Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo
back

Release Notes

search

Please Note:

Release Notes

Product Description

CipherTrust Manager is the center of the CipherTrust Data Security Platform. It serves as the central point for managing configuration, policy and key material for data discovery, encryption, on-premise and cloud based use cases. It is the successor to both the Thales eSecurity (formerly Vormetric) DSM and the Gemalto (formerly SafeNet) KeySecure platforms.

Product Abbreviations

NameAbbreviation
CipherTrust Batch Data TransformationBDT
CipherTrust ManagerCM
CipherTrust Application Data ProtectionCADP
CipherTrust Cloud Key ManagerCCKM
CipherTrust Data Protection GatewayDPG
CipherTrust Database Protection (formerly known as ProtectDB)CDP
CipherTrust Transparent EncryptionCTE
CipherTrust Transparent Encryption UserSpace (formerly known as ProtectFile FUSE)CTE UserSpace
CipherTrust Teradata ProtectionCTP
CipherTrust Intelligent ProtectionCIP
CipherTrust Data Discovery and ClassificationDDC
Data Protection on DemandDPoD
CipherTrust TokenizationCT
CipherTrust Vaulted TokenizationCT-V
CipherTrust Vaultless TokenizationCT-VL

Release Description

This release is available on the Customer Support Portal in the following formats:

  • An upgrade file for physical k570, k470 and k160 CipherTrust Manager devices, and existing k170v Virtual CipherTrust Manager instances.

  • An OVA image file for deploying a new Virtual CipherTrust Manager on VMWare vSphere or Nutanix AHV.

  • A VHDX image file for deploying a new Virtual CipherTrust Manager on Microsoft Hyper-V.

  • A QCOW2 image file for deploying a new Virtual CipherTrust Manager on OpenStack.

In addition, 2.11.0 Virtual CipherTrust Manager is available on the following public clouds:

  • Amazon Web Services: SafeNet Cloud Provisioning System

  • Google Cloud

  • Microsoft Azure: Available as a BYOL image in the Microsoft Azure Marketplace

  • Oracle Cloud

  • IBM Cloud

    • An OVA image file for deploying a new Virtual CipherTrust Manager on IBM Cloud VMWare.

    • A QCOW2 image file for deploying a new Virtual CipherTrust Manager IBM Cloud Virtual Private Cloud Gen2.

2.11.0 contains a number of new features and enhancements. Refer to Release 2.11.0 for details. For the list of known issues, refer to Known Issues.

Features and Enhancements

Release 2.12.0

Platform

  • Enhanced the /v1/system/info API to get the serial number (chassis_serial_number) of the CipherTrust Manager Physical Appliance.

  • New features for Thales TCT k570:

    • Upgrade Luna Client to fully support FIPS backup

    • CM 2.8 Feature Support: Key Rotation for HSM Root Key

    • Support for External JWT Rotation

Limitations

  • To fetch all keys, it is recommended to use KeyNamesRequest instead of KeyQueryRequest. The KeyQueryRequest response time is proportional to the number of keys on the CipherTrust Manager, hence may lead to a timeout exception on the client side.

  • Currently, the log forwarders are not configured to use the system's proxy configuration. If proxy is configured, the log forwarders bypass the proxy servers.

  • The backup and restore of users and groups in a domain only works among the domains of different CipherTrust Managers. This feature does not support backup and restore among different domains of the same CipherTrust Manager.

  • During client renewal, if another client (which has Auth mode set to DN) already exists in the system with a matching subject DN, the client renewal may fail. This applies to external or local CA clients. For external CA certificates, delete the client to be renewed and register a new client with a new certificate and different subject DN.
    However, for local CAs, it is not required to delete the client to be renewed, rather set the do_not_modify_subject_dn field to false. Refer to Renewing Local CA Clients for details.

Deprecated Feature(s)

The CipherTrust Manager version 2.9 onward:

  • The 'global' user doesn't get generated on restart.

  • The 'global' user cannot be created.

    While upgrading to CipherTrust Manager 2.9, the 'global' user gets deleted.

    In CipherTrust Manager 2.8 and 2.9 mixed cluster environment, if a 'global' user exists, you cannot login as a 'global' user.

    While upgrading to CipherTrust Manager 2.9 or in mixed cluster environment, if a 'global' user is deleted, the keys owned by the 'global' user will be accessible to the 'Key admin' or 'admin' groups. The NAE/KMIP users can also access these keys.

Application Data Protection

  • Added support for access policies that allow you to select how to display data in a RESTful API call during the reveal operation based on the user. The data can be revealed as:

    • Plaintext

    • CipherText

    • Masked Value

    • Error/Replacement Value

  • Added licensing enforcement for DPG.

CCKM

  • [Tech Preview] Added support for external vaults and external keys for Oracle Cloud Infrastructure (OCI) using the API.

  • Provided GUI to manage Azure certificates and Azure secrets.

  • Enhanced the Scheduler GUI to automatically rotate AWS and Azure keys after a specific number of days of their creation or the last rotation.

  • Added capability to schedule key rotation at the Azure key vault level using the GUI.

