Release Notes

Product Description

CipherTrust Manager is the center of the CipherTrust Data Security Platform. It serves as the central point for managing configuration, policy and key material for data discovery, encryption, on-premise and cloud based use cases. It is the successor to both the Thales eSecurity (formerly Vormetric) DSM and the Gemalto (formerly SafeNet) KeySecure platforms.

Product Abbreviations

Release Description

This release is available on the Customer Support Portal in the following formats:

• An upgrade file for physical k570, k470 and k160 CipherTrust Manager as a Service devices, and existing k170v Virtual CipherTrust Manager as a Service instances.

• An OVA image file for deploying a new Virtual CipherTrust Manager as a Service on VMWare vSphere or Nutanix AHV.

• A VHDX image file for deploying a new Virtual CipherTrust Manager as a Service on Microsoft Hyper-V.

• A QCOW2 image file for deploying a new Virtual CipherTrust Manager as a Service on OpenStack.

In addition, 2.11.0 Virtual CipherTrust Manager is available on the following public clouds:

• Amazon Web Services: SafeNet Cloud Provisioning System

• Google Cloud

• Microsoft Azure: Available as a BYOL image in the Microsoft Azure Marketplace

• Oracle Cloud

• IBM Cloud

  • An OVA image file for deploying a new Virtual CipherTrust Manager as a Service on IBM Cloud VMWare.

  • A QCOW2 image file for deploying a new Virtual CipherTrust Manager as a Service IBM Cloud Virtual Private Cloud Gen2.

2.11.0 contains a number of new features and enhancements. Refer to Release 2.11.0 for details. For the list of known issues, refer to Known Issues.

Features and Enhancements

Release 2.11.0

Platform

• Support added to deploy the CipherTrust Manager AMI in AWS China region.  

• Support added to configure maximum TLS version on interfaces.

• Added ability to auto-generate server certificates on restart if CSR parameters or CA is changed.

• Registration of new KMIP client certificates now uses DN matching instead of fingerprint pinning.

• Support added for pre-registered public clients (KSCTL, NAE, Web-UI, and API playground).

• Expansion of the quorum feature for CTE specific bulk operations using API.

• Support added for RSA-PSS padding with pre-computed hash for Sign/SignVerify operations.

• Added ability to monitor KMIP and NAE cryptographic and key management operations through Prometheus and Grafana.

• Added support to modify the network interface settings for existing interfaces (NAE/KMIP/WEB).

• Provision to re-encrypt the data using the REST interface.

• Administer user login based on client types such as unregistered, public, and confidential clients.

• Added control of user impersonation behavior for KMIP and ProtectApp/NAE clients

• Auto registration support for NAE clients.

• Option to allow unregistered clients to register them on CipherTrust Manager using NAE interface.

• Introduced Prometheus metrics for CTM resources (licensing, user-management, key-rotations, and backups).

• Expansion of the quorum feature to delete GWS CSE endpoints.

• Support added for domain level backup and restore for CCKM resources (Projects, Google External Key Manager (EKM) Endpoints and Cryptospaces).

• The default setting of the system generated auto key rotation scheduler for new deployments is now disabled. However, in the previous releases, it was enabled.

• New features for Thales TCT k570:

  • Upgrade Luna Client to fully support FIPS backup

  • CM 2.8 Feature Support: Key Rotation for HSM Root Key

  • Support for External JWT Rotation

• The ProtectV tile has been removed from the CipherTrust Manager as a Service GUI. Refer to ProtectV for details.

Limitations

• To fetch a key, it is recommended to use KeyNamesRequest instead of KeyQueryRequest. The KeyQueryRequest is a time taking process and sometimes may lead to timeout exception.

• Currently, the log forwarders are not configured to use the system's proxy configuration. If proxy is configured, the log forwarders bypass the proxy servers.

• The backup and restore of users and groups in a domain only works among the domains of different CipherTrust Managers. This feature does not support backup and restore among different domains of the same CipherTrust Manager.

• During client renewal, if another client (which has Auth mode set to DN) already exists in the system with a matching subject DN, the client renewal may fail. This applies to external or local CA clients. For external CA certificates, delete the client to be renewed and register a new client with a new certificate and different subject DN.
  However, for local CAs, it is not required to delete the client to be renewed, rather set the do_not_modify_subject_dn field to false. Refer to Renewing Local CA Clients for details.

