Luna SA 4.1.1 - Secure Support - SafeNet

More documents

Recommendations

Info

Issue Priority Synopsis( 27281 ) hsm debugmode commandoutputs a bit ofextraneous info( 27220 ) Error in"Updating to Luna SA4.1.0" guide( 26394 ) JSPmakepersistant callwith null object returns"partition full"( 24230 ) “Package 7fails” when installingsoftware packages( 24223 ) Luna SA4:harmless pcmciastartup errors on 1UapplianceLLLLLProblem: Notice the line about cobra20 in the output below as a result of the "hsmdebug mode" command, it should be removed:[viper26] lunash:>hsm debug modeSyntax Error: Not a valid command.Command Result : 22 (Invalid argument)Syntax: hsm debug modeDescription: > HSM Debug Mode[root@cobra20 Cmode]# cat HThese commands are for HSM debug mode objects. The following subcommands areavailable:Name (short) Description---------------------------------------------------------set s Set HSM Debug Mode.Workaround: None. Ignore the extraneous text.Problem: In all cases, the command to update firmware should read “hsm updatefirmware” but the last two words are transposed in the document and the fix did notmake it into the released documentation.Workaround: Ignore the wording in “Updating to Luna SA 4.1.0” and write thecommand as hsm update firmware.Problem: Attempting to write an object that doesn't exist into the lunaJSP keystorereturns "('com.chrysalisits.crypto.LunaPartitionFullException: LunaTokenObject:Partition object storage limit has been reached. (130)')" A better error should bereturned, ie "Object handle invalid" equivalentWorkaround: Avoid attempting to write non-existent objects into the keystore.Problem: When running a package update, you might see a message during theinstall phase, indicating that package 7 has failed. This is the result of a too-specificdependency check by the install script (the installed version of a required package isalready newer, and works fine). The message is cosmetic and the installation issuccessful.Workaround: None. Ignore the message.Problem: In the absence of the pci card reader on the 1U appliance (which uses adifferent internal interface, and not the PCMCIA interface that is used in the 2U LunaSA), some errors are reported in the bootup logs of the 1U appliance. Example:Oct 25 10:00:55 viper21 pcmcia: Starting PCMCIA services: Oct 25 10:00:55viper21 pcmcia: modulesHint: insmod errors can be caused by incorrect moduleparameters, including invalid IO or IRQ parameters Oct 25 10:00:55 viper21pcmcia: /lib/modules/2.4.18/pcmcia/yenta_socket.o: init_module: No such deviceOct 25 10:00:55 viper21 pcmcia: Hint: insmod errors can be caused by incorrectmodule parameters, including invalid IO or IRQ parameters Oct 25 10:00:55viper21 pcmcia: /lib/modules/2.4.18/pcmcia/ds.o: init_module: Operation notpermitted Oct 25 10:00:55 viper21 pcmcia: cardmgr. Oct 25 10:00:55 viper21cardmgr[702]: no pcmcia driver in /proc/devices Oct 25 10:00:55 viper21 rc:Starting pcmcia: succeeded Oct 25 14:02:55 viper21 pcmcia: Starting PCMCIAservices: Oct 25 14:02:55 viper21 pcmcia: modulesHint: insmod errors can becaused by incorrect module parameters, including invalid IO or IRQ parametersOct 25 14:02:55 viper21 pcmcia: /lib/modules/2.4.18/pcmcia/yenta_socket.o:init_module: No such device Oct 25 14:02:55 viper21 pcmcia: Hint: insmod errorscan be caused by incorrect module parameters, including invalid IO or IRQparameters Oct 25 14:02:55 viper21 pcmcia: /lib/modules/2.4.18/pcmcia/ds.o:init_module: Operation not permitted Oct 25 14:02:55 viper21 pcmcia: cardmgr.Oct 25 14:02:55 viper21 cardmgr[696]: no pcmcia driver in /proc/devices Oct 2514:02:55 viper21 rc: Starting pcmcia: succeededWorkaround: None. Ignore the message. These errors are normal and do notrepresent a faultLuna SA 4.1.1 Customer Release Notes 007-010109-001 Revision G Copyright 2007-2012 SafeNet Inc. 12
