A new certificate is used immediately upon recovery of an HA member, rather than using a cached copy of the outgoing cert, as in previous releases. There is no need to launch a new client instance to invoke a new certificate.

Allows to securely import subscriber authentication keys into a 5G authentication platform (UDM).

See Luna Key Translation.

All cryptographic mechanisms with "HMAC" in the name now accept zero-byte input.

Perform appropriate administration tasks, maintain the availability of your platform, and prevent a crash, when applications are lax in releasing resources.

Can set a custom location for temporary files. See Configuration File Summary.

Includes:

>Updated encryption

>Enhanced cipher suite options

>Multiple domains per partition

>Session Key lifetime management

See Universal Cloning.

Adds enhanced performance for ECIES using Curve25519.

processing of Subscription Concealed Identifier (SUCI) de-concealment requests. See CKM_ECIES.

Supports wrap/unwrap operations using the CKM_AES_GCM mechanism.

Assist the verification of FMs in compliance with industry and national standards. See FMSW_GetImage API to validate an FM.

You can now use Luna Cloud HSM services to back up any Luna 7 HSM securely in the cloud.

>SimMultisign in JCPROV (requires minimum Luna HSM Firmware 7.7.0)

>ECIES structure CK_ECIES_PARAMS_EXT in JCPROV (requires minimum Luna HSM Firmware 7.7.0)
>New HA Login API in JCPROV (requires minimum Luna HSM Firmware 7.7.0). Includes a new sample, HALogin_v2.java.

>SHA-3 in JCPROV/JSP (requires minimum Luna HSM Firmware 7.4.2)

>BIP32 Sample Java Application Extended to Demonstrate BIP44 Key Derivation (requires minimum Luna HSM Firmware 7.3.0)

Refer to Luna HSM Client 10.4.0 and Luna HSM Client 10.4.0 for more information.

>OUID Methods GetObjectUID and GetObjectHandle Usable With HA Groups

>CK_MILENAGE_SIGN_PARAMS can now be used in HA Groups (requires minimum Luna HSM Firmware 7.4.2)

Refer to High-Availability Groups.

Now possible to set CKA_EXTRACTABLE when creating private keys using Luna KSP.

PKA meets a requirement of PP 419-221.5, and allows each key in a partition to have its own authorization and rules governing its use, including integration with a SAM. and sole control of keys. The resulting overhead increases the size of partition headers, affecting the size and number of objects that can be stored, which invokes new considerations for backup and restore.

Existing applications (with no PKA awareness) can still work if the new Client Cryptoki library is installed. Existing partitions become "backward compatible" when the HSM is upgraded to f/w 7.7.0. New partitions can be backward compatible or PP 419-221.5-compatible by setting an option at creation time.

>Luna HSM Client 10.1 or higher is required to use Luna partitions with DPoD Luna Cloud HSM services

>The PE1756Enabled setting on Luna 6.x HSMs is not supported for use with the Version-Compatible Luna HSM Client

>Minimum OS requirements for Luna HSM Client 7.2 must be met (Refer to the CRN for details)

The Crypto User (CU) role has always been able to create public objects, but not clone them. In HA mode, this would cause the replication and subsequent object creation operations to fail. Firmware 7.2.0 allows the CU to clone public objects, and therefore to perform operations on HA groups without Crypto Officer authentication.

You can configure partition policies for Cloning or Key Export Mode manually, as long as you have updated the HSM firmware. To set these modes using Policy Templates, you must meet the Policy Template requirements.