Quantcast
Channel: Data Protection Support
Viewing all 550 articles
Browse latest View live
↧

End-of-Sale for SafeNet Ethernet Encryptor CN9100

March 25, 2020, 3:23 pm
$
0
0
Thales is announcing End-of-Sale and Last Time Buy opportunities for the SafeNet Ethernet Encryptor CN9100.

We encourage customers to transition to the Thales CN9120 Network Encryptor (CN9120). These best-in-class high-assurance high speed encryption solutions provide maximum security and performance, and are certified to the highest security standards. Delivering 100,000,000,000 bits per second of high-assurance data encryption, the CN9120 provides mega data security (100 Gbps) and high speed network performance with ultra-low latency (<2 μS).

Thales High Speed Encryptors (HSE) ensure the most secure data-in-motion protection, maximum performance, near-zero overhead with “set and forget” management, and lowest total cost of ownership.

Transforming the network encryption market, Thales High Speed Encryptors (HSE) are the first to offer  Transport Independent Mode (TIM) operation,  TIM delivers network independent encryption and the ability to encrypt traffic flows at Layers 2, 3 and 4 simultaneously across any kind of network infrastructure.

Limited quantities remain; products are available on a first-come, first-served basis.

Maintenance will be available for renewal through December 31, 2021.

Encryptor for End-of-Sale

SafeNet Ethernet Encryptor CN9100

The following are key dates in the End-of-Sale process:

  • End-of-Sale Date:  12/31/2020
  • Start of Good Faith Support: 12/31/2021
  • End-of-Life/End-of-Support: 12/31/2023

The HSE part number affected by this announcement, includes, but is not limited to:

  • End-of-Sale Part Number – Ethernet Encryptor,100 GBPS,DUAL AC,CN9100
Alternative Products
Customers using these products are encouraged to migrate to the Thales CN9120 Network Encryptor, or one of our other market leading high speed encryptors.
   Alternative Product Description Part Number
   Ethernet Encryptor,100 GBPS, DUAL AC,CN9120 943-000305-001-000
Thales High Speed Encryptors are the first choice for network encryption.  They are field proven to secure data in transit including time-sensitive voice and video streams, as well as metadata for enterprise and government organizations, defense agencies, global financial transactions networks, and the world’s biggest cloud services providers.  Thales data in motion encryptors help companies encrypt an even broader range of network traffic across more location types – from the data center to branch offices at speeds up to 100 Gbps.

For more information on features and migration procedures, please contact your local sales representative or see the Support Portal.

 

↧
Search

End-of-Sale for SafeNet Fibre Channel Encryptor CN6040

March 25, 2020, 5:21 pm
$
0
0
Thales is announcing End-of-Sale and Last Time Buy opportunities for the  SafeNet Fibre Channel Encryptor CN6040

We encourage customers to contact support for replacement advice, to find out more about the robust Thales portfolio of best-in-class high-assurance network encryption solutions providing maximum data in motion security and performance, and certified to the highest security standards. Thales High Speed Encryptors (HSE) ensure the most secure data-in-motion protection, maximum performance, near-zero overhead with “set and forget” management, and lowest total cost of ownership.

Limited quantities remain; products are available on a first-come, first-served basis.

Maintenance will be available for renewal through December 31, 2021.

Fibre Platforms for End-of-Sale

SafeNet Fibre Channel Encryptor CN6040

The following are key dates in the End-of-Sale process:

End-of-Sale Date:  12/31/2020
Start of Good Faith Support: 12/31/2021
End-of-Life/End-of-Support: 12/31/2023

The following is a list of HSE part numbers affected by this announcement, including, but not limited to:

  • End-of-Sale Part Description:  FIBRE CHANNEL Encryptor,1/2/4GFC,DUAL AC,CN6040
  • End-of-Sale Part Number:  957-000003-001
Alternative Products
Customers using these products are encouraged to migrate to one of our other market leading network encryptors.
Alternative Product Description Part Number
Ethernet Encryptor,1 GBPS, External AC,CN4010 943-000234-001-000
Ethernet Encryptor,1 GBPS, External AC,CN4020 943-000276-001-000
Ethernet Encryptor,1 GBPS, Dual AC,CN6010 943-000228-001-000
Ethernet Encryptor,10 GBPS,DUAL AC,CN6100 943-000071-001-000
Ethernet Encryptor, 40 GBPS, DUAL AC, CN6140 943-000124-001-000
Ethernet Encryptor,100 GBPS, DUAL AC,CN9120 943-000305-001-000
SafeNet Virtual Encryptor,CV1000, DPDK, Perpetual 943-000114-001-001