Deprecated Feature(s)

The CipherTrust Manager version 2.9 onward:

• The 'global' user doesn't get generated on restart.

• The 'global' user cannot be created.

  While upgrading to CipherTrust Manager 2.9, the 'global' user gets deleted.

  In CipherTrust Manager 2.8 and 2.9 mixed cluster environment, if a 'global' user exists, you cannot login as a 'global' user.

  While upgrading to CipherTrust Manager 2.9 or in mixed cluster environment, if a 'global' user is deleted, the keys owned by the 'global' user will be accessible to the 'Key admin' or 'admin' groups. The NAE/KMIP users can also access these keys.

Application Data Protection

Added trial licensing enforcement for DPG.

CCKM

• Provided GUI to manage Azure certificates and Azure secrets.

• Enhanced the Scheduler GUI to automatically rotate AWS and Azure keys after a specific number of days of their creation or the last rotation.

• Added capability to schedule key rotation at the Azure key vault level using the GUI.

• Added capability to select and modify policy and policy templates using the GUI.

• Added support for migration of CCKM Enterprise source keys from Data Security Manager (DSM) to the CipherTrust Manager.

• Added support for migration from CCKM Appliance with CipherTrust Manager as Key Source to the CipherTrust Manager as a Service.

• Added capability to generate and verify Hash-based Message Authentication Codes (HMAC) for AWS symmetric keys.

• Ability to get alerts/notifications for the AWS and Azure cloud key expiry events.

• Added support for Cloud KMS key management mode for Google EKM via a Virtual Private Cloud (VPC) connection to allow users to create, rotate, or destroy coordinated EKM keys through the Google console.

• Added support for Google EKM through a VPC.

• Added capability to allow the selection of all of the versions of an existing CipherTrust Manager key when creating an EKM endpoint.

• The XKS performance numbers for both the CipherTrust Manager and Luna HSM (as key sources) have improved for this 2.11.0 release.

CTE

• Added support for CipherTrust Manager as a Service's quorum control for CTE operations and resources. A CipherTrust Manager as a Service administrator can configure a quorum policy to have multiple approvers for supported operations.

• Added support for signature sets for CTE for Kubernetes clients.

• Added support for COS policies for Wasabi cloud storage.

• Enhanced the CTE clients GUI to display different client types - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

• Enhanced CTE reports to filter reports based on client type - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

CTE resources of Efficient Storage and Container policies on the DSM cannot be migrated to the CipherTrust Manager as a Service 2.10 using the backup/restore method. The Container policies are supported only on the DSM. However, Efficient Storage resources can be manually created on the CipherTrust Manager as a Service. Migration of Efficient Storage resources will be supported in a future release.

CTE UserSpace

CTE UserSpace is a new kernel-independent file encryption product based on CTE and CTE UserSpace (rebranded ProtectFile FUSE). The CTE UserSpace version compatible with CipherTrust Manager as a Service 2.10 will be 10.0 (instead of 9.5).

• The resources of CTE UserSpace clients running 9.5 and higher Agent versions are managed by the Transparent Encryption application on the CipherTrust Manager. These clients can't be managed by the ProtectFile & Transparent Encryption UserSpace application.

  This release does not support the following features:

  • Kernel Compatibility Matrix

  • Agent and System locks

  • CBC and XTS keys

  • COS, ESG, IDT, and LDT policies and GuardPoints

  To manage the clients running the previous versions of the CTE UserSpace Agent, use the ProtectFile & Transparent Encryption UserSpace application only. Alternatively, upgrade those clients to CTE UserSpace 9.5 or a higher version.

• Added support for CipherTrust Manager as a Service's quorum control for CTE operations and resources. A CipherTrust Manager as a Service administrator can configure a quorum policy to have multiple approvers for supported operations.

• Enhanced the CTE clients GUI to display different client types - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

• Enhanced CTE reports to filter reports based on client type - FS (CTE), CSI (CTE for Kubernetes), and CTE-U (CTE UserSpace).

CIP

• Added support for NFS and SMB/CIFS DataStores

• Added capability to scan SMB/CIFS DataStores

• Added capability to generate reports for NFS/SMB/CIFS DataStores

• Extended policy support to NFS and SMB/CIFS GuardPoints

DDC

• Agent upgrade to version 2.6.1. This resolves a few problems, such as support for filters in the Exchange and Sharepoint data stores. See the Advisory Notes below for more information.

• Support for scanning binary data in MongoDB and SAP HANA.

• Support for the Exchange Server data store.

• Removed support for legacy reports.

• Support for remediation of the root path in the SMB network storage data store.

• Support for different weights per InfoType. The risk in formulas for in Data Objects and Data Stores will now be calculated based on the value and occurrences of each InfoType.

• Enhanced Singaporean NRIC data type to include the new prefix "M" for Foreign Identification Numbers (FINs).

ProtectV

ProtectV is End-of-Life based on the announcement shared in the past. CipherTrust Manager 2.11 onward, the ProtectV tile has been removed from the CipherTrust Manager as a Service GUI and registering ProtectV clients is no longer supported.

Refer to End-of-Sale and End-of-Life Announcement SafeNet ProtectV for details.

CDP

Added support for the following operations on CipherTrust Manager UI for Oracle, MSSQL, and DB2:

Earlier, these operation were not supported though CipherTrust Manager interfaes. For details, refer to the CDP Admin Guide.

Resolved Issues

This table lists the issues resolved in 2.11.0.

Advisory Notes

This section highlights important issues you should be aware of before deploying the CipherTrust Manager. There is also a full list of known issues associated with the release.

Luna Network HSM 5.x and 6.x are no longer supported as Root-of-Trust for CipherTrust Manager as a Service

As Thales has passed the end-of-support date for Luna Network HSM 5.x and 6.x, CipherTrust Manager as a Service no longer supports those versions for root of trust. CipherTrust Manager as a Service does not enforce against setting up those versions for root-of-trust, so upgrading will not disrupt existing root-of-trust connections to our knowledge. Consult the End of Sale and End of Support announcement, Luna Network HSM 7 documentation, and Data Protection on Demand and Luna Cloud HSM documentation for migration information.

Quorum

Do not enable quorum on the ManagePolicyAttachment and DeletePolicy operations until all the CipherTrust Manager nodes in a cluster are upgraded to 2.10 or a higher version.

KeySecure Classic Hardware No Longer Supported

CipherTrust Manager as a Service firmware version 2.8 or above is not supported on KeySecure Classic k450 and k460 hardware. Refer to Migrate from KeySecure Classic for information on migrating KeySecure Classic data to CipherTrust Manager as a Service hardware.

SMB Connection

The Host and Port fields must be specified together, or do not specify any of them. If Host and Port are not specified while creating an SMB connection, these fields cannot be added later.

Recommendation for Secure Initialization Vector in DESede CBC, AES CBC, and AES GCM Encryption Requests

When generating a new AES or DESede key CipherTrust Manager as a Service currently generates and stores a Default IV associated with the new key. This is mainly used to support specific legacy integrations and applications.

We strongly recommend future crypto applications use a secure, unique initialization vector (IV) for each AES CBC, AES GCM, and DESede CBC encryption request, rather than relying on a default IV provided by CipherTrust Manager as a Service for the security of your data. For example, unpredictable, unique IVs for AES CBC requests protect against oracle attack techniques such as ROBOT, DROWN, POODLE, and BEAST.

We recommend to use CipherTrust Manager as a Service's random number generation to produce secure IVs, or you can provide your own IV with each AES CBC, AES GCM or DESede CBC encryption request following the security guidelines for constructing secure IVs in NIST SP800-38A and NIST SP800-38D.

The IV value used for an encryption request is needed to decrypt the data later.

In the KMIP interface, always set the RandomIV object in the Cryptographic Parameters attribute to true or provide your own secure IV in the Request Payload as an IV/Counter/Nonce object.

In the REST and NAE interfaces, use CipherTrust Manager as a Service's random number generation to produce secure IVs for cryptographic requests, or provide your own secure IV.

Some Key States Change After Upgrade

After upgrade from 2.4 some key states are remapped as a result of harmonizing NAE-only key states. In most cases, the allowed operations for a key remain the same before and after upgrade, so key usage is not disrupted.

