Luna SA 4.4 - securedbysafenet.com

1 safenet Customer Support Contacts: Web: Email: luna SA Customer Release Notes 007-010090-001 Revision B Copyright 2009-2011 safenet Inc. 1 luna SA CUSTO MER RELEASE NO TES Document part number: 007-010090-001 Revision B Release notes issued on: 11 November 2011 Note The most up-to-date version of this document is available at the following location: Product description safenet luna SA is a network-attached hardware security appliance providing cryptographic acceleration, hardware key management, and multiple configuration profiles.

2 Component versions Note luna SA does not support legacy 2U appliances. luna SA is the last release to suppport the 2U appliance. Do not attempt to upgrade 2U luna SA appliances to release The outcome would not be a tested or supported configuration. Release applies to the current, RoHS-compliant 1U luna SA only. Component 1U HSM: K5 Card Reader USB HSM Firmware: or (see Note 1) G3 Backup Token , , or (see Note 2) G4 Backup Token , , or (see Note 2) luna CA4 Token luna PCM KE Token PED Workstation software (requires Remote PED) [optional] PED I migration PED I PED II IKey (for PED II) 1000 Note 1 You can use backup tokens at firmware with luna SA at firmware or , provided you do not use the ARIA cipher (which was not supported in ).

3 However, we generally recommend that you update to token firmware Note 2 Appliance software requires installed HSM firmware or Both firmware versions are FIPS-validated. luna SA Customer Release Notes 007-010090-001 Revision B Copyright 2009-2011 safenet Inc. 2 Software upgrade paths The following table lists the upgrade paths for 1U luna SA appliances running release or higher software. Component From Version Directly To Version Client software , Appliance software , , , HSM firmware *, , * ( *) If your luna SA equipment is at any other starting point, please refer to the luna SA CRN and update instructions in order to bring your system to that approved (tested and supported) starting point before you begin the upgrade to luna SA and firmware or Otherwise, contact safenet Customer Support.

4 Legacy 2U models of luna SA (with the orange front-panel-cover) are not supported for this release. Do not attempt to update the old 2U models. For FIPS compliance, luna SA and firmware were your last stop. Firmware upgrade paths The tables below present your upgrade options depending on whether you start with a brand-new luna SA appliance or you start with an older version and install the update. luna SA ITEM [Previously] Installed Software Supported (new) System Software Included firmware Installed firmware Supported firmware New appliance (from factory) with optional or Update package , , , option only , , or New systems are shipped with firmware installed and with [optional] firmware already in the waiting area on the appliance.

5 New features like Remote PED require firmware You can keep firmware if you don t want Remote PED. You cannot keep an earlier firmware (such as ) and use software at all. In general, if update software includes firmware, then that firmware displaces whatever firmware package is in the appliance s waiting area . Therefore, it is possible to have installed HSM firmware of one version and optional/waiting firmware of another version. It is not possible to have more than one optional/waiting version. Update software includes ONLY the [optional] firmware, which it loads into the waiting area.

6 So after you install the upgrade appliance software your HSM firmware is whatever version it was before the update and the optional firmware in the appliance s waiting area is only. Upgrade path for firmware Start Intermediate via s/w update End Upgrade path for firmware Start End or or luna SA Customer Release Notes 007-010090-001 Revision B Copyright 2009-2011 safenet Inc. 3 luna SA 4 hardware refresh Due to end-of-life or near end-of-life conditions on several components, a new hardware variant of the luna SA 4 platform was released in July 2011.

7 As a result of the hardware refresh, you must use new part numbers when ordering the luna SA 4 product. The old part numbers are no longer valid. For more information, see "Hardware revisions and part numbers" below. The hardware refresh has introduced some minor changes to the operational behavior of the product, as described in the following sections: SNMP enabled by default SNMP is enabled by default on the hardware-refresh platform. Support added for gigabit Ethernet The Ethernet ports now support 10 Mbps, 100 Mbps, and 1000 Mbps link speeds.

8 New network LED behavior The following table describes the behavior of the network status LEDs on the hardware-refresh platform. LED color LED state Ethernet link and activity Green Blinking 100 Mbps or 1000 Mbps link speed Steady on Link established. Communication activity not detected. Hardware revisions and part numbers safenet may occasionally make minor changes to the hardware components used to manufacture the appliance for cost or availability reasons. For example, if the supply of one the original components used to manufacture the appliance becomes limited, the original component may be replaced with an equivalent, but more widely available component.

9 Although these minor hardware changes do not affect how the appliance behaves or operates, any hardware change triggers a change in the product revision. A product may go through several hardware revisions during its lifecycle. Note, however, that for any given part number, all revisions of that part number are functionally equivalent. For example, there is no operational difference between revisions B and D of part number 808-000043-001. In general, the following rules apply: If the hardware change does not affect how the product behaves or operates, the part number remains the same.

10 Only the revision is changed. If the hardware change affects how the appliance behaves or operates, the hardware is assigned a new part number. luna SA Customer Release Notes 007-010090-001 Revision B Copyright 2009-2011 safenet Inc. 4 Notes about this release luna SP luna SP is a special implementation that resides on a base luna SA system. Versions of luna SP older than are not compatible with luna SA If you intend to update the underlying luna SA platform to , then you must also update luna SP to at least version safenet phasing out MD5 in luna HSM products MD5 and SHA-1 digest algorithms have seen widespread use for the past decade or more, but are beginning to show their age.