  • Added support for migration of CCKM Enterprise source keys from Data Security Manager (DSM) to the CipherTrust Manager.

  • Added support for migration from CCKM Appliance with CipherTrust Manager as Key Source to the CipherTrust Manager.

  • Added capability to generate and verify Hash-based Message Authentication Codes (HMAC) for AWS symmetric keys.

  • Ability to get alerts/notifications for the AWS and Azure cloud key expiry events.

CTE

  • Added support for CipherTrust Manager's quorum control for CTE operations and resources. A CipherTrust Manager administrator can configure a quorum policy to have multiple approvers for supported operations.

  • Added support for signature sets for CTE for Kubernetes clients.

  • Added support for COS policies for Wasabi cloud storage.

  • Enhanced the CTE clients GUI to display different client types - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

  • Enhanced CTE reports to filter reports based on client type - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

CTE resources of Efficient Storage and Container policies on the DSM cannot be migrated to the CipherTrust Manager 2.10 using the backup/restore method. The Container policies are supported only on the DSM. However, Efficient Storage resources can be manually created on the CipherTrust Manager. Migration of Efficient Storage resources will be supported in a future release.

CTE UserSpace

CTE UserSpace is a new kernel-independent file encryption product based on CTE and CTE UserSpace (rebranded ProtectFile FUSE). The CTE UserSpace version compatible with CipherTrust Manager 2.10 will be 10.0 (instead of 9.5).

  • The resources of CTE UserSpace clients running 9.5 and higher Agent versions are managed by the Transparent Encryption application on the CipherTrust Manager. These clients can't be managed by the ProtectFile & Transparent Encryption UserSpace application.

    This release does not support the following features:

    • Kernel Compatibility Matrix

    • Agent and System locks

    • CBC and XTS keys

    • COS, ESG, IDT, and LDT policies and GuardPoints

    To manage the clients running the previous versions of the CTE UserSpace Agent, use the ProtectFile & Transparent Encryption UserSpace application only. Alternatively, upgrade those clients to CTE UserSpace 9.5 or a higher version.

  • Added support for CipherTrust Manager's quorum control for CTE operations and resources. A CipherTrust Manager administrator can configure a quorum policy to have multiple approvers for supported operations.

  • Enhanced the CTE clients GUI to display different client types - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

  • Enhanced CTE reports to filter reports based on client type - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

CIP

  • Added support for NFS and SMB/CIFS DataStores

  • Added capability to scan SMB/CIFS DataStores

  • Added capability to generate reports for NFS/SMB/CIFS DataStores

  • Extended policy support to NFS and SMB/CIFS GuardPoints

DDC

  • EOS for Legacy Reports

  • The Singaporean NRIC data type has been enhanced to include the new prefix "M" for Foreign Identification Numbers (FINs)

  • TBD

Resolved Issues

This table lists the issues resolved in 2.11.0.

IssueSynopsis
KY-57030Problem: Azure GUI: While configuring a key rotation schedule, if you select All Keys Based on Creation/Last Rotation Date, but without making any changes switch to the All Keys or Only Expiring Keys option, then any changes under the selected option cannot be saved.
KY-56057Problem: On the CipherTrust Manager GUI, the Client Settings field does not allow the hash character #. If specified, the Client Settings tab cannot be accessed.
CM-18Thales TCT k570 model does not support HSM Firmware Upgrade (in field).
KY-52237The state of a pending CA changes to expired after the restart. This breaks the connection/integration of any KMIP or VSAN client.
KY-52180Problem: The Re-sign Settings toggle on the Client Settings tab remains enabled after settings are pushed to the CTE agent.
KY-46776GUI shows EC and RSA key types when adding keys to Azure-managed HSM vaults.
These key types are no longer visible on the GUI when adding keys to Azure-managed HSM vaults.

Advisory Notes

This section highlights important issues you should be aware of before deploying the CipherTrust Manager. There is also a full list of known issues associated with the release.

USB Host Logs are Not Immediately Forwarded on Upgrade

If you have an existing syslog forwarder configured for host logs, and upgrade to 2.11, the USB host logs are not immediately forwarded. You need to manually force the syslog forwarder to update completely. This can be achieved by:

  • Using the modify command.

    1. Use kscfg syslog forwarder modify --id <syslog_forwarder_id> --<another_option> <temporary_value> force the update.

    2. Use kscfg syslog forwarder modify --id <syslog_forwarder_id> --<another_option> <original_value> to reset to the original value.

  • Deleting and recreating the syslog forwarder.

    1. View the syslog forwarder's current configuration values with kscfg syslog forwarder get --id. Note down or otherwise retain these configuration values.

    2. Delete the existing the syslog forwarder with kscfg syslog forwarder delete --id <syslog forwarder_id>.

    3. Re-create the syslog forwarder with kscfg syslog forwarder add, including any options necessary to set the original configuration values. These options are documented here.

NextGen KeySecure and ProtectFile End-of-Support in 2023

NextGen KeySecure firmware and the ProtectFile connector will be End of Support in December 2023.

