immediately logs out all sessions open with that authentication (such as if an authentication has been compromised, where it is important to halt activity under a suspect role for security reasons) or
>open sessions are allowed to continue under the old authentication until closed (such as during routine password rollover, where it is important to allow operations to complete undisturbed).
HMAC Accepts Zero-byte Input
All cryptographic mechanisms with "HMAC" in the name now accept zero-byte input.
Session Memory Management Optimization
Applications are responsible for closing crypto sessions and releasing resources when they are no longer being used. Failure to do might eventually consume all available HSM memory. This memory management optimization allows you to support a higher number of simultaneous sessions by reducing the memory allocated per session, and to gracefully fail in case the available memory goes below a minimal threshold. It allows you to perform the appropriate administration tasks, maintain the availability of your platform, and prevent a crash.
See Cryptographic Module and Token Return Codes; refer to the note for errors 0x00310000 through 0x00310007.
Valid Update Paths
You can update the Luna HSM firmware to version 7.8.1 from the following previous versions:
>7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.2.0, 7.3.0, 7.3.3, 7.4.0, 7.4.1, 7.7.0, 7.7.1-20, 7.7.2, 7.8.0
Advisory Notes
This section highlights important issues you should be aware of before deploying HSM firmware 7.8.1.
Minimum Password Length is Increased to 8 Characters
Luna HSM Firmware 7.7.2 and newer enforces minimum 8-character passwords and challenge secrets, to comply with FIPS requirements. The previous limit was 7 characters. If you were using a 7-character password prior to upgrading the firmware, that password continues to work. Future password changes will use the new 8-character minimum.
If you have an existing HA group whose member partitions use a 7-character password/challenge secret, you must change all members to use a minimum 8-character password before adding a new member that uses Luna HSM Firmware 7.7.2 or newer.
Partition policy to control the use of DigestKey is added
Partition capability/policy 9: Allow DigestKey is added with Luna HSM Firmware 7.8.0; it controls the possibility of final keys being derived outside of the HSM. The policy defaults to OFF, which is the more secure option. Previously, DigestKey was always allowed, and this new policy provides choice for those who do not need the option, as well as for those who do need it.
NOTE Partition Policy 9 is destructive when switched OFF-to-ON, so have any partition contents backed up before you update HSM firmware. After update from any firmware prior to version 7.8.0, if you require this ability, you can switch the policy ON and then restore your material to the partition and resume using your application.
RSA Keygen Mechanism Remapping on Luna 7.7.1 or Newer Partitions Requires Minimum Luna HSM Client 10.4.0
Luna HSM Firmware 7.7.1 or newer partitions that have been individually set to FIPS mode using the new partition policy 43 require Luna HSM Client 10.4.0 or newer to automatically remap older RSA mechanisms as described in RSA Mechanism Remap for FIPS Compliance.
Special Considerations for Luna HSM Firmware 7.7.0 and Newer
Luna HSM Firmware 7.7.0 introduces new capabilities, features, and other significant changes that affect the operation of the HSM. Due to some of these changes, you must be aware of some special considerations before updating to Luna HSM Firmware 7.7.0 or newer. For more information, refer to Special Considerations for Luna HSM Firmware 7.7.0 and Newer before proceeding with the update.
3DES Usage Counter
For Luna HSM Firmware 7.7.0 and newer, triple-DES keys have a usage counter that limits each key instance to encrypting a maximum of 2^16 8-byte blocks of data when the HSM is in FIPS mode (HSM policy 12: Allow non-FIPS algorithms is set to 0). When the counter runs out for a key instance, that key instance can no longer be used for encryption or wrapping or deriving or signing, but can still be used for decrypting and unwrapping and verifying pre-existing objects.
The CKA_BYTES_REMAINING attribute is available when HSM policy 12: Allow non-FIPS algorithms is set to 0, but cannot be viewed if that policy is set to 1.
The attribute is preserved during backup/restore using a Luna Backup HSM 7; restoring puts the counter back to whatever value it had before backup.
The attribute is not preserved through backup/restore using a Luna Backup HSM G5; restoring sets the counter to like-new state (no usage).
FIPS Changes in Luna HSM Firmware 7.7.0 and Newer
New restrictions have been added to some mechanisms when the HSM is in FIPS mode (HSM policy 12: Allow non-FIPS algorithms set to OFF), to comply with FIPS SP800-131a Rev2, published in March 2019.
Mechanisms not permitted to wrap objects in FIPS mode
The following mechanisms are not permitted to wrap objects in FIPS mode (unwrap operations are permitted):
Mechanisms not permitted to sign data in FIPS mode
The following mechanisms are not permitted to sign data in FIPS mode (verify operations are permitted):
