cmu importkey

This function unwraps an RSA, DSA , or ECDSA private key onto the selected token or HSM. The key file may be in any of the following formats:

>PKCS #12(PFX) RSA in a DER-encoded format (.pfx file)

>PKCS #8(Unencrypted PrivatekeyInfo) in RSA or DSA in base 64 PEM, or binary DER format

>PKCS #1 (RSA in base64 PEM, or binary DER) format

>ECDSA keys can be PKCS1, PKCS8, and PKCS12 format.

NOTE   PKCS#12 encrypted keys can be imported into the HSM from firmware 7.7.0 and Universal Client 10.3 onward.

Syntax

cmu importkey -in=<filename> -keyalg=<algorithm> [-wrapkey=<handle/OUID>] [-setkeyattr] [-PKCS8] [-PKCS12] [-password=<password>] [-ped=<PED_ID>] [-slot=<slot#>]

Argument(s) Description
-in=<filename> Defines the full path to the file containing the PEM- or DER-encoded key to import.
-keyalg=<algorithm>

Specifies the key's algorithm.

Valid values: DSA,RSA,ECDSA

-out=<filename> Defines the full path to the file containing the PEM- or DER-encoded key to import.
-PKCS8

Indicates that the key to import is formatted according to the PKCS#8 standard.

NOTE: cmu options are case-sensitive.

-PKCS12

Indicates that the key to import is formatted according to the PKCS#12 standard. Only the private key portion is unwrapped onto the token. Any certificates in this file are simply ignored. It is assumed that you properly export a PKCS #12 key from Windows keystore (or other source, as appropriate).

NOTE: cmu options are case-sensitive.

-setkeyattr Allows the user to manually enter the imported key’s attributes. Modifiable key attributes are CKA_DECRYPT, CKA_SIGN, CKA_EXTRACTABLE, and CKA_UNWRAP. The defaults are always 1=true.
-wrapkey=<handle/OUID>

The handle or OUID of the existing key that is to be used as the wrapping key. This key must have the CKA_WRAP attribute set to true. If this flag is not specified the default behavior is to auto-generate an AES key for the sole purpose of unwrapping the key onto the HSM.

NOTE   The OUID can be specified on a Luna Cloud HSM service slot only, and requires Luna HSM Client 10.2.0 or newer. On a Luna HSM slot, specify the key by its object handle.

Common
-password=<password> The password for the role accessing the current slot, with the current command.  If this is not specified, it is prompted.  
-ped=<PED_ID> Specifies the PED ID for the registered Remote PED that will handle authentication for the current slot, with the current command. You must specify this parameter to use Remote PED authentication.
-slot=<slot#> The slot to be acted upon, by the current command.  If this is not specified, it is prompted.  

Example

cmu importkey -in rawrsa1028.pem –keyalg RSA -wrapkey 11 –setkeyattr

cmu importkey –PKCS8 –in pk8privkey.pem –keyalg DSA

cmu importkey –in rsakey.pem –keyalg RSA –wrapkey 11

cmu importkey –in rsakey.pem –keyalg RSA

cmu importkey –PKCS12 –in p12.pfx –keyalg RSA 

cmu importkey -PKCS12 -in ec.pfx -keyalg ECDSA

NOTE   PKCS#12 encrypted keys can be imported into the HSM from firmware 7.7.0 and Universal Client 10.3 onward in non-FIPS mode (HSM policy 12 set to ON).

NOTE

1.Ideally, the private key should be in PKCS#8 format (privatekeyinfo) and not encrypted.

To convert a private key of either RSA or DSA type: (see PKCS#1 for RSA and PKCS#11 (11.9) for DSA) into a PKCS#8 structure, use the following openssl command

openssl pkcs8 -in key.pem –nocrypt -topk8 -out noenckey.pem

You are prompted for the password to decrypt the PrivateKeyInfo.

2. If the PKCS#8 structure is already encrypted according to the PKCS#5-PBE standard, then to import via CMU, use the following command

openssl pkcs8 -in pk8.pem -out key.pem

You are prompted for the password to decrypt the PrivateKeyInfo.

3.You can export the PrivatekeyInfo contents of a .pfx file by using the following openssl command

openssl pkcs12 –in p12.pfx –out pk12_privkey.pem –nocerts –nodes

You are prompted for the password to decrypt the PrivateKeyInfo.