In most cases, you can upgrade from NextGen KeySecure to CipherTrust Manager directly. If you are running the legacy k450 or k460 hardware model, you must migrate data to the k470 or k570 model.

We strongly recommend migrating ProtectFile to CTE or CTE Userspace.

Luna Network HSM 5.x and 6.x are no longer supported as Root-of-Trust for CipherTrust Manager

As Thales has passed the end-of-support date for Luna Network HSM 5.x and 6.x, CipherTrust Manager no longer supports those versions for root of trust. CipherTrust Manager does not enforce against setting up those versions for root-of-trust, so upgrading will not disrupt existing root-of-trust connections to our knowledge. Consult the End of Sale and End of Support announcement, Luna Network HSM 7 documentation, and Data Protection on Demand and Luna Cloud HSM documentation for migration information.

Quorum

Do not enable quorum on the ManagePolicyAttachment and DeletePolicy operations until all the CipherTrust Manager nodes in a cluster are upgraded to 2.10 or a higher version.

SMB Connection

The Host and Port fields must be specified together, or do not specify any of them. If Host and Portare not specified while creating an SMB connection, these fields cannot be added later.

Recommendation for Secure Initialization Vector in DESede CBC, AES CBC, and AES GCM Encryption Requests

When generating a new AES or DESede key CipherTrust Manager currently generates and stores a Default IV associated with the new key. This is mainly used to support specific legacy integrations and applications.

We strongly recommend future crypto applications use a secure, unique initialization vector (IV) for each AES CBC, AES GCM, and DESede CBC encryption request, rather than relying on a default IV provided by CipherTrust Manager for the security of your data. For example, unpredictable, unique IVs for AES CBC requests protect against oracle attack techniques such as ROBOT, DROWN, POODLE, and BEAST.

We recommend to use CipherTrust Manager's random number generation to produce secure IVs, or you can provide your own IV with each AES CBC, AES GCM or DESede CBC encryption request following the security guidelines for constructing secure IVs in NIST SP800-38A and NIST SP800-38D.

The IV value used for an encryption request is needed to decrypt the data later.

In the KMIP interface, always set the RandomIV object in the Cryptographic Parameters attribute to true or provide your own secure IV in the Request Payload as an IV/Counter/Nonce object.

In the REST and NAE interfaces, use CipherTrust Manager's random number generation to produce secure IVs for cryptographic requests, or provide your own secure IV.

Some Key States Change After Upgrade

After upgrade from 2.4 some key states are remapped as a result of harmonizing NAE-only key states. In most cases, the allowed operations for a key remain the same before and after upgrade, so key usage is not disrupted.

As you cannot upgrade directly from 2.4 to 2.11, these changes take effect when you first upgrade from 2.4 to an intermediate minor version, 2.5, 2.6, or 2.7.

  • When a key has an NAE state of Retired and the deactivation date is set in the future, the key is set to Deactivated immediately upon upgrade. No cryptographic operations are allowed.

  • When a key has an NAE state of Restricted and Protect Stop Date is set in future, the key is set to Active and the Protect Stop Date is set to the current time. Decryption, signature verification, unwrapping, and MAC verification are allowed.

  • When a key has an NAE state of Active and Activation Date is not set, the activation date is set to the current time. All cryptographic operations are allowed.

  • When a key has an NAE state of Active and Activation Date is set in the future, the key is set to a Pre-Active state and the Activation Date is retained. No cryptographic operations are allowed until the Activation Date is reached.

  • When a key has a state of Deactivated before upgrade, its state will be unchanged after upgrade. However, the allowed operations for the Deactivated state change for 2.5. The key loses its ability to decrypt, verify signatures, unwrap, and verify MACs. You can re-activate the key after upgrade and set the ProtectStop date to restore those operations.

System Upgrade and Downgrade Supported Releases

System upgrades on a single unclustered device have been tested from releases 2.8.0, 2.9.0, and 2.10.0.

Upgrades from other versions have not been tested and may not work correctly.

CipherTrust Manager 2.11.0 can be downgraded to 2.10.0 for test purposes. For release-specific upgrade/downgrade information, refer to the release notes for your release.

Warning

As we cannot guarantee stability, we strongly recommend using downgraded systems for test environments only. Do not use a downgraded CipherTrust Manager in a production environment.

Refer to the System Upgrade page for instructions to perform an upgrade or downgrade.

The cluster upgrade section provides instructions to perform an upgrade on a cluster of devices. Supported upgrade paths depend on the method used to upgrade the cluster.

  • In-place offline cluster upgrade is supported from 2.10.

  • Cluster remove/rebuild is supported from 2.8, 2.9, and 2.10.

  • In-place cluster upgrade is performed from one minor version at a time, so there is no limit on starting version.

Restoring a backup from release 1.5.0 or later is supported; however, restoring a newer backup to an older version is never supported.

Protect the ksadmin Private SSH Key

The private SSH key for the ksadmin account is critical to system security and must be carefully protected. Failure to do so could allow an attacker to compromise the system.

