Allow the JCE provider to extract private key secrets out of AWS CloudHSM
Use the following steps to allow AWS CloudHSM JCE provider to extract your private key secrets.
Important
This configuration change allows extraction of all EXTRACTABLE key bytes in clear from your HSM cluster. For better security,
you should consider using key wrapping methods to extract the key out of the HSM securely. This prevents unintentional extraction of your key bytes from the HSM.
Use the following commands to enable your private or secret keys to be extracted in JCE:
-
Once you enable your clear key extraction, the following methods are enabled for extracting private keys into memory.
Class Method Format (getEncoded) Key getEncoded() RAW ECPrivateKey getEncoded() PKCS#8 getS() N/A RSAPrivateCrtKey getEncoded() X.509 getPrivateExponent() N/A getPrimeP() N/A getPrimeQ() N/A getPrimeExponentP() N/A getPrimeExponentQ() N/A getCrtCoefficient() N/A
If you want restore the default behavior and not allow JCE to export keys in clear, run the following command:
