As part of our continuing support for existing SAM customers , we would like to announce the availability of SafeNet Authentication Manager (SAM) 9.0 (SP2).

This version resolves known issues and features the following:

• Security  enhancements: Various optimizations implemented to improve security
• Refreshed UX/UI: Enhanced look and feel of SAM Manage, SAM Service and SAM Rescue portals to provide better user experience

This new release is now available for download from the Gemalto Support Portal KB0017712

The upgrade installer is also available for download from the Gemalto Support Portal KB0017713

This is a maintenance release with some critical fixes and minor security feature improvements for both Android and iOS.

– Enhanced security on iOS: The iOS version is now obfuscated, to protect the most sensitive functions from reverse engineering. This is done using Gemalto’s proprietary obfuscation tool, Zcrambler.

– Greater assurance with external tests:
o The iOS version has passed a third-party crowd test, where it was tested on 100 iOS devices covering iOS versions 9-11, with no issues found.
o The Android version has passed penetration testing by security experts MWR (now part of F-Secure). It resisted 20 days of intensive investigation from hackers with full access to the physical device, who were unable to uncover the seed. The report confirms that “Protections applied are of a high standard and are in line with industry best practices.”

– Greater efficiency and enhanced security on both Android and iOS: Thanks to the support of custom http headers in Out-of-Band request APIs, banks using Gemalto Mobile Secure Messenger can now identify the kind of message they are receiving, enabling better network traffic flow and also enhanced monitoring and security by detecting suspicious amounts of specific kinds of messages.

This version also includes critical fixes such as:
• Android: Fixed an issue to enable testing for integrators (FaceID NT wrapper Debug version activation)
• Android: Ensure proper root status detection (even when some native library is removed or replaced)
• iOS: Provide greater stability during retry on FaceID enrollment.
• iOS: Detect incorrect seed lengths during dual-seed provisioning, and report an error.

Customer release notes for SafeNet ProtectFile v8.9 for Windows and Linux are now available for download. These releases include the following enhancements:

SafeNet ProtectFile Windows v8.9

• Improved Communication with SafeNet KeySecure: File server configuration and logs
• Ability to Check Access Status of Encrypted Paths
• Database IO Optimization

Download Customer Release Notes and other information.*

SafeNet ProtectFile Linux v8.9

• Improved Communication with SafeNet KeySecure: File server configuration and logs
• Netlink Improvements
• Ability to Check Access Status of Encrypted Paths

Download Customer Release Notes and other information.*

Please review the Advisory Notes and the Resolved and Known Issues sections of the release notes for any limitations and/or restrictions.

*Note: Registered users may access the documents via the Gemalto Support Portal. Should you need assistance logging in, please contact the SafeNet Support team at 800-545-6608 (US customers) or +1 410-931-7520 (International customers).

This release is a maintenance release with some bug fixes for the Mac version, enabling more flexibility and security on Mac computers.

• More flexibility: Web Signer 1.2.1 can now be used smoothly on both Mac and Windows. A limit that previously existed on Mac computers has now been removed.

• Enhanced security: Web Signer 1.2.1 is now more accurate in its detection of potentially malicious software by supporting the high-resolution Retina display in the SWYS function. This enables users to make sure that there is no malicious overlay in the application before they sign a transaction – meaning that what they see is really what they sign.

Feel free to contact your support team or Account Manager if you have any questions.

This new version of Gemalto Mobile Secure Messenger brings the following improvements:

• Enhanced security: This new version can reject registration requests coming from potentially malicious devices. It does this by offering a mechanism to reject requests coming from devices that have not created a valid session before making the registration request. This requires collaboration with an intermediate network entity (typically a web application firewall) that can then instruct the application, through proprietary http headers, to reject registration if pre-requisites are not fulfilled.
• Wider reach of enhanced communication with iPhones: The previous version of Mobile Secure Messenger enabled enhanced push notifications that support the latest iOS push format, but only for customers who host the server-side part of Mobile Secure Messenger on the Tomcat application server. This benefit is now also available to customers hosting it on the Websphere application server.