TLS/SSL Must be Enabled in a Production System

As it may be useful for troubleshooting, it is possible to disable TLS/SSL for the NAE interface. This will lead to an insecure system. Therefore, TLS/SSL should always be enabled for a production system.

Key Usage Mask Selection

If you want to perform any operation (for example, Wrap/Unwrap) from the NAE/KMIP connector, set the usage mask explicitly for that operation while creating keys through UI.

DDC

Upgrading DDC

After you upgrade to version 2.11 you will not be able to downgrade it to any of the previous versions.

Clusters

  • Only one CipherTrust Manager node in the cluster can have DDC activated. To access DDC, create a new DNS entry to point to the active CipherTrust Manager node.

  • DDC functionality cannot be accessed through the CipherTrust Manager FQDN. DDC requests sent to an inactive CipherTrust Manager node fail (and return the impression that DDC fails randomly).

Licensing

Overlapping licenses are not supported (except for the trial license).

EOS for Legacy Reports

The support for Legacy Reports has been dropped in DDC 2.11.

EOS for KCT Datastore

End of Support for KCT Datastore Format in DDC 2.11.

Upcoming End of Support for Platforms and Features

  • Linux 2.4 Node Agents

  • Email Targets - Microsoft Exchange (EWS)

  • Microsoft 365 - Exchange Online (EWS)

  • Web Browser - Internet Explorer

Compatibility

This section documents known compatibility topics to be considered before deploying the CipherTrust Manager.

TLS Compatibility

This table identifies the supported TLS versions for each of the CipherTrust Manager interfaces. The default minimum value reflects the default minimum_tls_version setting. This setting controls the lowest acceptable TLS version allowed for connections to the interface.

InterfaceMinimum TLS versionMaximum TLS versionDefault Minimum TLS version
Web UITLS 1.2TLS 1.3TLS 1.2
NAETLS 1.0TLS 1.3TLS 1.2
KMIPTLS 1.0TLS 1.3TLS 1.2

TLS 1.0 and TLS 1.1 support will be discontinued in a future release.

By default, CipherTrust Manager accepts the following ciphersuites for TLS 1.2+ connections:

  • TLS_AES_256_GCM_SHA384 (TLSv1.3)

  • TLS_CHACHA20_POLY1305_SHA256 (TLSv1.3)

  • TLS_AES_128_GCM_SHA256 (TLSv1.3)

  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS Deprecation Notices

  • Use of TLS 1.0 and 1.1 protocols is deprecated. This support will be discontinued in a future release. Upgrade all applications connecting to CipherTrust Manager interfaces to TLS 1.2 or higher as soon as feasible.

  • Use of the following CBC-based ciphersuites is deprecated, and support will be discontinued in a future release:

    • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

    • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

    • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

    • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

    • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

    • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

    • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

    • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

    • TLS_RSA_WITH_AES_256_CBC_SHA

    • TLS_RSA_WITH_AES_128_CBC_SHA

Client Platforms

The following client Platforms are supported by the CipherTrust Manager.

Older versions of most client platforms (versions earlier than the minimum versions listed below) may have incompatible TLS clients. We recommend testing older versions of client platforms in a non-production environment to ensure proper functionality.

For the purpose of transitioning from SafeNet KeySecure Classic, you can temporarily connect to CipherTrust Manager with TLS/SSL disabled on the CipherTrust Manager NAE interface; however, this is recommended only in a non-production environment.

CipherTrust Application Data Protection

  • ProtectApp JCE: minimum version 8.6.1

  • ProtectApp .NET: minimum version 8.11.0

  • ProtectApp ICAPI: minimum version 8.10.0

  • ProtectApp Oracle TDE: minimum version 8.9.0

  • ProtectApp SQL EKM: minimum version 8.3.2

CipherTrust Cloud Key Manager

Minimum version 1.6.3.20532

CipherTrust Database Protection

  • ProtectDB Oracle: minimum version 8.8.0

  • ProtectDB SQL: minimum version 8.9.0

  • ProtectDB DB2: minimum version 8.7.0

  • Transformation Utility: minimum version 8.4.3

CipherTrust Transparent Encryption

Minimum version 7.0.0

CipherTrust Transparent Encryption UserSpace

Minimum version 10.0

CipherTrust Vaulted Tokenization

  • Tokenization Manager: minimum version 8.7.1

  • Vaultless Tokenization Manager: minimum version 8.8.0

CipherTrust Batch Data Transformation

Minimum version 2.2.0.2816

CipherTrust Vaultless Tokenization

Minimum version 2.5.2.19

CipherTrust Teradata Protection

Minimum version 6.4.0.12

ProtectFile

Minimum version:

  • ProtectFile Windows 8.12.3

  • ProtectFile Linux 8.12.3, 8.12.4p02 (for migration to CTE)

The latest three GA versions of ProtectFile are tested with CipherTrust Manager. Older versions are expected to work, but they are not tested explicitly.

Data Discovery and Classification Agents

Linux minimum kernel version is 2.6.

There are no changes in Agent requirements if you are upgrading from CM 2.4 to 2.5.1. If you are upgrading from a version older than 2.4 please refer to Upgrading Agents.

