Known and resolved issues
This section lists known issues in all released versions of ProtectToolkit 7, the ProtectServer 3 HSM Firmware, and the ProtectServer 3 Network HSM Appliance Software. Workarounds are provided where available and issues that have been resolved are listed along with the component and version that includes the fix.
Select Client, Firmware, or Appliance to filter issues that appear on the page by product component.
All known issues are listed below. Refer to the following subsections:
ProtectToolkit 7 issues
The issues described below are applicable to ProtectToolkit 7.
PSR-8825
In PTK 7.2.3, FM Emulation limits messages to 64Kb instead of 64Mb.
Workaround
Update the limit in emulation libraries.
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8739
etnetclient and etnetserver failures.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8687
Unable to login to admin slot using KMU
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8648
Data objects whose size is 32/128Kb can be created but disappear after HSM reset.
Workaround
None
Resolved
Fixed with combination of ProtectToolkit 7.3.1 and ProtectServer 3 HSM Firmware 7.03.01.
PSR-8645
printf calls in an FM would not show up in the hsmtrace.
Workaround
Prevent the compiler from this optimization by explicitly asking to not use the normal libc.
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8576
MKFM fails to sign in FIPS 140-3
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8575
jcprov crashes for messages greater than 64KB
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8562
ctkmu xtr31 (PTK 7.3.0) does not work.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8546
network show does not show updated Hostname
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8542
fcrypt C sample program fails to compile.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.3.
Note
This issue is unresolved in ProtectToolkit 7.3.0 and some ProtectToolkit 7 versions older than ProtectToolkit 7.2.3.
PSR-8533
Unresolved externals when building FM sample on PTK 7.3.0
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-8417
FM samples fail to compile or run in Emulation Mode.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.3.
Note
This issue is unresolved in ProtectToolkit 7.3.0 and some ProtectToolkit 7 versions older than ProtectToolkit 7.2.3.
PSR-8397
Data objects (object class CKO_DATA) greater than 32 KB in size cannot be created.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.3.
Note
This issue is unresolved in ProtectToolkit 7.3.0 and some ProtectToolkit 7 versions older than ProtectToolkit 7.2.3.
PSR-8356
ctotp fails to initialize multifactor authentication for a role and returns OTP Initialization failed. (signature invalid).
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.3.
PSR-8251
ctconf -v reports aborted sessions in Open Session Count until the HSM is reset.
Workaround
None
Resolved
Fixed with combination of ProtectToolkit 7.3.1 and ProtectServer 3 Network HSM Appliance Software 7.3.1.
PSR-8238
The SafeNetKSP.dll certificate is expired.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.3.
Note
This issue is unresolved in ProtectToolkit 7.3.0 and some ProtectToolkit 7 versions older than ProtectToolkit 7.2.3.
PSR-8179
If you use GRUB to disable IPv6 on a Linux machine hosting a ProtectServer 3 PCIe for operation in Network Mode, SafeNet HSM Net Server (etnetserver) crashes.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.3.
Note
This issue is unresolved in ProtectToolkit 7.3.0 and some ProtectToolkit 7 versions older than ProtectToolkit 7.2.3.
PSR-8132
eccdemo FM sample cannot be used.
Workaround
Add the following line to eccdemo.c:
#include <genmacro.h>
Resolved
Fixed in ProtectToolkit 7.3.0.
PSR-8044
Tokens that are approximately 64 KB or larger cannot be replicated.
Workaround
None
Resolved
Fixed with combination of ProtectToolkit 7.2.1 and ProtectServer 3 HSM Firmware 7.02.01.
PSR-7783
HA recovery does not work if there are two WLD slots
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.1.
PSR-7347
The first attempt at importing cryptographic objects from a smart card will fail when:
-
The objects are being imported using an N of M scheme, where N is greater than 2.
-
The objects are being imported after an HSM tamper.
-
Logging is enabled.
Workaround
Run ctkmu i a second time, immediately after the failed attempt, to successfully import the objects onto the HSM.
Resolved
Fixed in ProtectToolkit 7.2.0.
PSR-6852
cipherobj FM sample fails to run on Ubuntu systems.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.3.0.
PSR-6810
ctident list all does not report any Peer Certs for HSMs that are part of a functioning trust relationship.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.1.
PSR-6239
On Ubuntu systems, the Embedded Linux Development Kit (ELDK) package does not appear in the list of installed packages after it is installed.
Workaround
None
Resolved
Fixed in ProtectToolkit 7.2.0.
