Sentinel® HL from Thales, the successor of the SafeNet and Aladdin HASP keys, is the hardware key most often found in software that has been on the market for a decade or more. This page puts the KeyNub USB-C license dongle beside it, fact by fact. Every statement about Sentinel HL comes from Thales’ own data sheet and documentation, footnoted below with the date we read them; where those sources are silent, the cell says so. The page compares what each product is and how it is deployed. It does not rate either product’s security, and it does not compare prices.
Facts Side by Side
| KeyNub USB-C License Dongle | Sentinel HL (Thales) | |
|---|---|---|
| Vendor | AB-Tools GmbH, Munich, Germany; developed and supported there | Thales; Sentinel HL is part of the Sentinel LDK licensing solution5 |
| Hardware form factors | One USB-C dongle | USB keys in Mini, Micro and Midi housings1 |
| Driver on the end user’s machine | None. USB HID device handled by the operating systems’ built-in drivers; no runtime service, no vendor software on the end user’s machine | Driverless configuration keys use the operating system’s HID drivers; “in many cases, it is possible to use these keys without installing any additional support software”2. Under Windows the Sentinel LDK Run-time Environment is optional from Sentinel LDK 7.0; keys in HASP configuration require it3 |
| Administrator rights for the end user | None. On Linux, a udev rule grants ordinary users access | Not stated in the sources consulted |
| Security element | Common Criteria EAL6+ certified secure element; the device key pair is generated inside it | “Highly secure SmartCard chip technology”5; the data sheet names no evaluation level1 |
| Cryptography (vendor statements) | ECC P-256 device identity with certificate chain and live challenge-response; AES-256-GCM session channel derived by ECDH and HKDF | AES 128-bit encryption, 64,000 encryption keys, unique 32-bit ID, on-chip execution (AppOnChip) on most models1 |
| License storage | 1 MB of encrypted storage, as named records | Basic: 112 bytes; other models 4 KB protected read/write memory and 2 KB read-only memory, plus dynamic memory of 25 KB or 390 KB depending on the model1 |
| Counters | Hardware monotonic counters (read in a session, increment with the write role) | Pay-per-use licence models supported on every model1 |
| SDK licence | Bindings, samples and C ABI header under Apache-2.0 on GitHub; prebuilt native libraries under a separate binary licence | Sentinel LDK software package; terms are Thales’ |
| Programming languages | 43 languages, each with a runnable sample; one core C library with a stable ABI | Licensing API for C, .NET, .NET Standard, Java and REST; Admin API for C, .NET and Java4 |
| Server or cloud component | None required. Verification is local between the application and the dongle; no activation, licence or cloud server. A licence portal, fleet management or cloud service around the dongle can be built on the open SDK; AB-Tools develops such components as contract work | Sentinel HL “combines with Software License (SL) and Cloud License (CL)” in the Sentinel LDK portfolio; network concurrency on all but the Basic key15 |
| Operating systems | Windows, Linux, macOS; x64 and ARM64 (Apple silicon, Windows on ARM, aarch64 Linux) | Not compared; see the Sentinel LDK documentation4 |
Moving from Sentinel HL to KeyNub
The concepts map like this:
- Sentinel HL key: the KeyNub dongle. A USB HID device on every platform, with no configuration to choose.
- Feature IDs and licence terms: named records that you define and write with your own tooling, in whatever licence format your product uses.
- Read/write and read-only memory: records, 1 MB in total, read in a session and written with your write key.
- Run-time Environment: nothing. The native library is part of your application.
- Sentinel LDK Envelope (automatic wrapping of executables): KeyNub takes a different route. The check is written in your code against the documented API, and the integration guide shows the pattern that makes the check pointless to remove: data the program needs is shipped encrypted and decrypted through the dongle.
- Licensing API (login, read, write, encrypt, decrypt): the same operations exist in the KeyNub SDK as verify, session, records and app-data encryption, in 43 languages.
The KeyNub SDK is open: the bindings, the samples and the C ABI header are Apache-2.0 on GitHub, so the migration can be judged against the real code before a single dongle is bought. The language pages hold the install command and a reading example for each of the 43 languages.
Sources
- Thales, “Sentinel HL Driverless Configuration Keys” data sheet (EHV3EN, May 2026): https://docs.sentinel.thalesgroup.com/softwareandservices/ldk/LDKdocs/Specs/HL%20Data%20Sheet.pdf
- Thales, “Upgrading Sentinel HL Keys to Driverless Configuration” (Sentinel LDK documentation): https://docs.sentinel.thalesgroup.com/ldk/LDKdocs/WebHelp/UpgradeToDriverless.htm
- Thales, “End-User Keys” (Sentinel LDK Software Protection and Licensing Guide): https://docs.sentinel.thalesgroup.com/ldk/LDKdocs/SPNL/LDK_SLnP_Guide/GettingStarted/EndUser_Keys.htm
- Thales, “API References” (Sentinel LDK documentation): https://docs.sentinel.thalesgroup.com/ldk/apis.htm
- Thales, “Sentinel HL” product page: https://cpl.thalesgroup.com/software-monetization/all-products/sentinel-hl
Sentinel, Sentinel HL, Sentinel LDK and HASP are trademarks of Thales or its affiliates. They are used here to identify the products compared; KeyNub is not affiliated with Thales. All competitor facts on this page are quoted or paraphrased from the vendor’s public material as retrieved on 20 September 2026 and may have changed since. If you find a statement that is out of date, tell us and we correct it.
See also: KeyNub compared with CodeMeter.
All supported languages · Security architecture · Buy a KeyNub · Ask us something