ODBC driver for Microsoft SQL: To connect to Microsoft SQL, DDC Agent requires the ODBC drivers to be installed on the host. If DDC cannot find a suitable agent, make sure that these drivers are installed. If necessary, upgrade them to the latest available version. Thus, if your MSSQL Server is configured with TLS 1.2 only, install the ODBC Driver 17 for MSSQL Server.

TDP Version Compatibility

Data Discovery and Classification requires TDP 3.1.5.1 or newer.

Known Issues

This section lists the issues known to exist in the product at the time of release.

CipherTrust Manager

ReferenceSynopsis
KY-52137Problem: If you rotate the root of trust key for an HSM and then reboot the appliance, services fail to start up and the reboot does not complete. This can happen when the HSM contains two root of trust keys with the same name, and the wrong HSM key is loaded.
Workaround: If you are stuck in services startup, access the HSM with another client, and re-label one of the duplicate keys.
KY-51664Problem: When nShield Connect HSM is configured as root of trust, there are intermittent connectivity issues. The nShield HSM occasionally returns a ServerAccessDenied error, and CipherTrust Manager raises the HSM is offline system alarm.
Workaround: Wait for connectivity issues to resolve after a few automatic reconnection attempts.
KY-49289Problem: If a Luna Network HSM partition is configured as root of trust, and CipherTrust Manager's client access is revoked with the LunaSH commandclient revokePartition, connectivity remains intact until CipherTrust Manager is restarted.
Workaround: As a best practice, after running client revokePartition, restart the CipherTrust Manager or restart all CipherTrust Manager services.
KY-49126Problem: After the external CA is uploaded on the CipherTrust Manager, the GN and DC fields are not displayed as part of the record.
KY-48284Problem: Domain backups with local users cannot be restored into another domain in the same cluster.
Workaround: Restore the backup to a CipherTrust Manager in a new cluster, or to a different CipherTrust Manager instance which isn't clustered.
KY-42690Problem: If you edit the default port value on the web or KMIP interface, and then join the CipherTrust Manager to a cluster, web or KMIP requests directed to the changed port value fail on other nodes. This is true even though the nodes in the cluster display the new, correct port value for these interfaces.
Workaround: On CipherTrust Manager nodes with failing requests, change the interface port number to a temporary value, and then change the interface port number again to the desired value.
KY-39235If a user fails to log in to a domain, an audit record is created in the root domain instead of the intended domain.
KY-27450Local Certificate Authorities (CAs) do not allow commas , in any of the fields.
Workaround: Configure an External CA instead. Use a backslash \ in the Distinguished Name (DN) while creating a user if you are using certificate based login. For example, C=IN,ST=UP,L=Noida,O=Thales\,INC,OU=ENC,CN=test is an accepted value.
All other printable characters are allowed, as per RFC 5280 definition of PrintableString. @ and & are also allowed, beyond the definitions of the RFC.
KY-25152You cannot pass in a custom SSH key via cloud init on Oracle Cloud instances for initial launch. You also cannot use cloud-init to auto-generate an initial password for the admin user on Oracle Cloud instances.
Workaround: Login to the GUI to enter the SSH public key on initial access. You can also change the password for the admin user on this login.
KY-20310When setting up a new DPoD HSM on Demand Service as root of trust, the command succeeds but sometimes returns a timeout error.
Workaround: Disregard the timeout error.
KY-17662In-place cluster upgrade does not enforce upgrading only one version.
KY-17338KMIP: LDAP users cannot be set in the KMIP profile.
Workaround: To use LDAP authentication, use the KMIP auto registration.
KY-13617Domain scoped backup fails to restore on another domain when a key with the same name and version already exists.
Workaround: To handle this issue, try either of the following:
  • Retain both keys.
    1. Take the backup without the conflicting key with filters.
    2. Export/import the key material and import it separately.
  • Retain only the backup key.
    1. Delete the key with duplicate name on the restore system.
    2. Restore the domain scoped backup.
KY-13343Uploading an existing backup results in error but is displayed in the list with status "Uploading".
Workaround: Delete the backup using the "uploadID" as backup ID.
KY-11517[ProtectApp Application] The Invalid algorithm string error occurs when signing data with SHA384withRSA/PSSPadding.
KY-7289When migrating a KMIP application from KeySecure Classic to CipherTrust Manager, for encrypt/decrypt operations, the KMIP server always uses the ECB mode regardless of the provided mode.
Workaround: For migration use cases, if Cryptographic Usage Mask is specified with the CBC mode on KeySecure Classic:
  1. Decrypt the data using KeySecure Classic.
  2. Encrypt the data with keys stored on CipherTrust Manager.
KY-7288When migrating from KeySecure Classic to CipherTrust Manager, AES-GCM encrypt/decrypt operations, AuthenticatedEncryptionTag is returned appended to CipherText.
Workaround: For migration use cases, when using AES-GCM with KeySecure Classic:
  1. Decrypt the data using KeySecure Classic.
  2. Encrypt the data with keys stored on CipherTrust Manager.
After migration to CipherTrust Manager, the AAD tag is not appended to the data. It is sent as a separate tag.
KY-7193Sub-domain System Defined Groups do not show "Domain Admins", "ProtectApp Users", and "ProtectDB Users" groups.
Workaround: Manually create missing groups in sub-domains. Policies for the groups are automatically created.
KY-6383Users with a pipe in their user names (for example, user1|something) cannot log on using NAE/KMIP.
KY-3670Cluster join operation can fail, but rarely, leaving joining node in a bad state.
Workaround: If a cluster join fails, verify that you can still log in to the joining node. If you cannot, restart the node before reattempting the join.
If you still cannot log on to the node:
  1. ssh in as the ksadmin user.
  2. Reset the node by running the ksctl reset command.
KY-2482(was NC-3480) Signing with EC keys does not work via the REST API.
KY-2423(was NC-2318) KMIP: Result Reason may not be accurate or have enough detail.
KY-2418(was NC-1780) NAE: Users cannot do a UserInfoRequest about themselves.
KY-1397(was NC-2253) Last Login and Logins count are not updated for global user.
KY-1396(was NC-2256) Group membership change for yourself does not take effect until after re-login.
KY-1394(was NC-2260) Trying to mark a shared key deletable or exportable by non-admin user returns: NotFound error. The error should be: insufficient permissions.
KY-1373(was NC-2391) Encrypt operation only generates a GetKey record. There's no indication the key was used.
KY-1166(was NC-4098) NAE/KMIP multiport iptables rules are not replicated.
Workaround: Perform NAE restart on each node.
KY-504Integration with CloudHSM Cluster: Fail-over is not supported between different ENI IPs within an AWS CloudHSM cluster.
NC-3573Migration: Active keys from KeySecure Classic will become Pre-Active on the CipherTrust Manager if the time zone is behind GMT.
Workaround: Change the state of the keys in Pre-Active state to active from REST API or KMIP interface.
NC-3572Migration: Keys in Pre-Active state on KeySecure Classic cannot be used for Crypto operations on the CipherTrust Manager.
Workaround: Change the state of the keys in Pre-Active state to Active using KeySecure Classic's Console (UI) or KMIP interface before taking the backup for migration.
Alternatively, after migration, change the state of the keys in Pre-Active state to Active from the CipherTrust Manager REST API or KMIP interface.
NC-2063If a user is deleted (or LDAP connection name changes), they fail to display in the keys table.

