Managing Keys

(Optional) Importing Key Materials

If the Key Material Source of the key created in Creating a Key in the Data Security Zone is External, you need to import a local key material on the console.

1. Log in to the DSC console.
2. In the navigation pane on the left, choose Data Security Zone > Trusted Key Space. The Key Management Service page is displayed.
3. In the Operation column of the external key, click Import Key Material. Configure parameters in the Download the Import Items step.
   • In the Wrapping Algorithm drop-down list, select an algorithm.

     Table 2 Key wrapping algorithms

     Algorithm	Description	Configuration
     RSAES_OAEP_SHA_256	An RSA algorithm that uses Optimal Asymmetric Encryption Padding (OAEP) and the SHA-256 hash function.	Select an algorithm based on your HSM functions. If your HSMs support the RSAES_OAEP_SHA_256 algorithm, use it to encrypt key materials.

   • Select Use Existing Key Material or Download Key Material as needed.
     • Use Existing Key Material: Obtain the wrapping key and import token via API. Go to Step 4.
     • Download Key Material: The import token is automatically transferred. You simply need to use the downloaded wrapping key to export the key material from your key management device. Do not close this dialog box, or the token will become invalid. Go to Step 5.

4. Perform this step if you selected Use Existing Key Material in Step 3.
   1. Download key materials via API.
   2. Use the wrapping key to encrypt the key material.
   3. In Step 3, select Use Existing Key Material and click Next. In the Import Key Material step, configure the key material.
      In the Key Material text box, enter the key material encrypted using the wrapping key in 4.b. For example, enter the content of the EncryptedKeyMaterial.bin file in Using a Wrapping Key to Encrypt a Key Material.

      Figure 2 Importing a key material
      

   4. Click Next. In the Import Key Token step, configure parameters based on Table 3.
      Figure 3 Importing a key token

      

      Table 3 Parameters for importing a key token

      Parameter	Description
      Key ID	Randomly generated key ID when a key is created.
      Token	Enter the import token obtained in 4.a.
      Key Material Expiration Mode	Key material will never expire: Select this option to keep the imported key material valid indefinitely. Key material expires on: Select this option to set a specific expiration date and time for the key material. By default, imported key material expires 24 hours after import. When key material expires, the system automatically deletes it within 24 hours. Once deleted, the key becomes unusable, and its status changes to Pending import.

5. Perform this step if you selected Download Key Material in Step 3.
   1. Click Download Key Material to download the key material to your local PC. The downloaded file is a wrapping key file, as shown in Downloading a file.
      Figure 4 Downloading a file
      
      • wrappingKey_KeyID is the wrapping key. It is encoded in binary format and used to encrypt the wrapping key of the key material.
      • Import token: You do not need to download it. The import wizard automatically transfers the import token. If you close the wizard before completing the import, the token will automatically become invalid.
      

      The wrapping key expires in 24 hours. If the wrapping key is invalid, download it again.

      The console automatically transfers the import token. Therefore, do not close or exit the Import Key Material dialog box after the key material is downloaded. Otherwise, the imported token will automatically become invalid.

   2. Use the wrapping key to encrypt the key material.
   3. Click Next. In the Import Key Material step, click Add and upload the encrypted key material in 5.b.
      Figure 5 Importing a key material
      

   4. Click Next to go to the Import Key Token step. Configure the parameters by referring to Table 4.
      Figure 6 Importing a key token
      

      Table 4 Parameters for importing a key token

      Parameter	Description
      Key ID	Randomly generated key ID when a key is created.
      Key Material Expiration Mode	Key material will never expire: Select this option to keep the imported key material valid indefinitely. Key material expires on: Select this option to set a specific expiration date and time for the key material. By default, imported key material expires 24 hours after import. When key material expires, the system automatically deletes it within 24 hours. Once deleted, the key becomes unusable, and its status changes to Pending import.

6. Click OK. When message "Key imported successfully" is displayed in the upper right corner, the materials are imported.
   

   The key ID, imported key material, and import token must match. Otherwise, the import will fail.

   You can view the imported key in the key list. The default status of an imported key is Enabled.

Migrating a Key to an Enterprise Project

An enterprise project is a cloud governance management tool that aligns with your organization's corporate structure and business model. It helps you manage cloud-based projects, resources, personnel, finance, and applications using both a hierarchical organization structure (companies, departments, and projects) and a project service structure.

If you have enabled enterprise project management, you can add specified custom keys to enterprise projects on the KMS console. For details about how to enable the enterprise project function, see Enabling Enterprise Center.

1. In the navigation pane on the left, choose Data Security Zone > Trusted Key Space. The Key Management Service page is displayed.
2. In the row of a key, click More > Add to Project. A dialog box is displayed.

   If you are not an enterprise user, the Add to Project button is not displayed in the Operation column.

3. Select a project. Click OK.

Enabling a Custom Key

This section describes how to enable one or more custom keys on the KMS console. Only enabled custom keys can be used to encrypt or decrypt data. A new custom key is in the Enabled state by default.

1. In the navigation pane on the left, choose Data Security Zone > Trusted Key Space. The Key Management Service page is displayed.
2. Locate the target key in the list and click Enable in the Operation column.
3. In the displayed dialog box, click Yes to enable the key.