You may contact your salesperson if you wish to benefit from the enhancements that come with this release.

This is to announce the upcoming end-of-sale and end-of-support dates for SafeNet ProtectV 1.x, 2.x and 3.x, the industry’s first comprehensive high-availability solution for protecting data across bare metal, virtual and cloud infrastructures.  Customers are encouraged to transition to the latest version of SafeNet ProtectV v.4.5.0 for continued full disk encryption of physical servers, virtual machines, and cloud instances to securely run sensitive workloads.

Table 1 of this announcement describes the end-of-life milestones, definitions, and dates for the affected product(s).

Table 2 lists the product part numbers affected by this announcement (alternative products are listed thereafter).

Table 1 – End-of-Life Milestones:

Table 2 – Affected Products:

The following is a list of SafeNet ProtectV part numbers affected by this announcement: 

Alternative Products

Customers using these products are encouraged to migrate to the latest version of SafeNet ProtectV.  Existing customers with a Technical Support Customer Portal account can log in to view complete migration instructions, get the latest software upgrades, and access the Gemalto Knowledge Base.

For more information, please contact your Gemalto Sales representative.

As part of our ongoing product communications, we are announcing End-of-Sale for the following Mobile PKI products:

• SafeNet Reader CT1100
• SafeNet Reader K1100 
• Bluegiga BLED112-V1 USB-BLE dongle
• Gemalto Bluetooth Device Manager (GBDM)
• SafeNet Core 8030
• SafeNet Prime 8840
• IDGo 800 Mobile
• SafeNet MobilePKI for BlackBerry (ex SafeNet MobilePKI for Good)

 Mobile PKI Products – End-of-Sale Key Dates

For replacement products and additional details please refer to the End-of-Sale announcement

ProtectServer 2 firmware version 5.01.02 has completed NIST FIPS 140-2 Level 3 certification.

The certificate can be viewed at the following NIST website URL: https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3231

This new version of Enrollment & Provisioning Server (EPS) brings the following improvements:

• More choice: Banks can now choose the perfect HSM for their needs, as EPS now supports the following, on top of the HSMs it already supported previously: Thales nShield, SafeNet Luna Network (models 5 & 6), and SafeNet Cryptovisor/DPoD.

• Enhanced security:

o The new version of EPS no longer uses PANs/PSNs in CAP token IDs, thereby avoiding unnecessary disclosure of this sensitive information in APIs and logs.

o Token metadata in the database is now encrypted for better protection.

• Better monitoring:

o This version includes new APIs to monitor the server status, enabling banks to get better information of potential issues once the server is live.

o Banks can now easily build reports and get statistics – such as the number of tokens provisioned. – thanks to new structured logs showing all operations processed by the server.

• More flexibility: Do two banks use the same virtual PAN? Does one bank need two domains for the same customer, so that, for example, the help desk can log in as the customer, but with a different key? The technical difficulties that these situations posed previously (for banks using the CAP algorithm) have now vanished, as this new version of EPS allows the same PAN/PSN to be used in multiple domains.

Feel free to contact your support team or account manager to find out more.

We are excited to announce that as of June 25, 2018, the SafeNet Luna K7 Cryptographic Module used in SafeNet Luna PCIe and SafeNet Luna Network HSMs is now FIPS 140-2 Level 3 validated (NIST Certificate #3205). Both the A Series (Password) and S Series (PED) are validated to FIPS 140-2 Level 3.

It is recommended that customers upgrade to software version 7.2 and run the latest FIPS-validated firmware 7.0.3:

• SafeNet Luna Network HSM 7 – download SafeNet Luna HSM 7.2 software with the 7.0.3 firmware bundled with it (DOW0002875 (KB0017493))
• SafeNet Luna PCIe HSM 7 – download the 7.0.3 firmware via DOW0002872 (KB0017490)

About FIPS / NIST
FIPS 140-2 is the benchmark industry leading security certification and demonstrates compliance to an established set of security requirements for cryptographic modules defined by National Institute of Standards and Technology (NIST).

