Managing Azure Keys

This section describes how to manage Azure keys on CCKM. Before proceeding, you must have an Azure key vault added to the CCKM. Refer to Managing Azure Vaults for details.

Adding Azure Keys

This section describes about the different types of keys and how to create/use these keys. CCKM allows you to:

• Create new local keys on the CipherTrust Manager. Refer to Uploading New Local Keys for details.

• Create new Azure native keys. The key material is created by Azure. Refer to Creating Azure Native Keys for details.

• Use existing local keys available on the CipherTrust Manager to create new keys. Refer to Uploading Existing Local Keys for details.

• Create new keys on Luna HSM. The key material is created by Luna HSM. Refer to Uploading New Luna HSM Keys for details.

• Use existing Luna HSM keys available on Luna HSM to create new keys. Refer to Uploading Existing Luna HSM Keys for details.

To add an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click Add Key. The Select Material Origin screen of the Add Azure Key wizard is displayed. Depending on your requirements, select from the following options:

   • Upload New Local Key

   • Create Azure Native Key

   • Upload Existing Local Key

   • Upload New Luna HSM Key

   • Upload Existing Luna HSM Key

Uploading New Local Keys

On the Select Material Origin screen:

1. Select Upload New Local Key. The CipherTrust Manager will create a new key material locally.

2. Click Next. The Create CipherTrust Key screen is displayed.

** Create CipherTrust Key**

1. Enter a Key Name.

2. Select the Key Size from the available options. The key size can be:

   • 2048

   • 3072

   • 4096

3. Click Create Key next to the Key Name field. A CipherTrust key is created and displayed on the screen.

4. Click Next. The Add Labels screen is displayed.

Add Labels

1. Select the desired Vault.

2. Enter a user-friendly alias as the Key Name. This helps in uniquely identify a key.

3. Select the Key Type.

   • For a standard vault, the key type is RSA.

   • For a premium vault, the key type can be RSA or RSA HSM.

4. Select the key Size. The options are 2048, 3072, and 4096.

   When creating a key or adding a new version by uploading an existing Luna HSM key, RSA HSM appears selected and is non-editable.

5. Select Key Attributes. The Key Attributes section contains the following details:

   • Set Activation Date

   • Set Expiration Date

6. Select the Enable Key check box.

7. Select the Key Operations. The supported operations are:

   • Encrypt

   • Decrypt

   • Sign

   • Verify

   • Wrap Key

   • Unwrap Key

8. Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.

   To add a tag:

   1. Specify a tag name.

   2. Specify the tag value.

   3. Click the + button.

   Similarly, you can add more tags.

9. Click Save.

A message Azure Key successfully created is displayed on the screen. The newly created key is displayed in the list of Azure keys.

The origin of the key is CCKM.

Set Activation Date

To configure the activation date:

1. Select the Set Activation Date check box.

2. From the on-screen calendar, select the date and time to activate the key.

Set Expiration Date

To configure the expiration date:

1. Select the Set Expiration Date check box.

2. From the on-screen calendar, select the key expiration date and time.

Creating Azure Native Keys

On the Select Material Origin screen:

1. Select Create Azure Native Key. The Azure will create a native key material.

2. Click Next. The Add Labels screen is displayed.

Add Labels

1. Select the desired Vault.

2. Enter a user-friendly alias as the Key name. This helps in uniquely identifying a key.

3. Select the Key Type.

   • For a standard vault, Elliptic Curve or RSA.

   • For a premium vault, Elliptic Curve, Elliptic Curve HSM, RSA, or RSA HSM.

4. (Applicable to RSA or RSA HSM key types) Select Size from the following options: 2048, 3072, and 4096.

5. (Applicable to Elliptic Curve or Elliptic Curve HSM key types) Select Curve from the following options: P-256, P-384, P-521, and SECP256K1.

6. Select Key Attributes. The Key Attributes section contains the following details:

   • Set Activation Date

   • Set Expiration Date

7. Select the Enable Key check box.

8. Select Key Operations from the available options.

   If the Key Type is RSA or RSA HSM, following operations are supported:

   • Encrypt

   • Decrypt

   • Sign

   • Verify

   • Wrap Key

   • Unwrap Key

   If the Key Type is Elliptic Curve or Elliptic Curve HSM, following operations are supported:

   • Sign

   • Verify

9. Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.

