Gemalto announces the End-of-Sale and End-of-Support dates for SafeNet Luna HSM 5.x/6.x and SafeNet Luna Java HSM 3.x. The last day to order the affected product(s) is February 28, 2020.

• Table 1 describes the end-of-life milestones, definitions, and dates for the affected products
• Table 2 lists the product part numbers affected by this announcement
• Customers with active and paid service and support contracts: support will be available until the End of Support date shown in Table 1
• Customers with Common Criteria, Brazil ITI and Singapore NITES certification requirements: please read through the Projects with Certification Requirements section to learn how the currently certified variants will remain available

EoS Milestones and Dates – Table 1

Migration Path – SafeNet Luna HSM 5.x / 6.x
Option 1: SafeNet Luna HSM 7

SafeNet Luna HSM 5.x/6.x customers are encouraged to migrate to SafeNet Luna HSM 7. In addition to providing the same security features as SafeNet Luna HSM 5.x/6.x, SafeNet Luna HSM 7 offers:

• Fastest HSM on the market with over 20,000 ECC and 10,000 RSA operations/secon
• Lower latency for improved efficiency
• Common Client (7.2) – supporting multiple appliance versions
• Docker Container support
• Flexible Partition Policies
• Partition Policy Templates
• High quality keys through external Quantum RNG seeding
• Remote PED HSM initialization
• 4 x 1 Gigabit Ethernet ports with Port Bonding
• Enhanced Environmental Failure Protection against temperature, voltage, time, and radiation
• Sliding rails for ease of installation (optional) and Locking Bezels
• FIPS 140-2 Level 3 for both Password and PED-based HSMs
• Common Criteria (CC) EAL4+ (AVA_VAN.5 and ALC_FLR.2) against the Protection Profile (PP) 419221-5 is under     evaluation

Migration Path – SafeNet Luna HSM 5x. / 6.x
Option 2: As a Service Model with SafeNet Data Protection on Demand

SafeNet Data Protection on Demand is a cloud-based platform that provides a wide range of on-demand HSM, key management and encryption services through a simple online marketplace. SafeNet Data Protection on Demand helps enterprises reduce infrastructure costs, easily manage security, and shorten time to market. Just click and deploy the data protection services/tiles you need, provision new tenants, and further services and get usage and audit reporting in minutes.
Highlights:

• Zero upfront investment
• Cloud agnostic
• Up and running in less than 5 minutes
• OpEx only usage-based billing
• SLA On Demand – 99.95% availability
• Automatic failover included
• Key backups are automatic
• Key and crypto operation metrics and reporting
• Elastic, automatic scaling
• Low total cost of ownership

Migration Path – SafeNet Luna Java HSM (3.x)
SafeNet Luna HSM 7 (Network HSM or PCIe HSM) is the recommended migration product for SafeNet Luna Java HSM (Luna SP).

Although it is not a one for one replacement, SafeNet Luna HSM 7 provides Java API support (JCA/JCE and JCprov). Additionally, future Functionality Module (FM) support (early 2019) will also allow secure custom code to be developed and executed within the secure confines of the HSM card. This combination allows for the development of Java applications with highly secure elements operating inside the hardware boundary of a HSM.

Any enterprise Java application code (which would have been run on the Tomcat application server of the Java HSM appliance), would in the future need to be run on a dedicated application server with either a PCIe card built in or an additional SafeNet Luna Network HSM, which perform the Java application related crypto functionality.

Affected Products: Table 2
The SafeNet HSM part numbers affected by this announcement are listed here in Table 2. Please note that not all revisions will be affected in order to satisfy Common Criteria, Brazil ITI and Singapore NITES certification requirements.

Projects with Certification Requirements
Projects that require SafeNet Luna HSMs for specific certifications such as Common Criteria, Brazil ITI, Singapore NITES, etc., not available on newer SafeNet Luna HSM releases will remain active and will be exempt from the published End of Sale/ End of Support timelines. Once the certification of newer SafeNet Luna HSM versions has been completed, a transition plan and timeline will be announced, ensuring sufficient time to plan your migrations.