   To enable multiple keys at a time, select them and click Enable in the upper left corner of the list.

Disabling a Custom Key

1. In the navigation pane on the left, choose Data Security Zone > Trusted Key Space. The Key Management Service page is displayed.
2. In the key list, click Disable in the Operation column of a key.
3. In the dialog box that is displayed, select I understand the impact of disabling keys and click OK.

   To disable multiple keys at a time, select them and click Disable in the upper left corner of the list.

Scheduling the Deletion of a Key

Keys cannot be deleted immediately. Instead, you must schedule a deletion period ranging from 7 to 1,096 days.

Only custom keys in the Enabled, Disabled, or Pending import state can be deleted. Default keys cannot be deleted.

The system permanently deletes the key once the scheduled deletion period expires. After deletion, any content encrypted with this key, including generated data keys, can never be decrypted. Before deleting a key, ensure it is no longer in use. Otherwise, dependent services will become unavailable.

To schedule the deletion of multiple keys at a time, select them and click Delete in the upper left corner of the list. The following describes how to delete a single key.

1. In the navigation pane on the left, choose Data Security Zone > Trusted Key Space. The Key Management Service page is displayed.
2. In the Operation column of a key, click Delete.
3. On the Delete Key page, configure Waiting Period.
   Figure 7 Configuring the waiting period before deletion

   

4. If deletion verification is disabled, enter DELETE in the confirmation dialog box and click OK.

   If deletion verification is enabled, select a verification mode, click Get Code, enter the code, and click OK.

   To disable operation protection, hover the cursor over your account name and click Security Settings. On the Critical Operations tab, click Disable next to Operation Protection.

Canceling the Scheduled Deletion of a Key

This section describes how to use the KMS console to cancel the scheduled deletion of one or more custom keys prior to deletion execution. After the cancellation, the key is in Disabled status.

To cancel the deletion of multiple keys at a time, select them and click Cancel Deletion in the upper left corner of the list. The following describes how to cancel the scheduled deletion of a key.

1. In the navigation pane on the left, choose Data Security Zone > Trusted Key Space. The Key Management Service page is displayed.
2. In the key list, click Cancel Deletion in the Operation column of a key.
3. In the displayed dialog box, click OK.

   After the cancelation, the key status changes to Disabled. To enable the key, follow the instructions provided in Enabling a Custom Key.

Downloading Key Materials by Calling an API

1. Call the get-parameters-for-import API to obtain the wrapping key and import token.
   • public_key: content of the wrapping key (Base-64 encoding) returned after the API call
   • import_token: content of the import token (Base-64 encoding) returned after the API call
   The following example describes how to obtain the wrapping key and import token of a CMK (ID: 43f1ffd7-18fb-4568-9575-602e009b7ee8; algorithm: RSAES_OAEP_SHA_256).

   • Example request

     {      
         "key_id": "43f1ffd7-18fb-4568-9575-602e009b7ee8",
         "wrapping_algorithm":"RSAES_OAEP_SHA_256"
     }

   • Example response

     {
         "key_id": "43f1ffd7-18fb-4568-9575-602e009b7ee8",    
         "public_key":"public key base64 encoded data",
         "import_token":"import token base64 encoded data",
         "expiration_time":1501578672
     }

2. Save the wrapping key and convert its format. Only the key material encrypted using the converted wrapping key can be imported to the management console.
   1. Copy the content of the wrapping key public_key, paste it to a .txt file, and save the file as PublicKey.b64.
   2. Use OpenSSL to run the following command to perform Base-64 coding on the content of the PublicKey.b64 file to generate binary data, and save the converted file as PublicKey.bin:

      openssl enc -d -base64 -A -in PublicKey.b64 -out PublicKey.bin

3. Save the import token, copy the content of the import_token token, paste it to a .txt file, and save the file as ImportToken.b64.

Using a Wrapping Key to Encrypt a Key Material

Trusted key spaces only support symmetric keys. The key material is EncryptedKeyMaterial.bin.

• Method 1: Use the downloaded wrapping key to encrypt key materials on your HSM. For details, see the operation guide of your HSM.
• Method 2: Use OpenSSL to generate a key material and use the downloaded wrapping key to encrypt the key material.
  

  If you need to run the openssl pkeyutl command, ensure your OpenSSL version is 1.0.2 or later.

  1. To generate a key material for a 256-bit symmetric key, on the agent where OpenSSL has been installed, run the following command to generate the key material and save it as PlaintextKeyMaterial.bin:
     • AES256 symmetric key

       openssl rand -out PlaintextKeyMaterial.bin 32

  2. Use the downloaded wrapping key to encrypt the key material and save the encrypted key material as EncryptedKeyMaterial.bin.

     If the wrapping key was downloaded from the console, replace PublicKey.bin in the following command with the wrapping key name wrappingKey_keyID.

     Table 5 Encrypting the generated key material using the downloaded wrapping key

     Wrapping Key Algorithm	Key Material Encryption
     RSAES_OAEP_SHA_256	openssl pkeyutl -in PlaintextKeyMaterial.bin -inkey PublicKey.bin -out EncryptedKeyMaterial.bin -keyform der -pubin -encrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256