AWS CloudHSM previous Client SDK releases
This section lists previous Client SDK releases.
Client SDK 5.16.2 adds support for RHEL 10 platform and removes support for Ubuntu 20.04 LTS. Client SDK 5.16.2 also adds support for JCE Provider and KSP with new features, while delivering bug fixes and improvements across other SDKs.
Platform support
-
Added RHEL 10 support for x86 and ARM architectures.
-
OpenSSL Engine is not supported in RHEL 10 as part of Red Hat's transition to the newer Provider-based architecture introduced in OpenSSL 3.0.
-
CloudHSM CLI
-
Fixed a bug where signing with prehashed data did not clear tokens in interactive mode.
-
Fixed a bug in
quorum token-sign listthat previously caused errors when three or more tokens were present.
JCE provider
-
Added support for finding Elliptic Curve (EC) keys using ECParameters and ECPoint for hsm2m.medium types.
-
Added
sharedInfoparameter support for ECDH with X9.63 KDF.
PKCS #11 library
-
Added support for finding Elliptic Curve (EC) keys using ECParameters and ECPoint for hsm2m.medium types.
Bug fixes/Improvements
-
Enhanced token listing functionality to display more tokens in a single operation.
-
Fixed key usage token clearing issue in CloudHSM CLI interactive mode when signing with prehashed data.
-
Resolved a known issue where some HSM throttled operations on hsm2m.medium would not be automatically retried. Refer to Issue: Operations can fail during backup creation for details.
Client SDK 5.16.1 adds support for signing and verifying prehashed data in the CloudHSM CLI.
Platform support
-
SDK 5.16.1 is the last release to provide Ubuntu 20.04 LTS platform support. For more information, see the Ubuntu website
.
CloudHSM CLI
-
Added support for signing and verifying prehashed data in the CloudHSM CLI. For more information, see The crypto sign category in CloudHSM CLI and The crypto verify category in CloudHSM CLI.
JCE provider
-
Updated AES/CBC/Pkcs5Padding Encryption mode to automatically generate a random Initialization Vector (IV) when null IV is provided. Previously, null IV would result in an operation failure. Explicit IVs remain mandatory for decrypt operations.
Bug fixes/Improvements
-
Reduced latency for repeated digest update operations in JCE.
-
Updated the `generate key-reference` command to correctly name KSP key reference files based on their Attribute ID values when running on Windows Server. For more information, see Generating KSP key references (Windows).
Client SDK 5.16 adds ECDH with X963 KDF support on hsm2m.medium cluster type for JCE provider and PKCS #11 library. Client SDK 5.16 also adds support for generating KSP key reference files on Windows Server with CloudHSM CLI.
CloudHSM CLI
-
Added support for generating KSP key reference files on Windows Server, for more information, see Generating KSP key references (Windows).
JCE provider
-
Added ECDH with X963 KDF support on hsm2m.medium cluster type, see Supported mechanisms for JCE provider for AWS CloudHSM Client SDK 5.
PKCS #11 library
-
Added ECDH with X963 KDF support on hsm2m.medium cluster type, see Supported mechanisms for the PKCS #11 library for AWS CloudHSM Client SDK 5.
Bug fixes/Improvements
-
Fixed a bug where session keys were not properly cleaned during disconnection.
-
Fixed an issue where successful mTLS logout operations on hsm2m.medium incorrectly returned an error response.
-
Fixed an issue with connection failure during the windows startup.
-
Fixed an issue where SDK info tools displayed incorrect output on Ubuntu systems.
-
Fixed an issue that previously allowed ECDSA with weaker hashes in FIPS mode.
Client SDK 5.15 adds support for replicating a user across cloned clusters with CloudHSM CLI. Client SDK 5.15 also adds installation packages for PKCS #11 library, JCE provider, CloudHSM CLI, and Key Storage Provider (KSP) for Windows Server 2025.
Platform support
-
Added support for Windows Server 2025 for PKCS #11 library, JCE provider, CloudHSM CLI, and Key Storage Provider (KSP).
CloudHSM CLI
-
Added the following command:
-
Replicate a user with CloudHSM CLI
-
Client SDK 5.14 adds support for quorum controlled key usage and key management operations using CloudHSM CLI. Client SDK 5.14 also adds support for Key storage provider (KSP) for AWS CloudHSM Client SDK 5 for windows platforms. Additionally, Client SDK 5.14 adds installation packages for PKCS #11 library, JCE provider, CloudHSM CLI, and Key Storage Provider (KSP) for Windows Server 2022.
Platform support
-
Added support for Windows Server 2022 for PKCS #11 library, JCE provider, CloudHSM CLI, and Key Storage Provider (KSP).
CloudHSM CLI
-
Added support for quorum controlled key usage and key management operations.