Should you have a project with specific certification requirements, please contact your Gemalto Sales Representative for additional details.

Additional Information
For any other questions or concerns please contact your Gemalto Representative.

SafeNet Luna PCIe HSM 6 firmware 6.24.7 (standalone or when used in the SafeNet Luna Network appliance) is now FIPS 140-2 Level 2 and Level 3 validated. The certificates are found on the NIST website – certificate #3208 and #3268 respectively. Additional details, including hardware version, may be found in the associated security policy, which is provided as a link at the bottom of the certificate information.

The password authenticated HSM is validated to FIPS Level 2, the PED authenticated HSM is validated to FIPS Level 3.

SafeNet Luna HSM firmware 6.24.7 is available as a separate package for HSM software 6.2.1, 6.2.2 and 6.3. To see the full information on this firmware release read through the Customer Release Notes (CRN) at article-ID: DOW0002849.  The download is available on the Gemalto Customer Support Portal – DOW0002850 and is the recommended version for SafeNet Luna HSM 6 customers moving forward.

Should you have any questions please contact your Gemalto Sales Representative.

Gemalto is pleased to announce that SafeNet KeySecure version 8.10.0 is now available for the following physical appliances:

• SafeNet KeySecure k460 (R320 and R330 chassis)
• SafeNet KeySecure k450 (R320 and R330 chassis)
• SafeNet KeySecure k250

Virtual deployments are also available through SafeNet Virtual KeySecure on AWS and VMware.

Below are new feature enhancements available in the SafeNet KeySecure 8.10.0 release:

• Password Management Settings for Local Users: Added password management settings for local users in the Management Console.
• Support for Password Authentication for KMIP Server: Added password authentication for KMIP server in the Management Console.
• Support for SSL Cert:  Use existing SSL certificates for web admin certificates.
• Support Key Wrap Format for SHA1 Algorithm: SafeNet KeySecure now supports the wrap format PKCS1v2.1/RSAOAEP for SHA1.
• Key Wrapping for Asymmetric Keys: SafeNet KeySecure now supports wrapping of asymmetric keys by using AES-256 keys.
• New Objects: Support added for new objects in naeSoftwareObjects and naeHardwareObjects for SNMP MIB Walk.
• Batching Requests: Support added for batching of multiple data sections for ECIES cryptographic operation requests.
• Strong Key Exchange Algorithm: Support added for Strong Key Exchange algorithm. For more information on Strong Key Exchange algorithms, refer to Chapter 34, “SSL” in the SafeNet KeySecure Appliance Administration Guide available on the Support Portal (Document Number: 007-012568-002)

Support Announcement:

SafeNet KeySecure no longer supports SSL 3.0 protocol or RC4 Cipher for SSL communications.

For a full list of product enhancements and issues resolved in this release, please refer to the customer release notes available on the Gemalto Customer Support Portal:

• KeySecure 8.10.0 Appliance Customer Release Notes (Document Part Number: 007-000155-001 Rev. A).

This release is compatible with the following SafeNet Data Protection portfolio client platforms and versions:

• ProtectFile-Linux 8.10.0
• ProtectFile-Windows 8.10.0
• ProtectDB SQL Server 8.10.0
• ProtectDB Oracle 8.10.0
• ProtectDB DB2 8.7.0
• ProtectDB Teradata 8.5.0
• ProtectApp-JCE 8.10.0
• ProtectApp-.Net 8.10.0
• ProtectApp-ICAPI 8.10.0
• Tokenization Manager 8.10.0
• SafeNet ProtectV

Older versions of the SafeNet client platforms are also expected to work with SafeNet KeySecure 8.10.0.

For a full list of supported upgrade and migration paths for customers, please read the customer release notes, available on the Gemalto Customer Support Portal.

We are pleased to announce that SafeNet Trusted Access (STA) has been updated with the following features:

 Rename an application: This feature enables customers to change the display name for an application in the user portal and in the STA and SAS consoles

Additional Languages Support: Support for simplified Chinese, Traditional Chinese, and Korean to the language selection in STA Login and User Portal

For additional details, please refer to KB0016061 in the Customer Support Portal.