Thales High Speed Encryptors are the first choice for network encryption.   They are field proven to secure data in transit including time-sensitive voice and video streams, as well as metadata for enterprise and government organizations, defense agencies, global financial transactions networks, and the world’s biggest cloud services providers. Thales data in motion encryptors help companies encrypt an even broader range of network traffic across more location types – from the data center to branch offices at speeds up to 100 Gbps.

For more information on features and migration procedures, please contact your local sales representative.

Go to the Support Portal
↧
↧

SafeNet Authentication Client (SAC) 10.8 for Windows and SafeNet Minidriver 10.8 – Release Announcement

March 31, 2020, 2:47 am
$
0
0

We would like to announce the releases of SafeNet Authentication Client (SAC) 10.8 for Windows and SafeNet Minidriver 10.8.

Both versions fix known issues and offer the following features:

SafeNet Authentication Client (SAC) 10.8 for Windows

  •  Support for SafeNet IDPrime 930/3930 (to be released in the coming months)
  • Support for a Customized Secure Messaging Key on IDPrime MD 830-FIPS Rev B L3 devices

SafeNet Minidriver 10.8 

  •  Support for SafeNet IDPrime 930/3930 (to be released in the coming months)

SAC 10.8 for Windows and SafeNet Minidriver 10.8 new versions can be downloaded from the Customer Support Portal as follow:

SAC 10.8 for Windows – KB0021505

SafeNet Minidriver 10.8 – KB0021507

 

 

↧

Using DPoD to Bring Your Own Key for AWS KMS

March 31, 2020, 4:26 am
$
0
0

This blog post outlines the procedure to use the DPoD HSM on Demand service to carry out bring your own key for AWS.

Overview

The process comprises of the following operations

  • Generate an external key in AWS
    • Create a key
    • Import token: ensures the import has to be done in a limited period of time before token expiration
    • Wrapping key: key used to wrap the key to be transferred
  • Convert the wrapping key certificate from DER format to PEM format
  • Create a AES key, and wrap using AWS wrapping key
    • Import wrapping key with the cmu tool
    • Change wrapping key attribute to enable wrap+encrypt operations with the cmu tool
    • Generate an AES key
    • Wrap the newly created AES key with the wrapping key from AWS
  • In AWS interface, import the wrapped key file and the token

Pre-requisites

An AWS with Key Management System must be activated
A HSM partition or a DPOD partition must be initialized and configured. FIPS mode may be enabled or disabled.

Step 1 – Generate an External Key in AWS

In Amazon KMS, go to Customer managed keys and create a key:

In step 1, select symmetric key and external in advanced options:

In steps 2,3 and 4 enter labels of your choosing and select key usage permissions, in particular, GrantIsForAWSResource:

Next select the RSAES_OAEP_SHA_256 Wrapping algorithm and download the wrapping key:

Save the wrapping key to your computer and then click next in the AWS dialog to show the following screen:

Leave this dialog open while we carry on with our next steps. We will return to this dialog in Step 3.

 

Step 2 – Import the wrapping key into the DPoD HSM-on-Demand Service

Start with extracting the ImportParameters.zip file that we downloaded in the previous step:

The uploaded wrapping key must be converted in PEM format to be uploaded onto the HSM partition. This can be accomplished using OpenSSL:

openssl rsa -in wrappingKey_90efd932-24d5-47aa-8d69-8271a9d03ae1_03041220 -inform DER -out pub_key.pem -outform PEM -pubin -pubout

Next import the AWS wrap key onto an HSM partition and set the encrypt and wrapping attributes.
Use the cmu tool supplied with the DPoD client:

cmu import -inputfile=pub_key.pem -pubkey=pubkey.pem -label "AWS wrap public key"
cmu list (get the handle ID)
cmu setattribute -handle=260348101 -wrap=true -encrypt=true

Next we will create the key that we will be taking to AWS inside the DPoD Cloud HSM. To accomplish this we will use the ckdemo application that is provided by the DPoD client but any method of generating a HSM key is equally applicable.

