Skip to main content

Downloading Public Key & Import Token

After creating a symmetric encryption AWS KMS key without key material it is necessary to download its public key and import token. Download both items in one step by using the AWS KMS console or the GetParametersForImport AWS API request. The public key that AWS KMS provides is a 2048-bit RSA public key that is unique to your AWS account.

note

The public key and import token are valid for only 24 hours. If you don't use them to import key material within 24 hours of downloading them, you must download new ones.

To protect the key material during import, it is paramount to encrypt it using the downloaded public key and a supported wrapping algorithm. AWS offers RSA PKCS #1 encryption with one of three padding options, while the Primus Tools only support RSAES_OAEP_SHA_256 and RSAES_OAEP_SHA_1. It is highly recommended to use the RSAES_OAEP_SHA_256 wrapping algorithm to wrap your key material.

The import token includes metadata that ensures that the key material is imported correctly. When uploading the en-crypted key material to AWS KMS, the same import token that was downloaded in this chapter must be uploaded.

It is always possible to download these items again. Usually reimporting the same key material into a KMS key is used to change the expiration time for the key material, or to restore expired or deleted key material.

To download the public key and import token, use the GetParametersForImport API request. Specify the KMS key that will be associated with the imported key material. This KMS key must have an Origin value of EXTERNAL.

Example command using the AWS CLI:

$ aws kms get-parameters-for-import \
	--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
	--wrapping-algorithm RSAES_OAEP_SHA_256 \
	--wrapping-key-spec RSA_2048
Parameterdescription
--key-idReplace 1234abcd-12ab-34cd-56ef-1234567890ab variable with the key ID of the KMS key for which to download the public key and import token.
--wrapping-algorithmSpecify the used wrapping algorithm as either RSAES_OAEP_SHA_1 with RSAES_OAEP_SHA_256
--wrapping-key-specSpecify the wrapping (public) key algorithm. Only 2048-bit RSA public keys are supported.

Example output:

{
	"ParametersValidTo": 1568290320.0,
	"PublicKey": "public key (base64 encoded)",
	"KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
	"ImportToken": "import token (base64 encoded)"
}