We are pleased to announce the release of SafeNet ProtectV 4.6.0, which adds support for virtual machines running on Google Cloud Platform and Data Protection On Demand (DPoD) VM Encryption Service (currently in preview mode). Additionally, SafeNet ProtectV 4.6.0 introduces a new in-transit key wrapping feature and online rekey of Windows system partitions.

Below are new feature enhancements available in the ProtectV 4.6.0 release:

• Support for Google Cloud Platform
  SafeNet ProtectV 4.6.0 extends support for ProtectV Manager on Google Cloud Platform.
• Support for RHEL 6.10
  This release extends support for encryption of virtual machines running Red Hat Enterprise Linux 6.10. Refer to the Operating Systems section of the customer release notes for the complete list of supported platforms.
• Support for AWS R4 and M5 Instances
  SafeNet ProtectV 4.6.0 adds support for encryption of Amazon EC2 R4 and M5 instances running Windows platforms.
• Support for SafeNet Virtual KeySecure k170v
  SafeNet ProtectV now supports the next generation SafeNet Virtual KeySecure k170v for managing encryption keys.
• Support for DPoD – VM Encryption Service
  SafeNet ProtectV 4.6.0 extends support for the Gemalto Data Protection on Demand (DPoD) platform. SafeNet ProtectV Manager 4.6.0 will also support the DPoD VM Encryption service scheduled to release in September, 2018. Refer to the Data Protection On Demand documentation for details. 
• Support for Multiple Syslog Servers
  Previous versions of SafeNet ProtectV supported one Syslog server only. Now you can configure multiple Syslog servers with ProtectV Managers. You need to configure different Syslog servers individually. This release also provides the ability to disable configuration of a particular Syslog server. The pvmctl status command is also improved in this release. It now shows IP addresses of all the configured Syslog servers.
• In-transit Key Wrapping
  SafeNet ProtectV 4.6.0 supports encryption of keys while they are moving among SafeNet KeySecure, ProtectV Manager, and ProtectV clients. This is referred to as in-transit key wrapping. Enable in-transit key wrapping to protect key encryption keys (“KEKs”) against TLS attacks. The KEK is wrapped with a public key by SafeNet KeySecure. This feature is disabled by default. As a ProtectV administrator, you can enable the feature.
• Ability to Set Time Zone
  A new command, pvmctl settimezone, is included in this release. Run this command to configure time zone on your ProtectV Manager instances. Refer to the SafeNet ProtectV User’s Guide for description of features.
• Audit Logging Improvements
  SafeNet ProtectV 4.6.0 contains improved audit logging. Audit Logs now display the logs of the following activities:

• Logging activities (local and LDAP users)
• Creating tokens
• Deleting tokens
• Deleting virtual machines
• Turning off/on encryption for a partition
• Modifying LDAP connection
• Adding or deleting users
• Creating additional administrators

Additionally, the “Time (UTC)” column is renamed as “Time” on the Audit Logs tab of the ProtectV Manager Console. Also, audit logs now reflect the time zone set on ProtectV Manager.

• Rekey Support for Windows System Partitions
  SafeNet ProtectV 4.6.0 adds support for rekey of Windows system partitions, for example, C:\ drive.

For download and customer release notes, please visit our Gemalto Customer Support Portal.

Effective as of December 31, 2018, Gemalto will discontinue selling the following products to customers and they will no longer be available for purchase:

• SafeNet Reader CT1100
• SafeNet Reader K1100
• Bluegiga BLED112-V1 USB-BLE dongle
• Gemalto Bluetooth Device Manager (GBDM)
• SafeNet Core 8030
• SafeNet Prime 8840
• IDGo 800 Mobile
• SafeNet MobilePKI for BlackBerry (ex SafeNet MobilePKI for Good)

For details please refer to the End-of-Sale announcement of the MobilePKI products mentioned above.

