Exporting keys

To export secret keys—that is, symmetric keys and asymmetric private keys—from the HSM, you must first create a wrapping key. You can export public keys directly without a wrapping key.

Only the key owner can export a key. Users with whom the key is shared can use the key in cryptographic operations, but they cannot export it. When running this example, be sure to export a key that you created.

Important

The exSymKey command writes a plaintext (unencrypted) copy of the secret key to a file. The export process requires a wrapping key, but the key in the file is not a wrapped key. To export a wrapped (encrypted) copy of a key, use the wrapKey command.

Export secret keys

Complete the following steps to export a secret key.

To export a secret key

1. Use the genSymKey command to create a wrapping key. The following command creates a 128-bit AES wrapping key that is valid only for the current session.

   Command: genSymKey -t 31 -s 16 -sess -l export-wrapping-key
   Cfm3GenerateSymmetricKey returned: 0x00 : HSM Return: SUCCESS
   
   Symmetric Key Created.  Key Handle: 524304
   
   Cluster Error Status
   Node id 2 and err state 0x00000000 : HSM Return: SUCCESS

2. Use one of the following commands, depending on the type of secret key that you are exporting.

   • To export a symmetric key, use the exSymKey command. The following command exports an AES key to a file named aes256.key.exp. To see all available options, use the exSymKey -h command.

     Command: exSymKey -k 524295 -out aes256.key.exp -w 524304
     Cfm3WrapKey returned: 0x00 : HSM Return: SUCCESS
     
     Cfm3UnWrapHostKey returned: 0x00 : HSM Return: SUCCESS
     
     
     Wrapped Symmetric Key written to file "aes256.key.exp"

     Note

     The command's output says that a "Wrapped Symmetric Key" is written to the output file. However, the output file contains a plaintext (not wrapped) key. To export a wrapped (encrypted) key to a file, use the wrapKey command.

   • To export a private key, use the exportPrivateKey command. The following command exports a private key to a file named rsa2048.key.exp. To see all available options, use the exportPrivateKey -h command.

     Command: exportPrivateKey -k 524296 -out rsa2048.key.exp -w 524304
     Cfm3WrapKey returned: 0x00 : HSM Return: SUCCESS
     
     Cfm3UnWrapHostKey returned: 0x00 : HSM Return: SUCCESS
     
     PEM formatted private key is written to rsa2048.key.exp

Export public keys

Use the exportPubKey command to export a public key. To see all available options, use the exportPubKey -h command.

The following example exports an RSA public key to a file named rsa2048.pub.exp.

Command: exportPubKey -k 524294 -out rsa2048.pub.exp
PEM formatted public key is written to rsa2048.pub.key

Cfm3ExportPubKey returned: 0x00 : HSM Return: SUCCESS