GetParametersForImportResponse

The following example downloads a public key and import token to import symmetric encryption key material. It uses the default wrapping key spec and the RSAES_OAEP_SHA_256 wrapping algorithm.

To download the public key and import token for a symmetric encryption KMS key

var client = new AmazonKeyManagementServiceClient();
var response = client.GetParametersForImport(new GetParametersForImportRequest 
{
    KeyId = "1234abcd-12ab-34cd-56ef-1234567890ab", // The identifier of the KMS key that will be associated with the imported key material. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
    WrappingAlgorithm = "RSAES_OAEP_SHA_1", // The algorithm that you will use to encrypt the key material before importing it.
    WrappingKeySpec = "RSA_2048" // The type of wrapping key (public key) to return in the response.
});

MemoryStream importToken = response.ImportToken; // The import token to send with a subsequent ImportKeyMaterial request.
string keyId = response.KeyId; // The ARN of the KMS key that will be associated with the imported key material.
DateTime parametersValidTo = response.ParametersValidTo; // The date and time when the import token and public key expire. After this time, call GetParametersForImport again.
MemoryStream publicKey = response.PublicKey; // The public key to use to encrypt the key material before importing it.

            

The following example downloads a public key and import token to import an RSA private key. It uses a required RSA_AES wrapping algorithm and the largest supported private key.

To download the public key and import token for an RSA asymmetric KMS key

var client = new AmazonKeyManagementServiceClient();
var response = client.GetParametersForImport(new GetParametersForImportRequest 
{
    KeyId = "arn:aws:kms:us-east-2:111122223333:key/8888abcd-12ab-34cd-56ef-1234567890ab", // The identifier of the KMS key that will be associated with the imported key material. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
    WrappingAlgorithm = "RSA_AES_KEY_WRAP_SHA_256", // The algorithm that you will use to encrypt the key material before importing it.
    WrappingKeySpec = "RSA_4096" // The type of wrapping key (public key) to return in the response.
});

MemoryStream importToken = response.ImportToken; // The import token to send with a subsequent ImportKeyMaterial request.
string keyId = response.KeyId; // The ARN of the KMS key that will be associated with the imported key material.
DateTime parametersValidTo = response.ParametersValidTo; // The date and time when the import token and public key expire. After this time, call GetParametersForImport again.
MemoryStream publicKey = response.PublicKey; // The public key to use to encrypt the key material before importing it.

            

The following example downloads a public key and import token to import an ECC_NIST_P521 (secp521r1) private key. You cannot directly wrap this ECC key under an RSA_2048 public key, although you can use an RSA_2048 public key with an RSA_AES wrapping algorithm to wrap any supported key material. This example requests an RSA_3072 public key for use with the RSAES_OAEP_SHA_256.

To download the public key and import token for an elliptic curve (ECC) asymmetric KMS key

var client = new AmazonKeyManagementServiceClient();
var response = client.GetParametersForImport(new GetParametersForImportRequest 
{
    KeyId = "arn:aws:kms:us-east-2:111122223333:key/9876abcd-12ab-34cd-56ef-1234567890ab", // The identifier of the KMS key that will be associated with the imported key material. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
    WrappingAlgorithm = "RSAES_OAEP_SHA_256", // The algorithm that you will use to encrypt the key material before importing it.
    WrappingKeySpec = "RSA_3072" // The type of wrapping key (public key) to return in the response.
});

MemoryStream importToken = response.ImportToken; // The import token to send with a subsequent ImportKeyMaterial request.
string keyId = response.KeyId; // The ARN of the KMS key that will be associated with the imported key material.
DateTime parametersValidTo = response.ParametersValidTo; // The date and time when the import token and public key expire. After this time, call GetParametersForImport again.
MemoryStream publicKey = response.PublicKey; // The public key to use to encrypt the key material before importing it.

            

The following example downloads a public key and import token to import an HMAC key. It uses the RSAES_OAEP_SHA_256 wrapping algorithm and an RSA_4096 private key.

To download the public key and import token for an HMAC KMS key

var client = new AmazonKeyManagementServiceClient();
var response = client.GetParametersForImport(new GetParametersForImportRequest 
{
    KeyId = "2468abcd-12ab-34cd-56ef-1234567890ab", // The identifier of the KMS key that will be associated with the imported key material. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
    WrappingAlgorithm = "RSAES_OAEP_SHA_256", // The algorithm that you will use to encrypt the key material before importing it.
    WrappingKeySpec = "RSA_4096" // The type of wrapping key (public key) to return in the response.
});

MemoryStream importToken = response.ImportToken; // The import token to send with a subsequent ImportKeyMaterial request.
string keyId = response.KeyId; // The ARN of the KMS key that will be associated with the imported key material.
DateTime parametersValidTo = response.ParametersValidTo; // The date and time when the import token and public key expire. After this time, call GetParametersForImport again.
MemoryStream publicKey = response.PublicKey; // The public key to use to encrypt the key material before importing it.