• IDClassic GCMemo 
• IDPrime MD 3810 Mifare 1K  
• IDProve 100

For details please refer to the IDPrime MD 3810 Mifare 1K – End-of-Sale announcement, IDClassic GCMemo – End-of-Sale announcement and IDProve 100  – End-of-Sale announcement.
 

Customer release notes for SafeNet ProtectFile v8.10 for Windows and Linux are now available for download. These releases include the following enhancements:

SafeNet ProtectFile Windows v8.10

• Enhanced Offline Mode Security. Now the offline storage password must:
• Be at least 10 characters in length.
• Contain both uppercase (A through Z) and lowercase (a through z) alphabetic characters.
• Have at least one numeric (0 through 9) character.
• Have at least one special character (! @ # $ % ^ & * ( ) _ – + = , . / < > ? ; ‘ : \” [ ] \\ { } | ~ `).
• Not contain spaces or tabs.
• Deprecated Support for Log Upload to the SafeNet KeySecure. Client logs can no longer be uploaded to SafeNet KeySecure. However, client logs can be redirected to a dedicated Syslog server or rotated on the file server.

Download Customer Release Notes and other information.*

SafeNet ProtectFile Linux v8.10

• Support for Oracle Cluster File System 2 (OCFS2) on SUSE Linux Enterprise Server 11 SP4 only.
• Dynamic Mounting Support for Exported SAN Disks
• Restricted Substitute User Access
• Enhanced Offline Mode Security. Now the offline storage password must:
• Be at least 10 characters in length.
• Contain both uppercase (A through Z) and lowercase (a through z) alphabetic characters.
• Have at least one numeric (0 through 9) character.
• Have at least one special character (! @ # $ % ^ & * ( ) _ – + = , . / < > ? ; ‘ : \” [ ] \\ { } | ~ `).
• Not contain spaces or tabs.
• Support for RHEL 6.10 on kernel 2.6.32-754.el6.x86_64.
• Improved Installation: if the upgraded kernel and the supported SafeNet ProtectFile kernel differ only in extraversion, then by default, the SafeNet ProtectFile installer returns a driver error.
• Support for Encryption of GPT Partitions (Alpha)
• Deprecated Support for Log Upload to the SafeNet KeySecure. Client logs can no longer be uploaded to SafeNet KeySecure. However, client logs can be redirected to a dedicated Syslog server or rotated on the file server.

Download Customer Release Notes and other information.*

Please review the Advisory Notes and the Resolved and Known Issues sections of the release notes for any limitations and/or restrictions.

*Note: Registered users may access the documents via the Gemalto Support Portal. Should you need assistance logging in, please contact the SafeNet Support team at 800-545-6608 (US customers) or +1 410-931-7520 (International customers).

SafeNet Luna USB and Backup HSMs as well as the SafeNet Luna Remote PED are now supported on Windows 10, addressing a Microsoft driver signing change in Windows 10 version 1607.  

Visit KB0017838 / DOW0003077 on the Gemalto Support Portal for more information and to download SafeNet Luna Client 7.2.1.   

We are pleased to announce that SafeNet MobilePASS+ for iOS  1.6.1  and SafeNet MobilePASS+ App for Windows 1.3.2  are now available.

These releases resolve known issues and bring the following features:

 SafeNet MobilePASS+ for iOS 1.6.1

• iOS 12 support

SafeNet MobilePASS+ for iOS v1.6.1  can now be downloaded from iTunes

SafeNet MobilePASS+ App for Windows  1.3.2 

• Accessibility support for keyboard interactions and narrator
• Virtual box and VMWare  Horizon client support
• UX improvements for enhanced user experience

 SafeNet MobilePASS+ App for Windows v. 1.3.2 can be downloaded from Windows Store

As part of our continuing support for existing SAM customers, we would like to announce the availability of SafeNet Authentication Manager (SAM) 9.0 (SP3).

This version resolves known issues and features security enhancements

The upgrade installer can be downloaded from the Gemalto Support Portal KB0018123.