PSR-6137
After installing ProtectToolkit 7 on Windows, the SFNT_CRYPT system variable is not set to the correct value, preventing applications from accessing the Cryptoki library.
Workaround
Complete either one of the following steps:
-
Set the Cryptoki provider once again. For more information, refer to Changing the Cryptoki provider.
-
Insert the path to the Cryptoki library as the value of the SFNT_CRYPT variable by editing the system variable directly.
Resolved
Fixed in ProtectToolkit 7.2.1.
PSR-5958
In ProtectToolkit 7.1.0, an error occurs while deleting slots with gCTAadmin.
Workaround
Run ctconf -d<slot> to delete slots on the HSM.
Resolved
Fixed in ProtectToolkit 7.3.0.
PSR-5499
gCTAdmin does not run on Windows and Linux.
Workaround
Use the ctconf and ctkmu command-line utilities to complete administrative tasks.
Resolved
Fixed in ProtectToolkit 7.1.0.
PSR-5057
After upgrading the HSM firmware, the gmadmin UI remains outdated and continues to display the previous firmware version.
Workaround
Restart gmadmin.
Resolved
Fixed in ProtectToolkit 7.1.0.
PSR-4604
When configuring a smart card, setting a user name longer than the stated maximum of 20 characters causes undefined characters to be displayed at the end of the user name.
Workaround
Do not set a smart card user name longer than 20 characters.
Resolved
Fixed in ProtectToolkit 7.1.0.
PSR-4470
When the MSCA service is stopped and then quickly restarted, the Safenet KSP library does not release the service before it is started again, resulting in a duplicate endpoint error message.
Workaround
Wait approximately 5 minutes before restarting the MSCA service.
Resolved
Fixed in ProtectToolkit 7.1.0.
PSR-3414
When a new PCIe driver is installed on Windows, the driver file (PTK_K7.sys) is not updated automatically.
Workaround
Use the following procedure to allow the Device Manager to recognize the new driver:
-
Disable the ProtectServer 3 PCIe device in the Device Manager.
-
Copy PTK_K7.sys manually from the installation directory to System32/drivers.
-
Enable the ProtectServer 3 PCIe device in the Device Manager.
Resolved
Fixed in ProtectToolkit 7.1.0.
PSR-3219
Pressing Cancel on the legacy Verifone 1000SE PIN pad halts the HSM.
Workaround
Do not press Cancel when entering keys. Upgrade to a newer PIN pad.
PSR-2046
When using ProtectToolkit-J, stopping an application using Ctrl-C causes the HSM to crash. Log reports a "Segmentation Fault".
Workaround
None
ProtectServer 3 HSM Firmware issues
The issues described below are applicable to the ProtectServer 3 HSM Firmware.
PSR-8648
Data objects whose size is 32/128Kb can be created but disappear after HSM reset.
Workaround
None
Resolved
Fixed with combination of ProtectToolkit 7.3.1 and ProtectServer 3 HSM Firmware 7.03.01.
PSR-8531
Generating RSA keys with invalid public exponent sizes will halt HSM in FIPS mode
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.03.01.
PSR-8166
Incorrect length prediction of output when CKM_AES_GCM operations call C_Decrypt and the input data size is not a multiple of 16 bytes.
Workaround
Avoid using length prediction and set the size the C_Decrypt buffer to the size of the encrypted data.
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.02.02.
Note
This issue is unresolved in ProtectServer 3 HSM Firmware 7.03.00 and some firmware versions older than ProtectServer 3 HSM Firmware 7.02.02.
PSR-8044
Tokens that are approximately 64 KB or larger cannot be replicated.
Workaround
None
Resolved
Fixed with combination of ProtectToolkit 7.2.1 and ProtectServer 3 HSM Firmware 7.02.01.
PSR-7940
When using an IDPrime smart card, the user is not locked out of the smart card after seven failed log on attempts.
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.02.
PSR-6598
CKM_DECODE_X_509 cannot be used to derive a public key from a certificate request.
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.02.01.
PSR-6518
C_Sign() returns an invalid signature when used with length prediction and if the data size is greater than 64 KB.
Workaround
Do not use length prediction with C_Sign() if the data size is greater than 64 KB.
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.02.
PSR-6494
If you are specifying a DES3 key as the wrapping key for an export key operation, by using the ctkmu x command with the -w option, and do not include the -3 option, the HSM halts.
Workaround
Include the -3 option to avoid halting the HSM or encountering an error.
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.00.
PSR-6150
When importing a certificate object onto the HSM alongside an RSA key object, the import operation fails and returns an error.
