Introduction

This guide is the reference guide for the following topics:

CORE user interface commands: CLICommand Line Interface; UI; Management Scripts
Settings: System; Partition; Client

This guide is a part of the following CORE user-oriented guides:

- CORE General Information User Guide: Specifications, Requirements, and Concepts.
- CORE Installation User Guide: Installation and Upgrade procedures.
- CORE FIPS User Guide: A concise summary of distinctive FIPSFederal Information Processing Standards - standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors-mode features and procedures.
- CORE KMIP User Guide: Configuring CORE as a KMIPKey Management Interoperability Protocol - an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server server.
- CORE IAM User Guide: User and Device authentication and authorization control.
- CORE Key Management User Guide: Keys, capabilities, authorization, and lifecycle procedures.
- CORE Maintenance User Guide: Backup, Restore, Database protection, Upgrade, Certificate renewal, and similar.
- CORE Interfaces User Guide: Definitive specification of UI and CLICommand Line Interface commands and settings.

Revision History

For the history preceding the 2.0.2103 release, see the Revision History of 2.0.2010 and earlier releases.

Release Date Description

Release	Date	Description
2.0.2112	March 2022	New features: The TOTPTime-based One Time Password-based second factor in 2FATwo-factor authentication - Authentication method that requires both something a user has (for example, a certificate) and something the user knows (for example, a password) of a partition users. System Attributes. OTPOne-Time Password (or Pin) - a password that is valid for only one login session or transaction. Master key. See Root Partition. Partition settings. TOTPTime-based One Time Password enabling. See TOTP Settings. Upgrade to 2.0.2112. See ekm_create_two_factor_master_key. Added settings for using a proxy with an external KMSKey Management System in proxyHost. Added Auto Backup setting. Changes: The CASPUnbound’s Crypto Asset Security Platform (“CASP”) provides the advanced technology and the architecture to secure crypto asset transactions. Vault Key Encryption uses two CORE keys. See ekm_set_offline_backup_keys. The default ACActivation Code validity period is extended to 0ne year. See Client Registration Settings.
2.0.2106	September 2021	New features: Split KeyA split key is a symmetric or a private key that has been split into a number of parts, - Keys and Certificates Tab, Join Split Key A secret key may be imported to CORE in parts (SplitKey) and reconstructed back (Join). The supported split/join method is XOR. The SplitKey file encoding must be HEX. Secret keys now have Key Check Value (KCVKey Check Value. PKCS#11 CKA_CHECK_VALUE) - Key Info, ucl show. Added the PKCS#11 CKA_CHECK_VALUE method to validate the key integrity or compare keys without knowing their actual values. UCLUnbound Command Language may be used to encrypt and decrypt files using Hybrid encryption -File Encrypt and Decrypt Commands. Google Cloud KMSKey Management System joins AWS and Azure unified key management and usage provided by CORE - New Keystore. Enhancements: Extended maximum validity of an Activation Code (ACActivation Code) to one year - Ephemeral Client Template, ucl client create -m Template The validity of CORE client Activation Code may be extended without changing its value - Refresh AC, ucl client refresh. A partition SOSecurity officer - UKC partition administrator role. may now check the status of the Keystores Tab external keystore by using non-intrusive Ping. Enhanced key import and export options - Import,ucl export. Changes: The ekm-trace.log file is archived hourly instead of daily. To refer to 3DES keys, use TDES instead of 3DES. The partition SOSecurity officer - UKC partition administrator role. rescue option was moved to the partition management tab in the UI. Doc changes: Rebranded the product name from Unbound Key Control (UKC) to Unbound CORE.
2.0.2103	May 2021	New features: New keys and algorithms Montgomery and Edwards curves - ucl generate –t ECC. CHACHA20 - ucl generate -t CHACHA20. Export and import of wrapped key material using JSON file - JSON of Key Wrapped by AES, Import Wrapped Key. User Groups - User Groups Tab. Defining SSOSingle Sign-On users using regular expressions - About SSO Expressions. Enhancements: Ephemeral client data may be omitted from the CORE database - ucl client create -m Template. Changes: EdDSAEdwards-curve Digital Signature Algorithm keys are now referenced as ECCElliptic-curve cryptography - an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields keys with curve CURVE25519 and SIGN purpose - ucl generate –t ECC. The meaning of the `--purpose E` (encrypt and decrypt) option has been reduced to the encrypt only - Prerequisites. Deprecated support for the RFC-5297 key (SIV). The `trusted` property of a key has been restricted to AES and public RSA keys - ucl generate –t AES, Import Public RSA Key. Doc changes: Refactored from UKC User Guide 2.0.2010.

