nShield Security World Release Notes

NSE-44980

Imported remote slots are now allowed to be mapped to slot 0. The front panel dialogs have not yet been updated to indicate that both dynamic and remote slots are now allowed.

NSE-46075

As a result of changes to support Remote Operator and Remote Administration the cfg-remoteslots utility may abort if run when there is an existng entry with a slotid of 0. We recommend editing the config file directly to make changes to the configuration.

NSE-41442

Earlier versions of nShield Java had a bug related to the order of clean up for unused or out-of-scope key objects and would sometimes return Status_UnknownID for operations during long running nCipherKM JCE and nCore Java applications.

The cause of this issue has now been fixed.

Java applications that perform operations directly with KeyID values rather than key objects may see Status_ObjectInUse errors unless keys, tokens, merged keys and channels are destroyed in the correct "LIFO" order.

Attempting to destroy a key or other object that is referenced by another object will result in Status_ObjectInUse errors.

Eg, If an application loads a key and creates a channel with that key, nCore Java will now return Status_ObjectInUse if the application attempts to destroy the key before destroying the channel using that key.

NSE-42172

The Java examples shipped with Security World Software are designed for use with later versions of Java (specifically Java version 8 and above). The Java examples may not work in earlier versions. Security World Software v12.80 continues to support Java versions 7, 8 and 11

NSE-39545

There is a performance regression in using ECDSA over SECP160r1 in the 12.80 Solo+ firmware. THis does not impact the Solo XC 12.80 firmware. Larger curve performance is also not impacted. If SECP160r1 is used it is recommended to not upgrade the firmware to 12.80 on the Solo+.

NSE-42034

Cmd_Encrypt does not properly populate the returned M_IV structured for Mech_AESmGCM. If an IV was supplied to Cmd_Encrypt then this value can be used instead. If no IV was supplied to Cmd_Encrypt then, for Mech_AESmGCM, the default chosen has taglen=16 and aad=the empty byteblock.

NSE-39031

In Security World v12.10 a compliance mode was added to the nShield Connect to allow compliance with USGv6 or IPv6 Ready requirements.

This mode changes the settings for the nShield Connect firewall so that it will pass-through packets which are discarded in the normal Default mode. This behavior is required for compliance testing but is not recommended for normal use since allowing packets with invalid fields or parameters through the firewall increases the attack surface.

This mode is known not to function correctly in the v12.80 Connect Image and should not be enabled.

NSE-41612

Downgrading an nShield Connect with the 12-80-3 Connect Image to an older version image with IPv6 networking configuration will require the nShield Connect to be factory reset following the upgrade. A new hardserver configuration file will also need to be created.

NSE-43519

12.80 clientside added support for IPv6 in the hardserver, however if IPv6 is disabled on the client machine the hardserver will fail to start. If IPv6 is disabled on the machine the following config item can be added to the Hardserver configuration file which will allow it to start:

[server_remotecomms_ipv6]
impath_port=0

NSE-36364

In rare cases upgrading from v12.50.x images to later v12.70 or v12.80 images can result in the Connect becoming stuck in maint2 mode and report 'hardserver error' on the front panel. This can be resolved by initiating a factory reset and a repeat upgrade to the intended Connect image to complete the process.

NSE-28462

During key migration, if an incorrect OCS passphrase is entered, the tool will output the message:

+ Error: Cannot migrate security world. + Failed to load softcard <card_name> : wrong passphrase

The 'Error: Cannot migrate security world' message is erroneous and can be ignored. The tool will continue and reprompt for the correct passphrase. Once the correct passphrase is entered the key migration will continue and complete successfully.

NSE-28606

nCipher Security do not recommend migrating keys to non-recoverable Worlds since it would then be impossible to migrate the keys in future should the need arise. If keys are migrated into a non-recoverable Wold then it is not possibly to verify OCS and softcard protected keys directly with nfkmverify. The OCS or softcards must be preloaded prior to attempting to verify the keys.

NSE-24335

Note: This issue applies to 12.50.11 XC firmware only. As a result of work to improve the upgrade experience with Solo XC it is necessary to add the following lines to /etc/vmware/passthru.map for successful operation of Solo XC in an ESXi environment.

# Solo XC 1957 082c link false

NSE-25477

If installing CAPI CSPs on Windows Server 2016 and 2019 do not select these as the default sChannel provider in the CSP wizards. If default sChannel is selected and the machine rebooted you will not be able to log in. It will be necessary to boot into safe mode and remove the CSPs as default sChannel providers.

NSE-23982

While resetting password if user enters incorrect password, cli prompt prints lone "I". This is where login handler program would print "Incorrect password for cli" message. Only "I" gets through the wire in time due to slow baud rate of the connection. This error is trivial and is only seen at the first log in during password reset.

NSE-23412

Customers should download at minimum CMAKE 3.9 for their RHEL distribution to be able to build the shipped examples.

NSE-25401

When installing 12.60 on a Dell XPS 8930 PC, a "Files in Use" screen may be displayed where it prompts to close down and restart Dell, Intel and NVIDIA applications. This can be ignored.

NSE-25626

Cancelling a Windows installation of the nShield Software with the "nShield Trusted Verification Device" component selected may leave the CyberJack Base Components installed on the machine. The user must restart their machine and uninstall the CyberJack Base Components manually via Add/Remove programs to completely uninstall.

NSE-22337

Users installing on a Pre-Windows 10 machine should download the Windows KB2999226 update to ensure the nShield Software will install correctly.

NSE-26559

If there are symbolic links within the NFAST_KMDATA folder then the installation will pause. To rectify the issue remove any symbolic links that may exist within NFAST_KMDATA and re-run the installer.

NSE-14406

In the Connect config file the remote_sys_log config entry implies multiple entries can be defined but only one remote syslog server can be configured.

NSE-14978

If Cmd_ChannelOpen is called without a key id an audit log message will be generated. This can occur if, for example, if Cmd_Hash is being used to hash a large amount of data. The nShield code translates this to opening a channel in Sign mode without a key. This would normally not be logged unless the key had the logkeyusage permission group flag. However, without a key the necessary checks cannot be performed and the Cmd_ChannelOpen is logged. This can be identified as a log entry without a key hash.

NSE-14519

The enquiry utility in 12.0 client-side incorrectly reports 12.50/12.60 Connect modules as Failed. This is a reporting error in this utility only and does not affect other applications. To confirm the module is in fact usable it is possible to send a NoOp command with: nopclearfail -n -m 1

NSE-14362

Type 0 smart cards cannot be used in a FIPS level 3 enforced Security World (introduced in Security World v12.50). Contact Support if you need information on moving from type 0 smart cards to supported smart cards.

NSE-15284

With this release of the CodeSafe Developer Kit the build flags required for nShield Solo XC and nShield Connect XC have changed. It is essential that NF_CROSSCC is removed from all XC SEE Machine build configurations. See the examples in the developer kit for further details.

NSE-15762

Some instability has been seen in the CNG nShield Service Agent when HSMs report failure after being cleared.

NSE-15834

After disabling key recovery in a Security World (using killrecov), nfkmverify no longer verifies the Security World, reporting "ACL of NSO not of expected form". The Security World is still usable and key recovery has been disabled.