CipherTrust Application Data Protection (CADP for C)

IssueSynopsis
KY-47385Problem: If you migrate a non-deletable VAE key from Data Security Manager to the CipherTrust Manager, the imported key is shown as "deletable".
Workaround: After migration, edit the key attributes on the CipherTrust Manager to make it non-deletable.
KY-47374Problem: If you migrate a non-exportable VAE key from Data Security Manager to the CipherTrust Manager, the imported key is shown as "exportable".
Workaround: After migration, edit the key attributes on the CipherTrust Manager to make it non-exportable.

CipherTrust Cloud Key Manager

IssueSynopsis
KY-55597Problem: Azure GUI: If an overriding schedule is added to an Azure vault, the size and source of the key rotation are not visible on the Key details page.
Workaround: View and change the size and source of the key rotation using the API.
KY-49086The POLICIES section of the AWS Keys details page does not show the roles associated with the key in the basic policy view.
Workaround: View the associated roles in the raw policy view.
KY-44547GUI: The "requested by" search functionality does not work for Google Workspace CSE records (Records > Google Workspace CSE).
KY-39123SAP Data Custodian: When a SAP group is added again, then performing any enable, disable, update, and add new version operation on a key in the group returns the "500 Internal Server Error".
Workaround: Refresh the newly added group, add the key again, and retry operations.
KY-35220When the CipherTrust Manager is upgraded, the Azure Keys page does not show any keys. "Error unescaping tags: invalid URL escape "%" 9 : NCERRInvalidParamValue" is returned.
Workaround: Refresh all the key vaults.
KY-31186If your proxy server does not support HTTP CONNECT, the CCKM Google cloud connection cannot use the CipherTrust Manager's proxy feature with a certificate.
Workaround: Add an exception (cloudkms.googleapis.com) with no_proxy or use the proxy with username and password, and restart the services.
KY-31058The manual add version/rotation process (using Clone Existing Key Material) of Google Cloud symmetric keys using migrated AWS DSM keys does not work.
KY-27583CCKM Scheduler: A key rotation or key refresh process remains stuck, and all new scheduled processes go into the scheduled state.
This happens when the scheduler expires due to some network issues or reboot of the CipherTrust Manager. The scheduled job remains in the running state.
Workaround: Delete the running and scheduled jobs from the API playground, and retry.
KY-17213When a CipherTrust Manager key is created using an auto rotation schedule on AWS cloud native key, its owner is set to "Global".
Workaround: A CipherTrust Manager administrator can assign the ownership of the key to a desired user in the CCKM Users group.