   To add a tag:

   1. Specify a tag name.

   2. Specify the tag value.

   3. Click the + button.

   Similarly, you can add more tags.

10. Click Save.

A message Azure Key successfully created is displayed on the screen. The newly created key is displayed in the list of Azure keys.

The origin of the key is Native.

Uploading Existing Local Keys

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click Add Key. The Select Material Origin screen of the Add Azure Key wizard is displayed.

Select Material Origin

1. Select Upload Existing Local Key. The already existing CipherTrust key material will be used.

2. Click Next. The Select CipherTrust Key screen is displayed.

Select CipherTrust Key

1. Select an existing CipherTrust key from the Key Name drop-down list.

2. Click Next. The Add Labels screen is displayed.

3. Add labels, as described in Add Labels.

4. Click Save.

A message Azure Key successfully created is displayed on the screen. The newly created key is displayed in the list of Azure keys.

The origin of the key is CCKM.

Uploading New Luna HSM Keys

To create a new Luna HSM key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click Add Key. The Select Material Origin screen of the Add Azure Key wizard is displayed.

Select Material Origin

1. Select Upload New Luna HSM Key. The new key material will be created in Luna HSM.

2. Click Next. The Create Luna HSM Key screen is displayed.

Create Luna HSM Key

1. Select the Partition ID of the desired Luna HSM.

2. Specify a Key Label.

3. Select the key Mechanism. The supported key mechanisms are:

   • CKM_RSA_FIPS_186_3_AUX_PRIME_KEY_PAIR_GEN

   • CKM_RSA_X9_31_KEY_PAIR_GEN

   • CKM_RSA_FIPS_186_3_PRIME_KEY_PAIR_GEN

   • CKM_RSA_PKCS_KEY_PAIR_GEN

4. Select the Key Size. The supported sizes are 2048, 3072, and 4096.

5. Select the Key Attributes. The options are:

   • Encrypt, Decrypt, Wrap, Unwrap

   • Sign, Verify, Derive

6. Create Create Key. The key creation starts.

   A message Create key is in progress. is displayed. The Key Name and Status are displayed on the Create Luna HSM Key screen.

7. Click Check Status to view the latest status. When the key is created successfully, the status becomes AVAIALBLE.

8. Click Next. The Add Labels screen is displayed.

9. Add labels, as described in Add Labels.

10. Click Save.

A message Azure Key successfully created is displayed on the screen. The newly created key is displayed in the list of Azure keys.

The origin of the key is External (Unknown).

Uploading Existing Luna HSM Keys

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click Add Key. The Select Material Origin screen of the Add Azure Key wizard is displayed.

Select Material Origin

1. Select Upload Existing Luna HSM Key. The key material of the selected Luna HSM key will be used to create the key.

2. Click Next. The Select Luna HSM Key screen is displayed.

Select Luna HSM Key

1. Select an existing Luna HSM key from the HSM Key Name drop-down list.

2. Click Next. The Add Labels screen is displayed.

3. Add labels, as described in Add Labels.

4. Click Save.

A message Azure Key successfully created is displayed on the screen. The newly created key is displayed in the list of Azure keys.

The origin of the key is External (Unknown).

Viewing Azure Keys

To view an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed. The Azure Keys page displays following details:

   Field	Description
   Key Name	Unique, user-friendly alias of the key. This is useful in searching for specific keys.
   Current Version	Current version of the key.
   Key Vault	Name of the Azure key vault.
   Region	Azure region where the key is created.
   Status	State of the key. The status can be: • Available • Soft Deleted • Deleted
   Algorithm	Name of the algorithm. Supported algorithms are: • EC • RSA • EC-HSM • RSA HSM
   Origin	Source of the key material. The origin of the key can be: • CCKM: Key material is created on CCKM. • Native: Key material is created on the cloud. • External (Unknown): Source of the key material is unknown. It is different than CCKM and the native cloud.
   Cloud	Name of the cloud. Supported clouds are: • Azure Cloud • Azure China Cloud • Azure German Cloud • Azure US Government
   Creation Date	Time when the key is created.