The certification involves both functional testing alongside structured code review by a nationally accredited laboratory to confirm the product complies to the claimed level of security.  As an output of this process a detailed report is generated which is further reviewed and scrutinized by a panel of government experts at either NIST or CSE ahead of certificate award.

Additional Information

• NIST Certificate #3205 can be found on the NIST website
• Firmware version 7.0.3 is now listed as the recommended version moving forward for SafeNet Luna HSM 7 customers
• F5 customers (only) wanting to run FIPS-validated firmware must run 7.0.2 on SafeNet Luna HSM 7.1
• Features and benefits for SafeNet Luna HSM 7.2 f/w, released May 18, 2018 are available on the Gemalto Tech Blog

Should you have any questions please contact your Gemalto Sales representative.

Gemalto is pleased to announce the official release of SafeNet Virtual KeySecure k170v version 1.4, which includes support for SafeNet ProtectFile.

New Features and Enhancements:

SafeNet Virtual KeySecure k170 version 1.4 extends support for encryption of local file system using SafeNet ProtectFile 8.7.10.

For a full list of other administrative improvements in this release, please see the customer release notes, available on the Gemalto Customer Support Portal (Document Part Number: 007-000162-001).

For more information on SafeNet Virtual KeySecure, k170v please contact your Gemalto Sales Representative, or visit the Product Page or the Product Brief.

Effective as of October 2, 2018, Gemalto will discontinue selling iKey 1000/1032 to customers and it will no longer be available for purchase, for more details please refer to the End-of-Sale announcement.

We are pleased to announce that the SafeNet MobilePASS+ App for Windows v. 1.2 is now available.

This release brings the following features:

• User interface streamlined to match with iOS and Android: For improved user experience
• Enrolment screens enhancements : For improved user experience
• Multi-Language support: French, Japanese and Spanish are now supported
• Security  enhancements: Various optimizations implemented to improve security

SafeNet MobilePASS+ for Windows v 1.2 can be downloaded from Microsoft’s App Store.

Customer release notes for SafeNet ProtectFile v8.7.10 for Windows and Linux are now available for download. These releases include the following enhancements:

SafeNet ProtectFile Windows v8.7.10

• Migration, key rotation (shallow and deep), and decryption using AES-256 keys
• Enhanced KeySecure failover
• Syslog server
• Volume mount points
• Bootstrap CLI utility
• User, group, and process-based access policies

This release supports the following access types: Read, Write, ReadWrite, ReadCipher, ReadWriteCipher, and NoAccess.

Download Customer Release Notes and other information.*

SafeNet ProtectFile Linux v8.7.10

• Migration, key rotation (shallow and deep), and decryption using AES-256 keys
• Enhanced KeySecure failover
• Syslog server
• Volume mount points
• Bootstrap CLI utility
• User, group, and process-based access policies

This release supports the following access types: Read, Write, ReadWrite, ReadCipher, ReadWriteCipher, and NoAccess.

Download Customer Release Notes and other information.*

Please review the Advisory Notes and the Resolved and Known Issues sections of the release notes for any limitations and/or restrictions.

*Note: Registered users may access the documents via the Gemalto Support Portal. Should you need assistance logging in, please contact the SafeNet Support team at 800-545-6608 (US customers) or +1 410-931-7520 (International customers).

We are pleased to announce the release of a brand new token, SafeNet eToken 5300, as well as updated releases for SafeNet Authentication Client and SafeNet Minidriver.

New: SafeNet eToken 5300

SafeNet eToken 5300 is a compact, tamper-evident USB token, which offers a third factor

of authentication with touch-based presence detection.

