See below to wrap and export a key.

Generating a wrapping key

Generate an RSA 2048 key using OpenSSL. For example: 

$ openssl genrsa -out key.pem 2048

Extract the public key from the key you created, and list the key parts. For example: 

Where:

  • The public.pem public part of the key will wrap the key.
  • The key.pem private part will unwrap the key.

Downloading the key

Export the Base64 encoding of the target AES-256 key.

To download the key

  1. Log in to the Cryptographic Security Platform Vault for Cryptographic APIs web GUI.

  2. From the Home tab, select Manage > Keys.

  3. On the Manage Keys page, select the key you want to export, then select Actions > Export Key.

  4. On the Export Key page, complete the following: 

    Field

    Description

    Version

    Displays the key version number. Copy this value to the clipboard. This is the key GUID.

    Public Key

    Click Browse and import the public part (public.pem) of the RSA 2048 key that you created.

    Hashing Algorithm

    Select SHA256 or SHA1.

  5. Click Download Key.

Decoding the key

Base64 decode the wrapped AES key and save it in a file. For example: 

$ openssl enc -base64 -d <<< H2frvNvTUP+VyynwRYqo8+YEPRAgdioSyWtzYtJlQ1AqvxWW2B5EjEiJ8HxczMkxGKJPVjMJzKhYFkWgRhgWVDUQSroDLV4PMZvcwRQ33/Z05brjJk/3I7n2aqPKlwPwAtVLy2phT8DVa4j1ozcmDI5aLKUncrdz/iY/tuaEaFMyTHrHuLoo2jAONmyy2wJpi4tGeNoa+v+tKIzcmV9a9oE76Y7g9WHy35YDwryP2jzaK6NdMlBiABqnrdGaa9O1mIt8HTZNMawHX9IXP7amAww0gGb4AGvOragllxUw42/Eo2E7Nfo0JKElo2xn6NuKZ2TZRoMolTQZrDkEOrmoX6rBZb3d3HyiHlHFDbU0JPIt/O+0EwS9tQJoBunv7gISLE1rrcLStrI= >> decoded_wrapped_key
$ ls -lrt
-rw-r--r-- 1 user1 1049089 1732 Aug 6 15:16 key.pem
-rw-r--r-- 1 user1 1049089 460 Aug 6 15:18 public.pem
-rw-r--r-- 1 user1 1049089 296 Aug 6 16:01 decoded_wrapped_key

Splitting the key

Split the decoded key into two parts:

  • The temporary AES key
  • The target key

For example: 

$ dd if=decoded_wrapped_key of=wrapped_temp_aes_key bs=1 count=256
256+0 records in
256+0 records out
256 bytes copied, 0.0101148 s, 25.3 kB/s
 
$ dd if=decoded_wrapped_key of=wrapped_target_key bs=1 skip=256
40+0 records in
40+0 records out
40 bytes copied, 0.0025336 s, 15.8 kB/s
 
$ ls -lrt
-rw-r--r-- 1 user1 1049089 1732 Aug 6 15:16 key.pem
-rw-r--r-- 1 user1 1049089 460 Aug 6 15:18 public.pem
-rw-r--r-- 1 user1 1049089 296 Aug 6 16:01 decoded_wrapped_key
-rw-r--r-- 1 user1 1049089 256 Aug 6 16:04 wrapped_temp_aes_key
-rw-r--r-- 1 user1 1049089 40 Aug 6 16:04 wrapped_target_key

Unwrapping the temporary key

Unwrap the temp AES key using the private key. For example: 

$ openssl pkeyutl -decrypt -inkey key.pem -in wrapped_temp_aes_key -out temp_aes_key -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1
 
$ ls -lrt
-rw-r--r-- 1 bhavsac 1049089 1732 Aug 6 15:16 key.pem
-rw-r--r-- 1 bhavsac 1049089 460 Aug 6 15:18 public.pem
-rw-r--r-- 1 bhavsac 1049089 296 Aug 6 16:01 decoded_wrapped_key
-rw-r--r-- 1 bhavsac 1049089 256 Aug 6 16:04 wrapped_temp_aes_key
-rw-r--r-- 1 bhavsac 1049089 40 Aug 6 16:04 wrapped_target_key
-rw-r--r-- 1 bhavsac 1049089 32 Aug 6 16:06 temp_aes_key

Unwrapping the target key

Unwrap the target key using the temp AES key. The output is the unwrapped target key. If the target key is an AES key, then the output is Base64 encoded. For example: 

$ openssl enc -d -id-aes256-wrap-pad -iv A65959A6 -K $( hexdump -v -e '/1 "%02x"' < temp_aes_key ) -in wrapped_target_key | openssl enc -base64
0vEmbWIQnMAjP3gVJ0C4amnl+TWHymmW5ezQu5MDI+o=

Verifying the key

Verify the output using the Get Key Value API. For example: 

GET: <CSP-vault-IP>/token/1.0/key/<key-guid_of_target_key>/value/
Response
{
"result": "success",
"value": "0vEmbWIQnMAjP3gVJ0C4amnl+TWHymmW5ezQu5MDI+o="
}