We are pleased to announce that SafeNet Authentication Service (SAS) and SafeNet Trusted Access (STA) now support Google Authenticator. With the release of this feature, users can leverage Google Authenticator or other apps compatible with the Google Authenticator format to log into resources protected by SAS and STA.

Note: Support for Google Authenticator is currently available in SAS Cloud and STA in the EU zone and will become available soon in the Classic zone and in SAS PCE/SPE.

SafeNet Authentication Service PCE/SPE 3.8.1 is now available for download from the Gemalto Service Portal KB0018114

This  release brings the following features:

• Enhanced Security for SAS Authentication Agents
• MobilePASS+ Desktop Support for Windows 10

Gemalto is pleased to announce the release of version 2.3.0 of the Luna EFT Payment HSM.

This release of Luna EFT Payment HSM introduces key features expanding the software’s capabilities in terms of flexibility, logging and monitoring and addition of new payment standards. This includes:

• AES DUKPT – This release adds AES DUKPT according to ANSI X9.24-3 (2017). A new key specifier “Format 26” is introduced to support the AES key based DUKPT scheme.
• Remote System Logging via syslog – This release allows to send error logs from Luna EFT Payment HSM to configured remote syslog servers. A new web page for remote syslog server configuration is introduced in the Luna EFT Administration Console.
• Audit Logs Auto Archiving – This release introduces a new LunaSH command to support auto archiving of EFT audit logs, allowing for more automated audit log retrieval.
• Backup and Restore of HSM Configuration – This release adds functionality to secure backup/restore of HSM configurations via the web console.
• VFPE Program Enhancement – This release adds a new host function EA000D (FPE-CRYPTO-SET) to support data translation, encryption and decryption for VFPE Program.
• RSA Performance Improvements – This release provides RSA performance improvements for various OBM functions.
• Updated Host Functions – This release provides updates to various host functions concerning operation in PCI mode and key specifier extensions
  – EMV-PIN-CHANGE-UNBLOCK-MULTI (EE2021)
  – DECIPHER-4 (EE0807)
  – MAC-GEN-UPDATE-AES (EE0712)
  – MAC-GEN-FINAL-AES (EE0713)
  –  MAC-VER-FINAL-AES (EE0714)

Please go to the SafeNet Support Portal* to download the EFT 2.3.0 Software Release and the Customer Release Notes (use Document Number: KB0018136).

*Log in required.  Contact CustomerPortalSupport@Gemalto.com for assistance.

We are pleased to announce that SafeNet Trusted Access (STA) now supports PKI credentials, enabling organizations to enforce the use of certificate-based authentication when defined in a STA access policy.

Feature Benefits

• Allows organizations with existing PKI implementations to move to the cloud securely by building on their current PKI authentication framework for cloud access
• Offers users the convenience of single sign on (SSO)

For additional details, please refer to KB0016061  and KB0017763 in the Customer Support Portal.

We are pleased to announce that SafeNet MobilePASS+ SDK for Windows v1.2.1 is now available.

This release brings the following features:

• Accessibility support for keyboard interactions and narrator
• Virtual box and VMWare Horizon client support
• UX improvements for enhanced user experience
• Security enhancements

 SafeNet MobilePASS+ SDK for Windows v1.2.1 delivery package can be downloaded from the Gemalto Customer Portal KB0018159

We are pleased to inform you that SafeNet Authentication Service Agent for Windows Logon (WLA) 2.2.8 is now available. 

This new release brings security improvements.

Installation and configuration instructions, along with the agent itself, can be downloaded from the Gemalto Customer Portal KB0018143

Gemalto is pleased to announce the official release of SafeNet Virtual KeySecure k170v version 1.5

New in this release:

SafeNet Data Protection On Demand Support: Integration with the HSM On Demand services from SafeNet Data Protection on Demand provides customers with the flexibility of an HSM service in the cloud as a root of trust without the need to host hardware and impact capital outlay.

Support Opaque Objects via REST Interface: The k170v will now allow access to store remote objects via the REST Interface. Opaque objects can be used to support crypto graphic objects (such as PGP keys, passwords, etc.) as well as other sensitive data.