Key Storage Provider (KSP)
-
Added support for Key Storage Provider (KSP), a cryptographic API specific to the Microsoft Windows operating system. For more information, see Key storage provider (KSP) for AWS CloudHSM Client SDK 5
Client SDK 5.13 adds support for configuring mutual TLS on hsm2m.medium cluster types. For information on using mutual TLS with CloudHSM, see Set up mutual TLS between client and AWS CloudHSM (recommended). Client SDK 5.13 also adds installation packages for Ubuntu 24.04 LTS.
Platform support
-
Added support for Ubuntu 24.04 LTS on x86_64 and ARM64 architectures for all SDKs.
CloudHSM CLI
-
Added support for admin users to run the Replicate a key with CloudHSM CLI command. Client SDK 5.12 introduced the key replicate command for use by crypto users.
-
Added the following command:
Bug fixes/Improvements
-
Fixed an issue to decrease the time required for the client to detect unhealthy HSM connections, which helps prevent connection drop errors during lambda warm starts.
Client SDK 5.12.0 adds ARM support to several platforms and performance improvements for all SDKs. New features have been added to the CloudHSM CLI and JCE provider.
Platform support
-
Added support for Amazon Linux 2023 on ARM64 architecture for all SDKs.
-
Added support for Red Hat Enterprise Linux 9 (9.2+) on ARM64 architecture for all SDKs.
-
Added support for Ubuntu 22.04 LTS on ARM64 architecture for all SDKs.
CloudHSM CLI
-
Added the following command:
-
Added support for connecting to multiple clusters. For more information, see Connecting to multiple clusters with CloudHSM CLI.
JCE provider
-
Added
KeyReferenceSpecfor retrieving keys usingKeyStoreWithAttributes. -
Added
getKeysfor retrieving multiple keys at once usingKeyStoreWithAttributes.
Performance improvements
-
Performance improvements for the AES CBC NoPadding operation for all SDKs.
Client SDK 5.11.0 adds new features, improves stability, and includes bug fixes for all SDKs.
Platform support
-
Added support for Amazon Linux 2023 and RHEL 9 (9.2+) for all SDKs.
-
Removed support for Ubuntu 18.04 LTS due to its recent end of life.
-
Removed support for Amazon Linux due to its recent end of life.
CloudHSM CLI
-
Added the following commands:
-
Export an asymmetric key with CloudHSM CLI now supports export of public keys.
OpenSSL Dynamic Engine
-
The AWS CloudHSM OpenSSL Dynamic Engine is now supported on platforms that come installed with an OpenSSL library version of 3.x. This includes Amazon Linux 2023, RHEL 9 (9.2+), and Ubuntu 22.04.
JCE
-
Added support for JDK 17 and JDK 21.
-
Added support for AES keys to be used for HMAC operations.
-
Added the new key attribute
ID. -
Introduced a new
DataExceptionCausevariant for key exhaustion:DataExceptionCause.KEY_EXHAUSTED.
Bug fixes/Improvements
-
Increased the max length for the
labelattribute from 126 to 127 characters. -
Fixed a bug which prevented unwrapping of EC keys with the RsaOaep mechanism.
-
Resolved a known issue for the getKey operation in the JCE provider. Refer to Issue: Client SDK 5 memory leak with getKey operations for details.
-
Improved logging in all SDKs for Triple DES keys that have hit their maximum encryption block limit, per FIPS 140-2.
-
Added known issues for the OpenSSL Dynamic Engine. See Known issues for the OpenSSL Dynamic Engine for AWS CloudHSM for details.
Client SDK 5.10.0 improves stability and includes bug fixes for all SDKs.
CloudHSM CLI
-
Added new commands that allow customers to manage keys using CloudHSM CLI, including:
-
Create symmetric keys and asymmetric key pairs
-
Share and unshare keys
-
List and filter keys using key attributes
-
Set key attributes
-
Generate key reference files
-
Delete keys
-
-
Improved error logging.
-
Added support for multi-line unicode commands in interactive mode.
Bug fixes/Improvements
-
Improved performance for importing, unwrapping, deriving, and creating sessions keys for all SDKs.
-
Fixed a bug in the JCE Provider that prevented temp files to be removed on exit.
-
Fixed a bug that caused a connection error under certain conditions after HSMs in the cluster are replaced.
-
Modified JCE
getVersionoutput format to handle large minor version numbers and include patch number.
Platform support
-
Added support for Ubuntu 22.04 with JCE, PKCS #11, and CloudHSM CLI (support for OpenSSL Dynamic Engine is not yet available).
Client SDK 5.9.0 improves stability and includes bug fixes for all SDKs. An optimization has been made for all SDKs to inform applications of operation failure immediately when an HSM is determined unavailable. This release includes performance enhancements for JCE.
JCE provider
-
Enhanced performance
-
Fixed a known issue for session pool exhaustion