This new token offers the following features:

• Next generation USB token with cutting edge design
• Presence detection functionality to provide additional layer of security
• FIPS 140-2 certification in process, with approval expected within the next few months
• Micro and Mini form factors

Note: SafeNet eToken 5300 is not a replacement for SafeNet eToken 5110, which is still released and available for orders, with no EOS plans for the next few years.

Updated: SafeNet Authentication Client 10.6 for Windows

This new release offers the following features:

• Support for SafeNet IDPrime 940/3940 (to be released in Q4)
• Support for Classic Client V3 card in read only mode.
• Integration of SafeNet 10.2 Minidriver for performance and security enhancements
• IDPrime MD Read Only certificates mode to avoid certificate deletion from connected devices

SafeNet Authentication Client 10.6 Windows is now available for download from the Gemalto Support Portal KB0017845

Updated: SafeNet Minidriver 10.2

 This new release offers the following features:

• Security enhancements and updates
• New Minidriver engine based on SafeNet Authentication Client’s engine
• Support for SafeNet IDPrime 940/3940 (to be released in Q4)
• Support for SafeNet eToken 5300

 SafeNet Minidriver 10.2 is now available for download from the Gemalto Support Portal KB0017844

Product Change Notice: SafeNet Crypto Command Center

Versions 2.x, 3.0, 3.1, 3.2 end-of-sale and support

Overview

SafeNet Crypto Command Center continues to evolve, offering the Enterprise an easy to use, centralized solution for managing SafeNet Luna Network Hardware Security Modules (HSMs). In addition to the benefits previously offered such as the reduction of IT infrastructure costs for on-premises, cloud, hybrid cloud and virtual environments, this latest release also offers a variety of advantages including: monitoring, reporting and alerting; and integration with SafeNet Luna Network HSM 7. Crypto agility, flexibility, and the ability to serve many lines of business and applications at once continue to be a focus for this advanced crypto management platform.

As a result of the new product features and improvements available in version 3.3, Gemalto is announcing the end-of-sale and support for SafeNet Crypto Command Center versions 2.0, 2.1, 2.2, 3.0, 3.1 and 3.2 as per the timelines listed in Table 1.  To ease your migration efforts, please refer to Table 2 below.

Table 1: EoL Milestones and Dates

Table 2: Affected Part Numbers and Migration Path

Supporting Documentation and Tools

The following documentation is available to guide you through the migration process from SafeNet Crypto Command Center 2.X, 3.0, 3.1 and 3.2 to version 3.3:

Supported Technologies

SafeNet Crypto Command Center 3.3 supports the following versions of SafeNet Luna Network HSMs:

• x, 7.0, 7.1 and 7.2
• REST API is required

Questions?

Please contact your Gemalto Sales Representative.

We are pleased to inform you that SafeNet Agent for Microsoft Outlook Web Application (OWA) 2.1.0 is now available. 

This is a major new release that offers a completely new user interface, and enables SafeNet Trusted Access policies for OWA, as well as brings support for Push OTP with SAS Cloud.

For SafeNet Trusted Access (STA) customers:

 This is the first agent for STA. It allows customers to manage access to the Microsoft Outlook Web Access application through STA, and in this way, apply the value of the STA policy framework and scenario-based contextual conditions to OWA. For users, it provides the value of extending the STA single sign-on experience to Outlook Web Access.

The agent is intuitively configured from the STA admin console. The installer auto-detects MS Exchange version and the operating system for a streamlined installation experience.

For SafeNet Authentication Service (SAS) Cloud customers:

 This release supports Push OTP, as well as adds support for Windows Server 2016 and IIS 10.
The agent is intuitively configured from the SAS admin console. The installer auto-detects MS Exchange version and the operating system for a streamlined installation experience.

For SafeNet Authentication Service (SAS) PCE/SPE customers:

This release adds support for Windows Server 2016 and IIS 10.
The installer auto-detects MS Exchange version and the operating system for a streamlined installation experience.

SAS customers can download the updated OWA Agent v2.1.0 from the Gemalto Customer Portal KB0017916