CipherTrust Database Protection

IssueSynopsis
PDB-3293If datatype of a column changes from char family to blob after migration, the Return replacement value option for the Error Replacement feature does not work.

CipherTrust Data Discovery and Classification

IssueSynopsis
KY-9098DDC cannot automatically assign an Agent for empty NFS shared folders. You cannot create an NFS type Data Store with an empty folder. When an empty folder is shared over NFS and scanned by DDC, the probe fails.
Workaround: Introduce any document in the empty folder and manually trigger the Agent selection. Click the "Find Agent" button to relaunch the Agent selection. The button is visible when you click the ellipsis (overflow) button next to the data store.
KY-9104Scan fails with “Error scanning. The target for Data Store XYZ cannot be accessed.” This happens when the Data Store is created and an Agent is selected for the Data Store but then the Agent is no longer available and there is no way to select a new Agent from the UI.
Workaround: Edit the Data Store and edit any configuration parameters so the DDC Server automatically searches for a new suitable Agent.
KY-9399The XVA file contains a data object that is was reported when it should not. The XVA file format is not correctly handled. After an XVA file is scanned and the report is generated, an additional data object in the Data Objects tab is displayed in the UI. You should ignore it.
KY-8990Scheduled scans and those launched manually via ‘run now’ only start after X hours. If an Agent and server have the wrong time set, DDC’s ability to schedule scans or to start them immediately when they are manually launched from the UI or API will be affected and the scan start may be delayed.
Workaround: Configure an NTP server for DDC and all Agent hosts.
KY-24205The Agent selection will fail if no compatible Agent is found, or if no compatible Agent can reach the Data Store, or if the credentials provided do not grant access to the Data Store.
Solution: For possible solutions, check the following:
  • Make sure a compatible Agent is properly installed. Check the compatibility table in the “Agent Configurations” section in the “DDC Deployment Guide”.
  • For a local Data Store, make sure that the Agent is installed on the same host where the Data Store is located.
  • For remote connections, make sure that the network connectivity between the Agent and the Data Store is not blocked by a network firewall.
  • Verify the configured credentials, and make sure that they have permission to connect and read the Data Store contents.
  • When you make sure that the Agent is up and with connectivity, go back to DDC and select the button "Find Agent" for the Data store with the issue.
  • Make sure that you do not have two (or more) Agents with the same hostname (for example, as a result of VMs cloning).
  • Configure the Data Store using a hostname, instead of an IP Address.
None of the clustered nodes responds to requests to DDC.
DDC is only active in one of the CipherTrust Manager nodes. Requests sent to any other nodes will return this error. This will be improved in next releases.
Solution:
  • Run ksctl ddc active-node to identify the CipherTrust Manager node responsible for answering DDC requests and send the requests to the indicated IP. If this does not work, please restart the CipherTrust Manager node with that IP.
  • If the node identified by ksctl ddc active-node does not answer DDC requests correctly or is no longer active, contact Thales Customer Support.
KY-22666DDC may not scan big Data Objects for Data Stores other than local storage.
The threshold to consider is a file as big as half of the assigned scan RAM. When a DDC scan encounters a file exceeding this threshold, it may completely skip the file or scan just up to that threshold. The user has no way to identify the issue from DDC reports.
Possible Workarounds:
  • Download large files to a local storage, and run the scan on this local storage data store.
  • Increase the scan RAM as indicated in the Tuning Scan Settings section.
KY-13618Sometimes, a scan cannot be resumed after the CipherTrust Manager is restarted.
When a scan is paused before restarting the CipherTrust Manager, sometimes, the scan is shown as RUNNING after the restart, when in fact, it is stalled.
Workaround: Restart the scan execution after restarting the CipherTrust Manager. Note that the progress of the previous scan will be lost.
KY-19763OracleDB and IBM DB2: uppercase schema/table name issues.
User cannot launch Oracle/DB2 scan if schema OR table was created with lowercase and DDC is configured with lowercase.
Workaround: Set the target path in uppercase.
KY-21981Postgres tables without primary keys are not completely scanned
DDC can only scan Postgres tables if they have at least one primary key defined.
Workaround: Configure at least one primary key in the tables and run the scan again.
KY-27095The PostgreSQL Agent selection fails as if there were no compatible Agent, or as if no compatible Agent could reach the Data Store. DDC does not support the scram-sha-256 authentication method.
Workaround: Create the user with 'md5' password encryption by specifying the hash of the password at user creation, as in CREATE USER <user name> PASSWORD 'md5<password hash>';
For example, to create a user named 'u0' with the password 'foobar' (md5('foobar') = ac4bbe016b808c3c0b816981f240dcae) use the following command: CREATE USER u0 PASSWORD 'md5ac4bbe016b808c3c0b816981f240dcae';
KY-27855"Something went wrong" message when generating a report with many scans.Report with many scans cannot be generated due to timeout in the requests between CM and the TDP servers.
Workaround:
  • Verify the TDP health.
  • Verify the network speed and latency between CM and TDP.
KY-27102Reports created before upgrading to CM 2.4 do not show Last run and Duration. The upgrade to CM 2.4 resets the Last run and Duration fields for the existing reports.
KY-30138MongoDB reports will only contain information for the first 1M documents even when more than 1M documents are scanned.
Workaround: Run scans with less than 1M documents.
KY-46340Office365: OneDrive for Business - Using wrong OneDrive domain while probing or scanning does not return an error.
Also a scan with the wrong domain and path does not return any error and it completes successfully.
KY-48874A scan with MySQL datastore (version 8.0.30) fails due to "failed status in the scanner service".
KY-49115Discrepancies in scan results of infotypes for the same file in DDC 2.10 and 2.9.
These infotypes show discrepancies:
- Australian Passport Number: 1070 (in version 2.9), 204 (in version 2.10)
- China Union Pay: 1000 (in 2.9), 921 (in 2.10)
- Discover: 1001 (in 2.9), 919 (in 2.10)
- Diners Club: 1001 (in 2.9), 1002 (in 2.10)
KY-51301For SMB Data Stores with remediation enabled, scans performed after remediation completes may not find matches in encrypted files.
Workaround: Automatic agent selection does not narrow the selection of DDC Agents to those installed on host with a CTE Agent in the Agent Group protecting the SMB Guard Point. If DDC selects any of those agents, further scans on the SMB will read the encrypted content and therefore will be unable to find any match. In order to avoid this issue, please assign use labels to force DDC to select only the right agents as follows:
- Add one dedicated label to the DDC Agents installed on the hosts with valid CTE Agent,
- Associate that same label to the SMB Data Store, in order to guide automatic agent selection algorithm.
KY-51306DDC Agent version 2.6 fails to configure for SMB datastore using hostname or IP.
Workaround: If the hostname or IP do not work as credentials, instead try only the username.
KY-51550Office365: OneDrive for Business - Scan progress reaches more than 100%.
KY-51586A scan of a LONGBLOB file in MySQL gets stuck while scanning.
DDC should be able to scan a 20MB table, as LONGBLOB data type supports upto 4 GB of data, yet it fails.
KY-51623Partial Scan in BLOBs of size greater than 100 MB in MSSQL.
NOTE: If a file is partially scanned, it will be considered in the inaccessible location list.
KY-52297DDC scan fails with an empty GuardPoint path for a SMB data store.
Solution: A GuardPoint for a data store must always have a path configured in CTE.
KY-51695DDC is only able to scan the initial 4KB of any text file stored as a large binary object in database tables.
KY-52494From this DDC version on (DDC-2.10), RHEL-compatible Agents can only be installed on environments running the matching and officially supported kernel version.
KY-52532Autopause feature not working as expected in Azure Table scans.
A scan of Azure Table with the "Autopause" feature enabled has the following issues:
  • it fails to resume after autopause end time after it enters the "Autopaused" state from the "Pending" state,
  • it fails to enter the "Autopaused" state from the "Running" state.