  • First launch ckdemo
  • Login to the DPoD partition – input 1,3,1
  • Enter the PIN/password for your Crypto Officer

Now we can generate an AES key

  • Choose option 45 (Generate Simple Key)
  • Option 16 for AES
  • Choose 32 byte key length for AES 256
  • Enter 1 to activate all attributes

Next we will Wrap and export the key

  • Continuing to use ckdemo, enter 98 for Options
  • Now enter 17 – Configure OAEP hash params
  • Then 0 – exit options

  • Next select Option 60 – wrap key
  • Then Option 26 – RSA OAEP
  • Option 3 to use SHA 256
  • 0 – no source data file
  • Option 0 to list objects in the DPoD partition
  • Enter the key handle for the wrapping key
  • Enter the handle for the (AES) key we will be exporting to AWS

This will create a new file named wrapped.key

 

Step 3 – Upload the key to AWS

Now we return back to the AWS dialog we left at the end of step 1.

  • First select “Choose File” for the Wrapped Key Material. Select the wrapped.key file that we created at the end of Step 2.
  • Next select “Choose File” for the Import Token. Select the importToken_ file that we received in the ImportParameters.zip file during Step 1.

Press the “Upload key material” button to import our HSM sourced AES key and you should see the following success screen:


And that completes the process of BYOK from a DPoD Cloud HSM partition to AWS.


Credit: Sebastien Chapellier

↧

Hybrid HSM – Backup and restore on-premise Luna HSMs on DPoD

April 1, 2020, 3:17 am
$
0
0

Extending our hybrid Luna HSM capabilities, we are excited to announce the release of the newest Thales Data Protection on Demand (DPoD) service – Luna HSM Backup. This service is now available on the DPoD Marketplace.
Luna HSM Backup is an HSM on Demand service offering that provides a dedicated backup and restore location for your customers’ on-premises Luna HSMs.
With Luna HSMs, you can securely backup and restore HSM key material. The keys are directly cloned and can flow from on-premises to cloud and cloud to on-premises, providing customers the flexibility to freely move keys and back them up between cloud and on-premises environments in a purpose built-hybrid solution.
Automatic key replication is enabled for backup to Luna Cloud HSM, Luna HSMs on-premises (including Luna Backup HSM) and also for Azure, IBM and AWS dedicated Luna HSMs (PED support expected in Q4 2020). Similarly, customers can choose whether they want to back up their DPoD services to an on-premises solution such as Luna Backup HSM. The solution is ideal for customers who need to maintain control of their keys across multiple compute environments.
When backing up to Luna Cloud HSM Services, you can be assured that the backup is to a resilient Luna Cloud HSM service (99.95% SLA), and your keys are securely stored in NIST FIPS 140-2 Level 3 certified hardware.

If you would like a 30 day free trial of DPoD please click here.

↧
↧

Public Key Confirmation – Meeting CA/Browser Forum Standards with Luna and Luna Cloud HSMs

April 15, 2020, 2:46 am
$
0
0

The CA/Browser Forum’s EV Code Signing Guidelines stipulate that Certificate Authorities must protect private keys in FIPS 140-2 certified cryptographic modules, such as a HSM. In addition, section 16 parts 3a and 4b specify that there must be a mechanism for validating that a private key is indeed protected by a HSM. The process for accomplishing this is typically known as Public Key Confirmation (PKC) and can be accomplished using standard tools provided with both the Luna HSM and the DPoD Luna Cloud HSM.
A Luna (Cloud) HSM will issue confirmations only for private keys that were created by the HSM and that can never exist outside of the HSM. A valid confirmation is cryptographic proof that a specific key is inside the identified HSM. The confirmation is also proof that that the identified HSM is authentic.