Addressed issuesIssue Priority Synopsis(26772) SA 3.3 mustupdate to 4.1(25620) Support clienton a 64bit WindowsOS.(25492) Approvedhash functions mustnot be allowed untilafter user has loggedin(25443) DES is nolonger FIPS approvedLHHHProblem: A potential problem when updating a 3.3 SA to 4.0, when leaving thefirmware at 4.1.0, creates a situation where the box can't be updated at all. To getaround this, we must allow 3.3 to update to 4.1Fixed. Update of Luna SA 3.3 directly to 4.1 added.Problem: Port the client our Luna client to support the 64bit Windows platform.Fixed: Updated:1) Compiled and added new static openssl libraries and header files required forWin64 bit support.2) Modified all relevant .dsp files for 64 bit compiler (still using VC++ 6)3) Modified any source files for updated compiler changes (ie: iostream.h no longerexists...)4) Rebuilt putty ctp).Problem: NIST and CSE have issued an interpretation of FIPS 140-2 that says thatusers must be authenticated before they are allowed to use approved hash functions -i.e., SHA-1, SHA-224, SHA-256, SHA-384, SHA-256. If a user attempts to perform ahash operation before logging in we should return LUNA_USER_NOT_LOGGED_INand CKR_USER_NOT_LOGGED_IN thru the library.Fixed: The authentication state required for Digest commands has been changedfrom "PublicSession" to "LimitedUserAuthenticated".Problem: DES algorithms are no longer approved by FIPS.Fixed: Firmware is modified to restrict accordingly.(25441) FIPS nolonger recognizesRSA keys smaller than1024-bit.HProblem: FIPS no longer supports RSA keys smaller than 1024. While the system isin FIPS mode, attempts to use keys smaller than 1024-bit should return an error.Fixed: Firmware is modified to restrict accordingly.(25220) JSP will notread in cert withoutBasic Contstraint isCAsetHProblem: Our JSP should assume that if the boolean value for" isCA" is not set in thebasic constraints section of a cert, then it's False (i.e., an end-entity cert). Anotherinstance that should also be accounted for, is that in some end-entity certs, there is nobasic constraints section at all. This cert should also be imported without an error (Itshould also be assumed to be an end-entity cert).Fixed: Suppressed the error that was thrown when a malformed certificate is retrievedthrough our JSP. The fix suppresses an error that was thrown when the certificatedoes not conform to the RFC3280 specification on BasicConstraints. By NOT throwingthe exception the certificate is loaded into the LunaCertificateX509 structure and theBasicConstraints remains as the default value of -1 (which implies that 'isCA' == false).(25174) FIPS nolonger recognizesDSA keys smaller than1024-bit.HProblem: FIPS no longer supports DSA keys smaller than 1024. When in FIPSApproved mode, our HSM cannot allow DSA keys smaller than 1024 to be created,generated, unwrapped, unmasked, cloned on our HSM. The mechanism informationreported by the HSM must also report the correct minimum key size. 512 vs 1024,depending on the setting of "Allow non fips" policy.Fixed: Firmware is modified to restrict accordingly.(25173) Failed pairwisetest for all Keypair generationattempts must bereported.HProblem: Failed pair-wise test for all Key pair generation attempts must be reportedto the host/user. Currently, we loop (max of 3 tries) until a valid key pair is found.Fixed: If a pair-wise test fails, system logs an error to the debug area of the dualport.Luna SA 4.1.1 Customer Release Notes 007-010109-001 Revision G Copyright 2007-2012 SafeNet Inc. 13
Page 6: Luna SA VersionReason for Update3.0
Page 14: Issue Priority Synopsis(24986) 32-b
Page 17: CL_LogCritical("MCU IRQ: Multiple E

Luna SA 4.1.1 - Secure Support - SafeNet

Create successful ePaper yourself

Delete template?

Save as template?