CipherTrust Transparent Encryption

IssueSynopsis
KY-56890Problem: CTE log forwarding to CipherTrust Manager causes high resource usage, leading to CTE management microservice restarting.
Workaround: On the CTE client profile, disable log upload before upgrading CipherTrust Manager to 2.11.
KY-55739Problem: When a CipherTrust Manager user having only CTE Admins group permissions initiates a Quorum-dependent operation, a corresponding Quorum is created. After the required Quorum approvals, the operation does not auto-trigger in the background.
Workaround: Retry the operation after the required Quorum approvals.
KY-55511, KY-55527, KY-55275, KY-55528Problem: Simultaneous composite operations (for example, update and delete) are not supported for quorums.
KY-55273Problem: If quorum is activated for client group deletion, then bulk client group deletion generates multiple quorums in pre-active state.
Workaround: Delete client groups individually.
KY-55064, KY-54442Problem: In case of bulk client or client GuardPoint deletion, the quorum details may not be available. However, quorum operations (such as approval, rejection) can be performed.
This issue has no impact on functionality.
KY-51759, KY-51754Problem: When quorum is enabled, if you perform an operation to delete clients or GuardPoints in bulk, the quorum is created in pre-active state.
Workaround: Activate the quorum using the /v1/quorum-mgmt/quorums/{id}/activate API.
KY-51135Problem: Group members cannot be imported from ldap for user sets.
KY-34329Browsing VxVM raw devices that have slash in the path names shows non-existing directory in the GuardPaths.
Workaround: Create GuardPoints by manually entering the raw device paths.

ProtectApp

IssueSynopsis
KSCH-16415The Host Name field on the Client Registration screen does not have validation for host availability.
Workaround: Add clients using the API.

ProtectFile

IssueSynopsis
KSCH-573Encryption rules cannot be modified to reset values for include and exclude extension parameters.
KSCH-568Encryption rules do not prevent specifying both include and exclude extension parameters simultaneously.
KSCH-567Modifying a file level encryption rule to set the “isRecursive” flag does not return error.
KSCH-564Non-encryptor clients cannot be removed from a Linux cluster while a cryptographic operation on an encryption rule is in progress.