A Luna PKC bundle contains the following certificates (in a PKCS#7 certificate chain):

  • MIC: Manufacturing Integrity Certificate; corresponds to the Manufacturing Integrity Private Key (MIK), signed by the Thales Root.
  • HOC: Hardware Origin Certificate; corresponds to the Hardware Origin Private Key (HOK). Unique to each HSM. Signed by the MIK.
  • DAC: Device Authentication Certificate; this corresponds to the Device Authentication Private Key (DAK). Unique to each HSM. Signed by the HOK.
  • PKC: Public Key Confirmation Certificate; certificate for a private key on the HSM. Signed by the DAK.

The standard Luna cmu tool, can be used to create a PKC bundle and in turn verify that an RSA key is protected and has always been protected by a Luna HSM.
Example of a CMU command to fetch the PKC bundle :

cmu getpkc –handle=5 –pkctype=1

Complete syntax can be found at utilities reference guide in the Luna HSM documentation or the Luna Cloud HSM documentation.

If you would like a 30 day free trial of DPoD Luna Cloud HSM, please click here.

↧

End-of-Sale and End-of-Life Announcement: SafeNet KeySecure

April 23, 2020, 11:12 pm
$
0
0
This notification is to alert you that we are beginning the End-of-Life (EOL) process for the following SafeNet KeySecure (Classic KeySecure) appliances.
  • Physical KeySecure K250, K450, K460 appliances
  • Virtual KeySecure V8.X, k150v 8.x, k450v 8.x

Classic KeySecure will reach End-of-Sale effective 30-Jun-2020, and End-of-Life by 31-Dec-2023. Please refer to this External Communication for more details (log in required).

Existing Classic KeySecure customers have several options of migrating from Classic KeySecure to the Next Generation KeySecure platform as described in this External FAQ  (log in required).

Please contact Product Management for questions,Steve Kingston – Market Owner | Neeru Kamra – Product Owner | or Narayan Makaram – Product Marketing.
↧

End of Life/Sale Notification: SAS Cloud SAML Service Providers, SAM PKI Use cases & SNL

April 30, 2020, 2:32 am
$
0
0

As part of our ongoing product update cycle, below are End-of-Life (EOL) and End-of-Sale (EOS) reminders:

SAS Cloud SAML Service Providers

Effective as of July 31, 2020, SAS Cloud SAML Service Providers will be End-of-Life (EOL) and no longer supported.
For details please refer to the End-of-Sale Announcement.

SafeNet Authentication Manager (SAM) PKI Use cases

Effective as of June 30, 2020, we are planning to stop sales of SafeNet Authentication Manager for PKI use cases support.
For details please refer to the End-of-Sale announcement.

SafeNet Network Logon (SNL)

Effective as of July 30, 2020, we are planning to stop sales of SafeNet Network Logon (SNL).
For details please refer to the End-of-Sale Announcement.

↧
Search

SafeNet MobilePASS+ for Windows v1.8.3 – Release Update

May 4, 2020, 4:08 am
$
0
0

We are pleased to announce the release of  SafeNet MobilePASS+ for Windows v1.8.3

This new version brings the following features:

  • Enhanced accessibility support through the popular screen reader JAWS
  • Support for centralized and automated deployment through Active Directory Group Policy
  • Enabling end users to download logs for sharing with their IT department for troubleshooting

SafeNet MobilePASS+ for Windows v1.8.3 can be downloaded from  Windows Store or from Thales Customer Support Portal KB0021770

↧
↧

SafeNet Synchonization Agent 3.8.3 – Release Update

May 4, 2020, 4:10 am
$
0
0

We would like to inform you that SafeNet Synchonization Agent 3.8.3 is  now available.

This updated version features the following:

  • Enhanced support for complex user directories with an option to skip duplicate users
  • Support for Windows Server 2019

Installation and configuration instructions, along with the agent itself, can be downloaded from the Thales Customer Portal KB0021700

↧

SAS PCE/SPE 3.10.1 – Release Announcement

May 5, 2020, 12:07 am
$
0
0

We would like to announce the release of SAS PCE/SPE 3.10.1.

This new version brings the following feature:

  • Support for MS SQL v8 database

SAS  PCE/SPE 3.10.1 is now generally available for download from the Thales Service Portal KB0021682

↧

SafeNet Authentication Service Agent for Remote Logging 1.04 – Release Announcement

May 6, 2020, 6:16 am
$
0
0

We would like to inform you that SafeNet Authentication Service Agent for Remote Logging 1.04 is now available.