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.01.
PSR-6088
Some ECDSA signatures that are valid in OpenSSL fail to verify.
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.02.
PSR-6087
Specifying a custom ECC curve by parameter, rather than OID, returns an error.
Workaround
Specify the custom ECC curve by OID.
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.01.
PSR-6001
The ProtectServer 3 HSM crashes when attempting to decrypt a message with size of zero using an RSA key.
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.01.
PSR-5999
FM_GetCurrentPid, FM_GetCurrentOid, FM_SetCurrentPid, and FM_SetCurrentOid (current application ID functions) cannot be used.
Workaround
None
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.01.
PSR-5731
When using the Secure memory file system (SMFS), the SmFsReadFile function receives a different value from the one written by SmFsWriteFile.
Workaround
Modify the functionality module (FM) to only write data sizes that will be padded to a byte size that is divisible by 16. Thales recommends using a helper macro similar to the one shown below.
Example helper macro
In the following example snippet, the code will encrypt 47 bytes (33 + 14) which will then get correctly padded to 48 bytes (a multiple of 16).
#define FILE_SIZE(x) (((x) + 16 - ((x)%16)) - 1)
//Need 33 bytes
#define MAX_LENGTH FILE_SIZE(33)
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.00.
PSR-5727
When using the SMFS, the SVC_GetReplyBuffer HIFACE replay management function returns more data than requested.
Workaround
Reconfigure FMs that are calling SVC_GetReplyBuffer to call SVC_ResizeReplyBuffer instead.
Example FM reconfiguration
//SVC_GetReplyBuffer has an issue in PTK 7.00.00 FW
//Use SVC_ResizeReplyBuffer instead
outBuf = SVC_ResizeReplyBuffer(token, outBufLen);
//outBuf = SVC_GetReplyBuffer(token, outBufLen);
In the preceding example, SVC_ResizeReplyBuffer serves the same purpose as SVC_GetReplyBuffer but does not lead to the abovementioned error.
Resolved
Fixed in ProtectServer 3 HSM Firmware 7.01.00.
ProtectServer 3 Network HSM Appliance Software issues
The issues described below are applicable to the ProtectServer 3 Network HSM Appliance Software.
PSR-8749
PSE3+ with 2 bondings will lose one bonding after reboot.
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.3.1.
PSR-8741
After reboot of a network HSM with two interfaces, one interface will be lost.
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.3.1.
PSR-8683
Memory leak in etnetserver
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.3.1.
PSR-8666
SNMP reports incorrect session count when fullsecure message encyption is used
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.3.1.
PSR-8251
ctconf -v reports aborted sessions in Open Session Count until the HSM is reset.
Workaround
None
Resolved
Fixed with combination of ProtectToolkit 7.3.1 and ProtectServer 3 Network HSM Appliance Software 7.3.1.
PSR-7330
After changing the host name of a ProtectServer 3 External or ProtectServer 3+ External and restarting the appliance, the following occurs:
-
PSESH prompts the users with the old host name.
-
syslog messages continue to be reported with the old host name.
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.2.1.
PSR-6768
If more than 10 accept or drop rules have been added the iptables firewall of a ProtectServer 3 Network HSM appliance, rules 11 and higher cannot be specified with the network iptables PSESH command.
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.2.1.
PSR-6620
The secure log file cannot be viewed.
Workaround
None
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.3.0.
PSR-5142
When running psesh:>service restartnetwork, the network service might not restart if a network interface has been configured to use DHCP addressing and the network cable is unplugged from the respective network interface port on the appliance.
Workaround
If this occurs, complete one of the following two steps before running psesh:>service restart network:
-
Run psesh:>network interface delete -device <netdevice> to delete the network configuration for the interface.
-
Leave the network cable plugged into the respective network interface port on the appliance.
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.1.0.
PSR-5010
When running psesh:>sysconf appliance factory, the network configuration (hostname and IP address) are not reset.
Workaround
This issue has been partially fixed in ProtectServer 3 Network HSM Appliance Software 7.0.0; the IP address now resets after running psesh:>sysconf appliance factory.
Run psesh:>network hostname<hostname> to set a new host name for the appliance and complete the factory reset procedure.
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.1.0.
PSR-4802
When network interface bonding is configured in 802.3ad (Dynamic Link Aggregation) mode, repetitive spurious "illegal loopback" warnings are produced in the system logs.
Workaround
These warnings can be safely ignored.
Resolved
Fixed in ProtectServer 3 Network HSM Appliance Software 7.1.0.
