Release Change History

The following changes were made in past DataControl/KeyControl releases. For details about the current DataControl/KeyControl release, see https://my.hytrust.com/s/product-guides. For details about previous releases, visit our Customer Portal at https://www.hytrust.com/support.

Changes in Release 5.5.1

Upgrade Path: For Entrust KeyControl, upgrade to 5.5.1 is allowed from version 5.4 and 5.5. For the Entrust DataControl Policy Agent, upgrade to 5.5.1 is allowed from release 5.2, 5.2.1, 5.3, 5.4, and 5.5. For details, see KeyControl Upgrades and Policy Agent Upgrades.

Changes in this release:

  • The multi-tenant KMIP server is the next generation server used for KMIP. You must migrate from the legacy KMIP server to take advantage of the new features in the multi-tenant KMIP server. You must complete this migration before you will be able to upgrade to KeyControl version 5.6.

  • You can now authenticate KMIP tenant and vault tenant users using a local user instead of managed authentication.

  • You can now use OpenLDAP Authentication for Secrets Vaults and KMIP Tenants.

  • You can now use OpenID Connect for Secrets Vaults and KMIP Tenants.

Changes in Release 5.5

Upgrade Path: For Entrust KeyControl, upgrade to 5.5 is allowed from version 5.4. For the Entrust DataControl Policy Agent, upgrade to 5.5 is allowed from release 5.2, 5.2.1, 5.3, and 5.4. For details, see KeyControl Upgrades and Policy Agent Upgrades.

Changes in this release:

  • You can now use Bring Your Own Key (BYOK) with Microsoft Azure.

  • You can use KMIP with multiple tenants, which allows administrators to isolate different tenant environments for security and compliance.

  • HSM Root-of-Trust provides enhanced protection for the contents of the object store. Root-of-Trust is gained when the HSM provides the cryptographic keys necessary to unlock the object store.

  • The DataControl file encryption module is now compliant with the Korea Cryptographic Module Validation Program (KCMVP). This can be enabled by setting the environment variable ENTRUST_KCMVP=True before executing the hcl encryptfile command.

Changes in Release 5.4

Upgrade Path: For Entrust KeyControl, upgrade to 5.4 is allowed from version 5.3. For the Entrust DataControl Policy Agent, upgrade to 5.4 is allowed from release 5.0, 5.1, 5.1.1, 5.1.2, 5.2, 5.2.1, and 5.3. For details, see KeyControl Upgrades and Policy Agent Upgrades.

Changes in this release:

  • You can now use KeyControl to manage your cloud keys using BYOK functionality.

  • Licensing has been updated, including individual entitlements for BYOK, KMIP Servers, and Secrets Vault.

  • The Secrets Vault now has its own GUI.

  • You can now replace an nShield Connect HSM that is on a KeyControl cluster.

  • You can now add an additional nShield Connect HSM to create a high availability cluster in KeyControl.

  • KeyControl now supports online encryption and UEFI secure boot for Ubuntu.

  • You can now disable the KeyControl webGUI alerts for your KeyControl managed user objects to improve performance.

Changes in Release 5.3

Upgrade Path: For Entrust KeyControl, upgrade to 5.3 is allowed from version 5.2 and 5.2.1 only. For the Entrust DataControl Policy Agent, upgrade to 5.2 is allowed from release 5.0, 5.1, 5.1.1, 5.1.2, 5.2, and 5.2.1. For details, see KeyControl Upgrades and Policy Agent Upgrades.

Changes in this release:

  • Added support for Luna Cloud HSM.

    • You can now use the Luna Cloud HSM as a single HSM or in a cluster with Luna HSM.
    • You can now encrypt KMIP objects with keys stored in the Luna Cloud HSM.
  • You can now add a Key Encryption Key (KEK) to an existing Cloud VM Set.

  • The htadmin user can now reset the credentials for the Security Administrator (secroot) account. If you do not want to allow htadmin to reset the secroot credentials, you can disable this option.

  • You can now set an expiration date for the secroot user account or set it to never expire.