AWS cloudhsm medium security documentation change
Summary
Added documentation for new known issue: AES/CBC unwrap operations with all zero IV fails on hsm2m.medium instances
Security assessment
The change documents a cryptographic operation failure during key unwrapping (security-sensitive operation) that specifically impacts hsm2m.medium instances. Failure in key unwrapping operations could lead to service disruptions in cryptographic workflows, potentially affecting data security.
Diff
diff --git a/cloudhsm/latest/userguide/ki-hsm2m-medium.md b/cloudhsm/latest/userguide/ki-hsm2m-medium.md index 94df02098..fb013b91c 100644 --- a//cloudhsm/latest/userguide/ki-hsm2m-medium.md +++ b//cloudhsm/latest/userguide/ki-hsm2m-medium.md @@ -5 +5 @@ -Issue: Increased login latency on hsm2m.mediumIssue: Increased find key latency on hsm2m.mediumIssue: A CO using trying to set the trusted attribute of a key will fail with Client SDK 5.12.0 and earlierIssue: ECDSA verify will fail with Client SDK 5.12.0 and earlier for clusters in FIPS modeIssue: Only the PEM-formatted certificates can be registered as mtls trust anchors with CloudHSM CLIIssue: Customer applications will stop processing all requests when using mTLS with a passphrase protected client private key.Issue: User replicate fails when using the CloudHSM CLIIssue: Operations can fail during backup creationIssue: Client SDK 5.8 and above do not perform automatic retries for HSM throttled operations in some scenarios on hsm2m.medium +Issue: Increased login latency on hsm2m.mediumIssue: Increased find key latency on hsm2m.mediumIssue: A CO using trying to set the trusted attribute of a key will fail with Client SDK 5.12.0 and earlierIssue: ECDSA verify will fail with Client SDK 5.12.0 and earlier for clusters in FIPS modeIssue: Only the PEM-formatted certificates can be registered as mtls trust anchors with CloudHSM CLIIssue: Customer applications will stop processing all requests when using mTLS with a passphrase protected client private key.Issue: User replicate fails when using the CloudHSM CLIIssue: Operations can fail during backup creationIssue: Client SDK 5.8 and above do not perform automatic retries for HSM throttled operations in some scenarios on hsm2m.mediumIssue: AES/CBC unwrap operations with all zero IV fails on hsm2m.medium @@ -30,0 +31,2 @@ The following issues impact all AWS CloudHSM hsm2m.medium instances. + * Issue: AES/CBC unwrap operations with all zero IV fails on hsm2m.medium + @@ -122,0 +125,9 @@ For more information about best practices, see [Best practices for AWS CloudHSM] +## Issue: AES/CBC unwrap operations with all zero IV fails on hsm2m.medium + + * **Impact:** When using AES/CBC mechanism for unwrapping keys using the AWS CloudHSM JCE provider, operations with a 16-byte zero-filled IV fails on hsm2m.medium instances, due to an added validation check that was not in hsm1.medium instances. + + * **Resolution Status:** We are working on a fix that will allow zero-byte IVs to be accepted during AES/CBC unwrap operations. + + + +