2.0.2112

March 2022

New features:

The TOTPTime-based One Time Password-based second factor in 2FATwo-factor authentication - Authentication method that requires both something a user has (for example, a certificate) and something the user knows (for example, a password) of a partition users.
- System Attributes. OTPOne-Time Password (or Pin) - a password that is valid for only one login session or transaction. Master key. See Root Partition.
- Partition settings. TOTPTime-based One Time Password enabling. See TOTP Settings.
- Upgrade to 2.0.2112. See ekm_create_two_factor_master_key.
Added settings for using a proxy with an external KMSKey Management System in proxyHost.
Added Auto Backup setting.

Changes:

The CASPUnbound’s Crypto Asset Security Platform (“CASP”) provides the advanced technology and the architecture to secure crypto asset transactions. Vault Key Encryption uses two CORE keys. See ekm_set_offline_backup_keys.
The default ACActivation Code validity period is extended to 0ne year. See Client Registration Settings.

2.0.2106

September 2021

New features:

Split KeyA split key is a symmetric or a private key that has been split into a number of parts, - Keys and Certificates Tab, Join Split Key
A secret key may be imported to CORE in parts (SplitKey) and reconstructed back (Join). The supported split/join method is XOR. The SplitKey file encoding must be HEX.
Secret keys now have Key Check Value (KCVKey Check Value. PKCS#11 CKA_CHECK_VALUE) - Key Info, ucl show.
Added the PKCS#11 CKA_CHECK_VALUE method to validate the key integrity or compare keys without knowing their actual values.
UCLUnbound Command Language may be used to encrypt and decrypt files using Hybrid encryption -File Encrypt and Decrypt Commands.
Google Cloud KMSKey Management System joins AWS and Azure unified key management and usage provided by CORE - New Keystore.

Enhancements:

Extended maximum validity of an Activation Code (ACActivation Code) to one year - Ephemeral Client Template, ucl client create -m Template
The validity of CORE client Activation Code may be extended without changing its value - Refresh AC, ucl client refresh.
A partition SOSecurity officer - UKC partition administrator role. may now check the status of the Keystores Tab external keystore by using non-intrusive Ping.
Enhanced key import and export options - Import,ucl export.

Changes:

The ekm-trace.log file is archived hourly instead of daily.
To refer to 3DES keys, use TDES instead of 3DES.
The partition SOSecurity officer - UKC partition administrator role. rescue option was moved to the partition management tab in the UI.

Doc changes:

Rebranded the product name from Unbound Key Control (UKC) to Unbound CORE.

2.0.2103

May 2021

New features:

New keys and algorithms

Montgomery and Edwards curves - ucl generate –t ECC.
CHACHA20 - ucl generate -t CHACHA20.

Export and import of wrapped key material using JSON file - JSON of Key Wrapped by AES, Import Wrapped Key.
User Groups - User Groups Tab.
Defining SSOSingle Sign-On users using regular expressions - About SSO Expressions.

Enhancements:

Ephemeral client data may be omitted from the CORE database - ucl client create -m Template.

Changes:

EdDSAEdwards-curve Digital Signature Algorithm keys are now referenced as ECCElliptic-curve cryptography - an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields keys with curve CURVE25519 and SIGN purpose - ucl generate –t ECC.
The meaning of the --purpose E (encrypt and decrypt) option has been reduced to the encrypt only - Prerequisites.
Deprecated support for the RFC-5297 key (SIV).
The trusted property of a key has been restricted to AES and public RSA keys - ucl generate –t AES, Import Public RSA Key.

Doc changes:

Refactored from UKC User Guide 2.0.2010.