Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CTE-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Widows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

ProtectServer 3 HSM firmware releases

Releases for FIPS 140-3 Level 3 deployments

search
printsuggest an edit

Releases for FIPS 140-3 Level 3 deployments

The following ProtectServer 3 HSM Firmware versions have been released to date for FIPS 140-3 Level 3 deployments:

Note

Thales recommends using matching minor versions of ProtectToolkit 7, the ProtectServer 3 HSM Firmware, and the ProtectServer 3 Network HSM Appliance Software for most deployments. Some new features and enhancements for a ProtectServer 3 HSM Firmware version listed below may require a specific version of ProtectToolkit 7. In such cases, the required ProtectToolkit 7 minor version is mentioned in parentheses.

If you are reconfiguring a ProtectServer 3 HSM deployment for FIPS 140-3 Level 3-compliance, read Advisory notes to take note of the operational changes that this firmware version introduces and reconfigure applications where necessary, before reconfiguring the deployment for 140-3 Level 3-compliance.

copy link to clipboardProtectServer 3 HSM Firmware 7.03.01

Note

ProtectServer 3 HSM Firmware 7.03.01 includes all the changes that Thales introduced with the following firmware versions:

Refer to the CRN entries of the above mentioned firmware versions for more information about which features, enhancements, and advisory notes are applicable to ProtectServer 3 HSM Firmware 7.03.01.

copy link to clipboardNew features and enhancements

copy link to clipboardAdvisory notes

copy link to clipboardSome mechanisms have new operational and key size restrictions in FIPS Mode

The EdDSA mechanism signature generation scheme is updated in FIPS mode as per section 7, appendix A.2.3 of the Digital Signature Standard.

The ECDSA signature generation scheme is updated as per section 6.3.1, appendices A.3.1 and A.3.2 of the Digital Signature Standard.

New operational and key size restrictions apply to the following mechanisms when they are used in FIPS mode:

copy link to clipboardProtectServer 3 HSM Firmware 7.03.00

Note

ProtectServer 3 HSM Firmware 7.03.00 does not include all the changes that Thales introduced with the following firmware versions:

Refer to the CRN entries of the abovementioned firmware versions for more information about which features, enhancements, and advisory notes are not applicable to ProtectServer 3 HSM Firmware 7.03.00.

copy link to clipboardNew features and enhancements

ProtectServer 3 HSM Firmware 7.03.00 supports the latest features and enhancements introduced with ProtectToolkit 7.3.0, resolves various known issues described in Known and resolved issues, and introduces other new features and enhancements.

copy link to clipboardProtectServer 3 HSM factory reset capability (requires ProtectToolkit 7.3.0)

The ProtectServer 3 HSM can be reset to factory settings, erasing all cryptographic objects, ProtectServer identity keys and certificates, and functionality modules (FMs). For more information, refer to Resetting the HSM to factory settings.

copy link to clipboardProtectServer 3 HSM runs periodic self-tests

The ProtectServer 3 HSM now runs periodic self-tests (PSTs) without any user intervention or on demand external triggers. For more information about these periodic self-tests, refer to Self-tests.

copy link to clipboardAdvisory notes

This section highlights important issues you should be aware of before deploying ProtectServer 3 HSM Firmware 7.03.00.

copy link to clipboardNew FIPS restrictions for RSA and ECC signing key pairs

New RSA and ECC signing key pairs can be generated and used for signing and verification operations only.

copy link to clipboardMinimum PIN length increased from 4 characters to 8 characters in FIPS Mode

When the FIPS Algorithms Only security flag is set, all PINs, with the exception of smart card PINs, must be 8 to 32 characters in length. If PINs that are less than 8 characters long are carried over to FIPS Mode, you can continue using the PINs but are blocked from completing cryptographic operations until the PIN is reset.

copy link to clipboardCKM_KEY_WRAP_SET_OAEP not supported in FIPS Mode

CKM_KEY_WRAP_SET_OAEP can no longer be used in FIPS Mode.

copy link to clipboardSome mechanisms have new operational and key size restrictions in FIPS Mode

New operational and key size restrictions apply to the following mechanisms when they are used in FIPS mode:

On this page