This version features the following:

  • FIPS 140-2 compatibility supporting SAS PCE/SPE deployments in a FedRAMP compliant environment

Installation and configuration instructions, along with the agent itself, can be downloaded from the Thales Customer Portal KB0021669

↧

High Speed Encryption V5.1 Firmware Upgrade

May 11, 2020, 11:35 am
$
0
0

The purpose of this bulletin is to provide guidance for transitioning to the V5.1 firmware release for all fielded appliances.

Thales recommends that all HSEs be updated to the V5.1 firmware as soon as possible. The V5.1 is not backward compatible with prior versions of code but provides extensive feature advancements, updates to meet the latest security standards, and address critical known issues as outlined below.

The release is being offered free of charge to all Thales HSE customers from the Thales Support Portal (log in required).

Feature Enhancement: The V5.1 firmware release introduces Transport Independent Mode (TIM) which provides network independent encryption allowing customers to secure data in motion at layer 2, 3, or 4. In addition to the TIM enhancement, 100G Forward Error Correction (FEC) and GCM mode, and support for EQKD were added. Please refer to the Customer Release Note (CRN) and Users Guide for a full list of features now available.

Security Standard Updates: V5.1 firmware meets the latest NIST guidance set out in the Transitioning the Use of Cryptographic Algorithms and Key Lengths publication (SP800-131A). These updates to the V5.1 firmware render it inoperable with any prior version. It is recommended that all fielded units be upgraded to Firmware V5.1 to meet the latest NIST guidance and to ensure interoperability within the network. Please see the Release Notes for further details on interoperability and upgrade caveats.

Feature Enhancement: The V5.1 firmware release introduces Transport Independent Mode (TIM) which provides network independent encryption allowing customers to secure data in motion at layer 2, 3, or 4. In addition to the TIM enhancement, 100G Forward Error Correction (FEC) and GCM mode, and support for EQKD were added. Please refer to the Customer Release Note (CRN) and Users Guide for a full list of features now available.

Known Issue/Bug Fix: The HSE software library requires modification in order to address an undesired function. The fix removes an authentication mechanism whereby self-signed encryptor certificates may be accepted during session establishment. The change reduces the scope of accepted certificates, but does not alter the underlying security or cryptographic mechanism. Patches are available on the support portal to address this issues. Please see release notes for additional resolved issue.

All questions regarding upgrade of units should be directed to the Thales Support Team.

↧
↧

Luna HSM 7.4.2 Firmware Release Now Available

May 11, 2020, 11:39 am
$
0
0
Luna HSM 7.4.2 Firmware Release Now Available
Luna Network HSM firmware version 7.4.2 is now available, offering support for the following cryptographic algorithms:
·        3GPP Security for 5G Mobile Networks – Luna Network HSM now enables subscriber authentication for 5G mobile networks by protecting the private key. Specifically, Luna Network HSM now supports authentication and key generation functions for Milenage, Tuak and COMP128.

·        SM2 and SM4 – are now enabled in Luna Network HSM. Supporting the SM2 and SM4 cryptographic algorithms opens up sales and RFP opportunities in China.

·        SHA-3 – is the new Secure Hash Algorithm now available in the Luna Network HSM firmware, adding increased security.

The following HSM versions are required to take advantage of the new algorithms:

  • Luna Network HSM Appliance v7.4
  • Luna HSM Firmware v7.4.2
  • Luna HSM Client v10.2

Please note that this release replaces the previously released 7.4.1 firmware. Luna PCIe HSM will also offer the same support in the coming months.

Support Portal Downloads: 

  • Luna Network HSM Firmware 7.4.2 – KB0021674
  • Universal Client 10.2 – KB0021773
    • includes links to the Luna HSM Client, release notes and product documentation
  • 5G Algorithms/SM/SHA-3 Sample Code – KB0020857

Questions? Contact Nicholas Kondamudi, PLM, Claudia Dunphy, PMM
↧

Luna HSM Universal Client v10.2 Now Available

May 26, 2020, 9:07 am
$
0
0

The Universal Client v10.2 is now available, providing new operating system support for RHEL8 and Windows Server Core for Luna Network HSM, Luna PCIe HSM as well as Luna Cloud HSM from Data Protection on Demand (DPoD).