ARIA SEED Support: The k170v now supports the utilization of ARIA and SEED algorithms for the APAC marketplace.

SafeNet Encryption Connector Testing: Continued progress has been made to tighten the integration with the SafeNet Data Protection portfolio, including ProtectFile v8.9.10: CIFS & NFS share encryption and support up to 10,000 file servers with the k170v.

Improved KMIP Support: Enables customers to integrate with existing SafeNet KeySecure Ecosystem Partners such as VMware, vSAN, and will expand to others in the coming months.

Migration Preview for existing SafeNet KeySecure Customers: This latest release allows existing SafeNet KeySecure customers the ability to:

• Take an existing backup and restore it on a k170v virtual appliance
• Install k170 firmware on an existing k450 or k460 physical appliance
• The k170v firmware can now support the HSM firmware on the k460 appliance as a root of trust

Note: There is currently not a full migration path for existing customers, this is meant to be operated in non-production environments for current customers to test existing use cases with the SafeNet Virtual KeySecure k170v, the SafeNet Data Protection portfolio and our partner ecosystem before an official EOL announcement is made.

For a full list of other administrative improvements in this release, please see the customer release notes, available on the Gemalto Customer Support Portal (Document Part Number: 007-000249-001).

SafeNet Luna HSM software 7.3 is a field update release for SafeNet Luna Network and PCIe HSM 7.  This release includes Client software with drivers and tools, an appliance software update, and firmware update for the HSM. New features and enhancements include:

• Appliance Re-image: ‘re-manufacture’ or re-baseline your HSMs instead of having to raise an RMA request
• Support for BIP32 Algorithm:enables support for popular cryptocurrency and Blockchain applications requiring support for Hierarchical Deterministic Wallets
• Partition Utilization Metrics: visibility into the load individual applications are putting on HSMs (monitored on a per partition basis)

Available Documentation:

Please contact your Gemalto Representative for additional information.

 We would like to announce the release of SafeNet Authentication Client (SAC) 10.6 for Windows (Post GA) and SafeNet Minidriver 10.2 (Post GA).

Both versions resolve known issues.

SafeNet Authentication Client (SAC) 10.6 for Windows (Post GA) is now available for download from the Gemalto Support Portal KB0018213.

SafeNet Minidriver 10.2 (Post GA) is now available for download from the Gemalto Support Portal KB0018214 .

Note: IDGo 800 is EOS since June 2018 and SAC Minidriver now replaces the IDGo 800 on the MS website.

See SAC 10.x and SafeNet MiniDriver 10.2 capabilities in the table below:

We are pleased to inform you that SafeNet Agent for Epic Hyperspace Agent 2.0.0 is now available. 

This is a major new release that brings support for Push OTP to the Epic Hyperspace agent for the first time with SAS Cloud, offers major overhaul in the user experience and enables SafeNet Trusted Access policies for Epic Hyperspace.

Next generation agent:

 For SafeNet Trusted Access (STA) customers:

 This next generation agent allows customers to manage access to Epic Hyperspace application through STA, and in this way, apply the value of the STA policy framework and scenario-based contextual conditions to it.

The agent is intuitively configured from the STA admin console with template-based set-up through the STA application manager including support for Group Policy Object (GPO) based deployment

For SafeNet Authentication Service (SAS) Cloud customers:

 This release supports Push OTP. The agent is intuitively configured from the SAS admin console and gets support for Group Policy Object (GPO) based deployment.

The ability to configure Epic Hyperspace via the new SAS Application Management module is available for customers who are on-boarded to the new EU service zone and to the Classic zone.

Classic agent:

 For SafeNet Authentication Service (SAS) PCE/SPE and SAS Cloud customers:

Epic Hyperspace classic Agent 2.0.0 is available for PCE/SPE and SAS Cloud customers and provides intuitive set-up through the agent management console and through Group Policy Object (GPO) based deployment.

SAS customers can download the updated Epic Hyperspace classic Agent 2.0.0 from the Gemalto Customer Portal KB0018220