Key Management Service:wrapKey

Feature description

• The wrapKey command allows for the export of an encrypted copy of a symmetric key or private key from HSM into a file.

• Only the key's owner, the CU user who generated the key, is authorized to export it. Users with shared access can utilize the key for encryption operations but are not permitted to export it.

• For re-importing an encrypted key into HSM, refer to unWrapKey. To export a key in plain text from HSM, use exSymKey or exportPrivateKey, as appropriate.

Syntax

Enter the parameters as per the syntax provided below. For detailed parameter descriptions, see Parameters.

wrapKey -k <exported-key-handle>
        -w <wrapping-key-handle>
        -out <output-file>
        [-m <wrapping-mechanism>]
        [-t <hash-type>]
        [-noheader]
        [-i <wrapping IV>]  
        [-iv_file <IV file>]
        [-tag_size <num_tag_bytes>>]

Example

The following example demonstrates how to export an RSA asymmetric key (key handle 8) encrypted with an AES key (key handle 6) from HSM to a file.

Command:  wrapKey -k 8 -w 6 -out aes-encrypted.key -m 4

       	Cfm2WrapKey5 returned: 0x00 : HSM Return: SUCCESS

       	Key Wrapped.

       	Wrapped Key written to file "aes-encrypted.key" length 1516

Parameters