Introduction

Entrust KeyControl has been rebranded as the Entrust Cryptographic Security Platform (CSP) Key Manager.

The Entrust CSP Key Manager continues to provide a comprehensive solution for discovering and managing the lifecycles of cryptographic keys, secrets, certificates, tokens, libraries, protocols, and configurations:

  • The KeyControl Compliance Manager is now the Entrust CSP Compliance Manager. It still integrates with Entrust nShield Hardware Security Modules (HSMs) to protect the master keys for the CSP.

  • KeyControl Vault is now the Entrust Cryptographic Security Platform Vault. The Cryptographic Security Platform Vaults also still integrate with Entrust nShield HSMs to provide an optional HSM root of trust.

Because the Entrust integrations are tested against specific product versions, this guide is still branded as a "KeyControl" integration. It was tested against a pre-CSP version of KeyControl.

Exercise caution when using an Entrust Integration Guide with a product version that does not match the tested version, because your version might not function in exactly the same way.

Entrust cannot guarantee the success of integrations in configurations other than those indicated in the guide. This guide remains on the website for customers using pre-CSP versions of KeyControl.

This guide describes:

  • The procedure to install and configure KeyControl Vault.

  • The procedure to integrate Entrust KeyControl Vault and Entrust nShield HSM for establishing a hardware root of trust for all encryption keys.

  • The procedure to protect the KeyControl Vault Admin Key in the HSM.

When all of these procedures are performed, the combined solution facilitates regulatory compliance with a FIPS 140 Level 3 and Common Criteria EAL4+ root of trust.

  • Entrust recommends that you allow only unprivileged connections unless you are performing administrative tasks.

  • Until and including v13.4.5 firmware, all nShield HSMs require specific activation to utilize the elliptic curve features. See the nShield Security World documentation at nShield Product Documentation website.

Product configuration

Entrust has successfully tested nShield HSM integration with KeyControl Vault in the following configurations:

Product Version

KeyControl Vault

10.4.3

nShield HSM hardware

Connect XC, nShield 5c

Supported features

Entrust has successfully tested nShield HSM integration with the following features:

Feature Support

Softcards

Yes

Module-only key

Not Supported

OCS cards

For FIPS Authorization Only

nSaaS

Not tested

Supported nShield hardware and software versions

Entrust has successfully tested with the following nShield hardware and software versions:

HSM Security World Software Firmware Image FIPS 140 Level 3

Connect XC

13.6.8

12.72.3 (FIPS 140-2 certified)

13.6.7

Yes

nShield 5c

13.6.8

13.4.5 (FIPS 140-2 Certified)

13.6.7

Yes