As a reminder, the Universal Client provides the following hybrid benefits:

  • Ease of Use: deploy a single client to support both our on-premises and cloud-based HSMs
  • Flexibility:
    • Clone keys between Luna HSMs and Luna Cloud HSM
    • Securely backup and restore HSM key material between Luna HSMs, Luna Cloud HSMs and Luna Backup HSMs with automatic key replication
  • Scalability: 3rd party HSM integrations working with both Luna HSMs and Luna Cloud HSM

Additionally, Universal Client v10.2 is required to perform the new 5G algorithms, and support AIX 7.2 and SuSE 11 & 12 for Luna Network HSM only, as announced in the Luna HSM 7.4.2 firmware release.

Download the Luna HSM Universal Client v10.2, release notes and product documentation from the Support Portal at KB0021773.

Contact your Thales Representative any questions.

↧
Search

Microsoft Internet Information Services Agent (IIS) 2.0.1 – Release update

June 2, 2020, 3:50 am
$
0
0

We would like to inform you that SafeNet Trusted Access Agent for Internet Information Services  (IIS) 2.0.1 is now available.

 This release features FIPS suppport

Installation and configuration instructions, along with the agent itself, can be downloaded from the Thales Customer Portal KB0021866

↧

SafeNet MobilePASS+ SDK for Android and iOS v2.0 – Release Update

June 2, 2020, 3:51 am
$
0
0

We would like to inform you SafeNet MobilePASS+ SDK for Android and iOS v2.0 is now available.

This release features the following:

  • Optimized SDK for integrating OTP generation into customer’s existing application, or a new custom branded application.

Note: Push OTP is not yet supported.

Installation and configuration instructions, along with the agent itself, can be downloaded from the Thales Customer Portal KB0021831

↧
↧

SafeNet Authentication Client (SAC) 10.2 for Mac (Post GA R3) – Release Announcement

June 8, 2020, 12:35 am
$
0
0

We would like to announce the release of SafeNet Authentication Client (SAC) version 10.2 for Mac (Post GA R3).

This version resolves known issues found in MacOS 10.15 Catalina.

SAC 10.2 for Mac (Post GA R3) is now available for download from Thales Customer Support Portal KB0022024

↧

Release Notification: ProtectFile FUSE v8.8.4

June 10, 2020, 9:32 am
$
0
0

Thales is pleased to announce the release of ProtectFile FUSE v8.8.4.

ProtectFile FUSE v8.8.4 includes the following new features:

  • Support for NextGen KeySecure : SafeNet ProtectFile FUSE 8.8.4.000 extends support for the NextGen KeySecure appliances version 1.9.1 and higher
  • Improved Syslog Message Format: SafeNet ProtectFile FUSE logs redirected to a Syslog server are formatted according to the Syslog Protocol RFC 5424 guidelines. (Refer to https://tools.ietf.org/html/rfc5424 for details on RFC 5424).
  • Support for the following operating systems:
    • RHEL 7.4 and higher
    • SLES 12 SP4
    • SLES 15

Download available at KB0022104 ProtectFile Linux 8.8.4 with Fuse Driver (log in required).

↧

SafeNet IDPrime 930/931/3930– Release Announcement

June 15, 2020, 7:35 am
$
0
0

We are excited to release the first version of our next generation smart cards – the SafeNet IDPrime  930/931/3930.

These new cards offer the latest in cryptographic security and updated certifications, including FIPS certification  and Support of non-managed mode which is the capability to initialize the card in case that no CMS is in use.

The supporting middleware for SafeNet IDPrime 930/931/3930 is SafeNet Authentication Client (SAC) 10.8 and the supporting minidriver is SafeNet Minidriver 10.8

SafeNet IDPrime 930/931/3930 will be an eventual replacement for the IDPrime MD 830B/831/3810, and can now be offered instead.

Note: FIPS certification by National Institute of Standards and Technology (NIST) is in its final stages and to be finalized in the coming weeks.

↧
Viewing all 550 articles
Browse latest View live
Search