As you cannot upgrade directly from 2.4 to 2.10, these changes take effect when you first upgrade from 2.4 to an intermediate minor version, 2.5, 2.6, or 2.7.

• When a key has an NAE state of Retired and the deactivation date is set in the future, the key is set to Deactivated immediately upon upgrade. No cryptographic operations are allowed.

• When a key has an NAE state of Restricted and Protect Stop Date is set in future, the key is set to Active and the Protect Stop Date is set to the current time. Decryption, signature verification, unwrapping, and MAC verification are allowed.

• When a key has an NAE state of Active and Activation Date is not set, the activation date is set to the current time. All cryptographic operations are allowed.

• When a key has an NAE state of Active and Activation Date is set in the future, the key is set to a Pre-Active state and the Activation Date is retained. No cryptographic operations are allowed until the Activation Date is reached.

• When a key has a state of Deactivated before upgrade, its state will be unchanged after upgrade. However, the allowed operations for the Deactivated state change for 2.5. The key loses its ability to decrypt, verify signatures, unwrap, and verify MACs. You can re-activate the key after upgrade and set the ProtectStop date to restore those operations.

System Upgrade and Downgrade Supported Releases

System upgrades have been tested from releases 2.5.0, 2.6.0, and 2.7.0.

Upgrades from other versions have not been tested and may not work correctly.

CipherTrust Manager 2.7.0 can be downgraded to 2.6.0. For release-specific upgrade/downgrade information, refer to the release notes for your release.

Refer to the System Upgrade page for instructions to perform an upgrade or downgrade. The cluster upgrade section provides instructions to perform an upgrade on a cluster of devices.

Restoring a backup from release 1.5.0 or later is supported; however, restoring a newer backup to an older version is never supported.

Clusters with a Large Number of Transactions

Clusters that support a large number of transactions should have audit logging disabled and only syslog should be used for capturing audit logs. This significantly reduces cluster wide traffic and disk usage. This is a cluster wide setting and needs to be set on only one node in the cluster. Use the ksctl properties command to disable audit logging.

To disable local audit logging

Set the property ENABLE_RECORDS_DB_STORE to false using the ksctl command:

$ ksctl properties modify -n ENABLE_RECORDS_DB_STORE -p false

If configured, Audit logs will be still be sent to a syslog server.

Protect the ksadmin Private SSH Key

The private SSH key for the ksadmin account is critical to system security and must be carefully protected. Failure to do so could allow an attacker to compromise the system.

TLS/SSL Must be Enabled in a Production System

As it may be useful for troubleshooting, it is possible to disable TLS/SSL for the NAE interface. This will lead to an insecure system. Therefore, TLS/SSL should always be enabled for a production system.

Key Usage Mask Selection

If you want to perform any operation (for example, Wrap/Unwrap) from the NAE/KMIP connector, set the usage mask explicitly for that operation while creating keys through UI.

DDC

Upgrading DDC

After you upgrade to version 2.11 you will not be able to downgrade it to any of the previous versions.

Clusters

• Only one CipherTrust Manager node in the cluster can have DDC activated. To access DDC, create a new DNS entry to point to the active CipherTrust Manager node.

• DDC functionality cannot be accessed through the CipherTrust Manager FQDN. DDC requests sent to an inactive CipherTrust Manager node fail (and return the impression that DDC fails randomly).

Licensing

Overlapping licenses are not supported (except for the trial license).

EOS for Legacy Reports

The support for Legacy Reports has been dropped in DDC 2.11.

EOS for KCT Datastore

End of Support for KCT Datastore Format in DDC 2.11.

Upcoming End of Support for Platforms and Features

• Linux 2.4 Node Agents

• Email Targets - Microsoft Exchange (EWS)

• Microsoft 365 - Exchange Online (EWS)

• Web Browser - Internet Explorer

Compatibility

This section documents known compatibility topics to be considered before deploying the CipherTrust Manager.

TLS Compatibility

This table identifies the supported TLS versions for each of the CipherTrust Manager as a Service interfaces. The default minimum value reflects the default minimum_tls_version setting. This setting controls the lowest acceptable TLS version allowed for connections to the interface.

