Managing External Keys

This section describes how to manage external keys on CCKM. Before proceeding, you must have an external vault added to the CCKM. Refer to Managing External Vaults for details.

• Adding External Keys

• Viewing or Editing Details of External Keys

• Adding a Key Version

• Blocking External Keys

• Unblocking External Keys

• Deleting External Keys

Adding External Keys

To add an external key.

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Oracle.

3. Click Add Key. The Key Material Origin screen of the Add Oracle Key wizard is displayed.

Key Material Origin

1. Select Oracle External (HYOK) as the Origin Type.

2. Select an external Vault from the drop-down list. The list shows available external and default vaults.

   The Oracle Compartment field is unavailable (read-only) for external vaults.

3. Select CipherTrust (Local) or Luna HSM as the Source.

   Note

   • You can select Luna HSM as the source, if the selected external vault is not CipherTrust.

   • FM-enabled Luna HSM is not supported as a key source.

   1. Click Next. The Source Key screen is displayed.

Source Key

1. Click the desired source for instructions.

   CipherTrust (Local)

   Select the Source Key Material. This specifies how to create the key. The options are:

   • Create New Key: Click to create a fresh key. Specify an Oracle Key Name.

   • Select Existing Key: Click to create a new key by selecting an existing key. Select an existing key from the Select a source key drop-down list.

   Luna HSM

   1. Select the Source Key Material, the options are Create New Key and Select Existing Key.

   2. Click the desired tab to view the instructions.

      Create New Key

      1. Create New Key: Click to create a fresh key.

      2. Select a Partition from the drop-down list.

      3. Enter the HSM Key Name.

      4. Update the Key Usage from the available options.

      Select Existing Key

      1. Select Existing Key: Click to create a new key by selecting an existing key.

      2. Select a Partition from the drop-down list.

      3. Select a HSM Key Name from the drop-down list.

2. Click Next. The Configure Oracle Key screen is displayed.

Configure Oracle Key

1. Enter a unique, user-friendly alias as the Oracle Key Name. This will be the key name on the Oracle cloud. This name helps uniquely identify an external key.

2. Enter a Rego policy to be associated with the external key.

3. Click Next. The Review and Add screen is displayed.

Review and Add

This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, Source Key, and HYOK KEY sections.

Before adding the key, review all details. After the key is added, certain features will no longer be editable.

1. Review the key details displayed on the screen.

   If details are incorrect or you want to make any changes, click Edit next to the Source Key and HYOK KEY sections and update the details. Alternatively, click Back and make changes, as appropriate.

2. Click Add Key.

   The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.

   When the status next to the HYOK KEY section becomes Complete and the Oracle Key ID link is displayed, the key is created successfully.

3. Click Close. The Add Oracle Key wizard is closed.

The newly created key is displayed in the list of Oracle keys.

Viewing or Editing Details of External Keys

After a key is created, you can add tags to it, schedule their rotation, and view its versions.

In the edit view of a key, you can view all the key details such as its ID, compartment, vault, state, algorithm, and region etc.

To view or edit an external key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Oracle. The list of available keys is displayed.

3. Click the overflow icon () corresponding to the desired key and click View/Edit Details. Alternatively, you can click the key name link. The edit view of the key is displayed. The edit view is divided into:

   • GENERAL INFO: View and update the key name and policy. Refer to Updating Key Name and Policy for details.

   • KEY SCHEDULE: Add, update, and disable a key rotation schedule. Refer to Adding or Changing Key Rotation Schedule and Disabling Key Rotation Schedule.

   • KEY VERSIONS: View details of key versions. Refer to Viewing Key Version Details.

Updating Key Name and Policy

To update the key name and policy.

1. Edit Key Name.

2. Edit Policy.

3. Click Update.

Adding or Changing Key Rotation Schedule

To add or update a key rotation schedule:

1. Expand the KEY SCHEDULE section.

2. From the Select Rotation Schedule drop-down list, select the desired schedule.

3. Select the Key Origin. The options are:

   • CipherTrust (Local)

   • Luna, also select the Luna HSM Partition. FM-enabled Luna HSM is not supported as a key source.

4. Click Update.

The key rotation schedule is added/updated. The selected schedule is now assigned to the key. To view all the keys assigned to a schedule, refer to Viewing Keys Assigned to Schedules.

Disabling Key Rotation Schedule

To disable a key rotation schedule:

1. Expand the KEY SCHEDULE section.

2. Next to the Select Rotation Schedule drop-down list, click the close icon ().

Auto key rotation is disabled.

Viewing Key Version Details

To view the details of key versions, expand the KEY VERSIONS section. The key version details are displayed.

Adding a Key Version

To add a new key version:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Oracle.

3. Click the overflow icon () corresponding to the desired key.

4. Click Add Version. The Add Version dialog box is displayed.

5. Select a Method, the options are Create New Key and Select Existing Key.

6. Click the desired tab to view the instructions.

   Create New Key

   1. Select a Source, the options are CipherTrust (Local) and Luna HSM.

   2. Click the desired tab to view the instructions.

      CipherTrust (Local)

      Enter Key Name.

      Luna HSM

      1. Select a Partition from the drop-down list.

      2. Enter the HSM Key Name.

      3. Select the Key Type from the available options. The supported key types are AES and RSA.

      4. Select the Key Size from the available options.

      5. Select the Key Usage from the available options.

   Select Existing Key

   1. Select a Source, the options are CipherTrust (Local) and Luna HSM.

   2. Click the desired tab to view the instructions.

      CipherTrust (Local)

      Select the desired Source Key from the drop-down list.

      Luna HSM

      1. Select the Key Type from the available options. The supported key types are AES and RSA.

      2. Select the Key Size from the available options.

      3. Enter the HSM Key Name.

   Note

   It is not recommended to delete a source key that is being used for cryptographic operations.

7. Click Add Version.

Blocking Oracle Keys

You can block a key that belongs to external vaults. To block a key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Oracle.

3. Click the overflow icon () corresponding to the desired key.

4. Click Block. The Block Key dialog box is displayed.

5. Click Block Key to confirm the action.

The key is blocked. The state of the external key changes to Blocked.

Unblocking Oracle Keys

You can unblock a blocked key that belongs to external vaults. To unblock a key:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Oracle.

3. Click the overflow icon () corresponding to the desired key.

4. Click Unblock. The Unblock Key dialog box is displayed.

5. Click Unblock Key to confirm the action.

The key is unblocked. The state of the external key changes to Unblocked.

Deleting External Keys

An external key (HYOK) resides on the CipherTrust Manager, it does not require a deletion schedule. The key can be deleted directly from the CipherTrust Manager.

To delete an external key from the CipherTrust Manager:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Oracle.

3. Click the overflow icon () corresponding to the key to be deleted.

4. Click Remove Key. The Remove Key dialog box is displayed.

5. Click Remove Key to confirm the action.

A message stating that the key is removed successfully is displayed.