Sometimes, you might notice certain keys are displayed as grayed out. This happens when the keys are no longer accessible. For example, when:

• Any cloud permissions on the keys are changed. The keys are no longer accessible from the Azure connection.

• Connection is changed in KMS. The new connection does not have permissions to access the keys.

Editing Azure Keys

To view or edit an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click View/Edit.

4. Configure the KEY SCHEDULES. Refer to KEY SCHEDULES for details.

KEY SCHEDULES

To configure the key schedules, go to the KEY SCHEDULES section and select/enter the following details:

1. From the Select Rotation Schedule drop-down list, select a rotation schedule.

2. Select the key origin. The available options are CipherTrust, Native (Azure), or Luna.

   Click the desired tab to view the instructions.

   CipherTrust

   1. Select the Key Type. The available options are RSA and RSA-HSM.

   2. Select the Key Size. The available options are 2048, 3072, and 4096.

   Native (Azure)

   1. Select the Key Type. The available options are RSA, EC, RSA-HSM, and EC-HSM.

   2. select the Elliptical Curve Name. The available options are P-56, P-384, P-521, and SECP256K1.

   Luna

   1. Select the Partition.

   2. Select the Key Type. The available options are RSA and RSA-HSM.

   3. Select the Key Size. The available options are 2048, 3072, and 4096.

3. Select Enabled if you want to enable the rotated key.

4. Click Update.

A message Key schedule updated successfully is displayed on the screen.

Rotating Keys (Add Version)

To rotate Azure keys, CCKM Users require Add Key and Upload Key permissions.

To rotate a key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Rotate Now (Add Version). The Add New Version screen is displayed.

4. Select Key Material Origin. Depending on your requirements, select an appropriate option. Refer to the following sections for details:

   • Upload New Local Key

   • Create Azure Native Key

   • Upload Existing Local Key

   • Upload New Luna HSM Key

   • Upload Existing Luna HSM Key

A message Azure Key successfully rotated is displayed on the screen. Navigate to Cloud Keys > Azure > View/Edit > Versions to view the versions of the rotated Azure key.

Deleting Azure Keys

Non-soft-delete keys can be deleted directly from the Azure vaults using CCKM.

To delete an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Delete.

4. On the Confirm Delete screen, click Delete.

A confirmation message is displayed on the screen. The key status changes to DELETED.

Restoring Backup

To restore an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Restore Backup.

4. On the Confirm Restore Key screen, click Restore Key.

A message Key <key name> restored is displayed on the screen. The key status changes to AVAILABLE.

Deleting Backup

Deleting Backup permanently removes backup of a deleted Azure key from CCKM.

This operation can be performed only on the keys with DELETED status.

To delete backup of an Azure key from CCKM:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Delete Backup.

4. On the Hard Delete Azure Key screen, select the I wish to delete the backup of this key. check box.

5. Click Delete Key Backup.

A message Key <key name> backup deleted is displayed on the screen. The backup of the key is permanently deleted from CCKM.

Soft-Deleting Azure Keys

Soft deleting is the process of deleting Azure keys from the Azure vaults and CCKM. These keys still exist on CCKM and in the Azure vaults. The soft-deleted keys can be recovered.

To soft-delete an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Soft Delete. The Confirm Soft Delete dialog box is displayed.

4. Click Soft Delete.

A message key <key name> soft-deleted is displayed on the screen. The status of the key changes to SOFT-DELETED.

Recovering Soft-Deleted Azure Keys

To recover a soft-deleted Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Recover Soft Delete. The Confirm Recover Key dialog box is displayed.

4. Click Recover Key.

A message Key <key name> recovered from soft-delete is displayed on the screen. The status of the key changes to AVAILABLE.

Purging Azure Keys

Purging is the process of permanently deleting soft-deleted Azure keys from the Azure vaults. However, backup of the purged key can be restored on CCKM. If you wish to restore backup of the purged key, follow the steps mentioned in the Restoring Backup section.

To purge an Azure key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.

3. Click the overflow icon () corresponding to the desired alias and click Purge.

4. On the Purge Azure Key screen, select the I wish to purge this key. check box.

5. Click Purge Key.

A message key <key name> hard deleted is displayed on the screen. The status of the key changes to DELETED.