TLS 1.0 and TLS 1.1 support will be discontinued in a future release.

By default, CipherTrust Manager as a Service accepts the following ciphersuites for TLS 1.2+ connections:

• TLS_AES_256_GCM_SHA384 (TLSv1.3)

• TLS_CHACHA20_POLY1305_SHA256 (TLSv1.3)

• TLS_AES_128_GCM_SHA256 (TLSv1.3)

• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS Deprecation Notices

• Use of TLS 1.0 and 1.1 protocols is deprecated. This support will be discontinued in a future release. Upgrade all applications connecting to CipherTrust Manager as a Service interfaces to TLS 1.2 or higher as soon as feasible.

• Use of the following CBC-based ciphersuites is deprecated, and support will be discontinued in a future release:

  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

  • TLS_RSA_WITH_AES_256_CBC_SHA

  • TLS_RSA_WITH_AES_128_CBC_SHA

Client Platforms

The following client Platforms are supported by the CipherTrust Manager.

Older versions of most client platforms (versions earlier than the minimum versions listed below) may have incompatible TLS clients. We recommend testing older versions of client platforms in a non-production environment to ensure proper functionality.

For the purpose of transitioning from SafeNet KeySecure Classic, you can temporarily connect to CipherTrust Manager with TLS/SSL disabled on the CipherTrust Manager NAE interface; however, this is recommended only in a non-production environment.

CipherTrust Application Data Protection

• ProtectApp JCE: minimum version 8.6.1

• ProtectApp .NET: minimum version 8.11.0

• ProtectApp ICAPI: minimum version 8.10.0

• ProtectApp Oracle TDE: minimum version 8.9.0

• ProtectApp SQL EKM: minimum version 8.3.2

CipherTrust Cloud Key Manager

Minimum version 1.6.3.20532

CipherTrust Database Protection

• ProtectDB Oracle: minimum version 8.8.0

• ProtectDB SQL: minimum version 8.9.0

• ProtectDB DB2: minimum version 8.7.0

• Transformation Utility: minimum version 8.4.3

CipherTrust Transparent Encryption

Minimum version 7.0.0

CipherTrust Transparent Encryption UserSpace

Minimum version 10.0

CipherTrust Vaulted Tokenization

• Tokenization Manager: minimum version 8.7.1

• Vaultless Tokenization Manager: minimum version 8.8.0

CipherTrust Batch Data Transformation

Minimum version 2.2.0.2816

CipherTrust Vaultless Tokenization

Minimum version 2.5.2.19

CipherTrust Teradata Protection

Minimum version 6.4.0.12

ProtectFile

Minimum version:

• ProtectFile Windows 8.12.3

• ProtectFile Linux 8.12.3, 8.12.4p02 (for migration to CTE)

The latest three GA versions of ProtectFile are tested with CipherTrust Manager as a Service. Older versions are expected to work, but they are not tested explicitly.

Data Discovery and Classification Agents

Linux minimum kernel version is 2.6.

There are no changes in Agent requirements if you are upgrading from CM 2.4 to 2.5.1. If you are upgrading from a version older than 2.4 please refer to Upgrading Agents.

ODBC driver for Microsoft SQL: To connect to Microsoft SQL, DDC Agent requires the ODBC drivers to be installed on the host. If DDC cannot find a suitable agent, make sure that these drivers are installed. If necessary, upgrade them to the latest available version. Thus, if your MSSQL Server is configured with TLS 1.2 only, install the ODBC Driver 17 for MSSQL Server.

TDP Version Compatibility

Data Discovery and Classification requires TDP 3.1.5.1 or newer.

• If you have an existing TDP 3.1.5 cluster, you should apply the patch 3.1.5.1.

  Following the TDP upgrade users are required to Configure TDP service HDFS again and also Configure TDP service Livy.

Known Issues

This section lists the issues known to exist in the product at the time of release.

CipherTrust Manager

CipherTrust Application Data Protection (CADP for C)

CipherTrust Cloud Key Manager

CipherTrust Database Protection

Application Data Protection

CipherTrust Data Discovery and Classification

CipherTrust Transparent Encryption

ProtectApp

ProtectFile