Skip to main content

Transfer Target Key

To complete the key import, transfer the key transfer package (the .byok file) from your HSM Client (offline) computer to the Internet-connected computer.

Use the az keyvault key import command to upload the .byok file to the Key Vault HSM.

Example:

az keyvault key import --vault-name myKeyVaultHSM --name myPrimusByok --byok-file myPrimusRSA4k.byok
{
  "attributes": {
    "created": "2020-11-02T09:45:06+00:00",
    "enabled": true,
    "expires": null,
    "notBefore": null,
    "recoveryLevel": "Recoverable+Purgeable",
    "updated": "2020-11-02T09:45:06+00:00"
  },
  "key": {
    "crv": null,
    "d": null,
    "dp": null,
    "dq": null,
    "e": "AAEAAQ==",
    "k": null,
    "keyOps": [
      "encrypt",
      "decrypt",
      "sign",
      "verify",
      "wrapKey",
      "unwrapKey"
    ],
    "kid": "https://securosysprimuskeyvault.vault.azure.net/keys/SecurosysPrimusByokR4k/6c7eadd70c734e85928f58d60e83acd8",
    "kty": "RSA-HSM",
    "n": "zBnrPgwWrv9Q5y+/837rpWixWRgwTKy6pWRD9ba9HDA72ClbMqxzw/wpTbTioa187wu9jLa3sfACIycZDPYawF/DvaJfQQQdketG60gxDybqoBVBmmoHtbMjYDQMIFTcE0NEPRigL0FQNnKF0KC7zEVcPm7tVJL/FgX40TSiL6Sc
mYgOxqRICs3daSAW2Qg+hgfN4T5hSzKYji8cLHVGHCHI+7mdvwVdDevtWlL9nMQfoxbVIT+JFTOuUafz9TzqJpYLf2L2cUcXJJT/1H14xyhdsftP3HYgoQEzkdRBK/v/b9izafEFxKpkE82WBnHkADLjAaE6tKSfOFFNAaXNOj84rL4OwAcR7J
93WYNZRCBmXu/0tTFTwoiyxfMVK+hyUwyBeTyi/J5fmHS+vek84XKXxc+S9Zkw4EtyJwULopHwT58KUlEc9nVu+NNbJyxetx7ytSzVpKPp5Lf01EBwMQa+uZ4LpYaRAy3Rtw64Cvmq5yAFMAXOhtYA5yZ8xYjpy0Cldf+1k1SROThFFg5NQ4di
DpbSJJ1rvoO2Ub0Cy6t0z2X+S0yLFP91zn7bvmRg+z4pI5Tc+pKKYTlmFZbpnXuNqX7K8u3CMfildlRMfG9ELSImaR/mYrhy2kuUkkDzbHnETBfmjJOIhdVvNbd+7aB3VxsBGOzw1rGsP4C9qpc=",
    "p": null,
    "q": null,
    "qi": null,
    "t": null,
    "x": null,
    "y": null
  },
  "managed": null,
  "tags": null
}

If the upload is successful, Azure CLI displays the properties of the imported key. Alternatively, import can also be performed and controlled via Azure Portal.

Verify Imported Target Key​

Verify the existence of the imported target key with the command az keyvault key show.

Example:

az keyvault key show --vault-name SecurosysPrimusKeyVault --name SecurosysPrimusByokR4k
{
  "attributes": {
    "created": "2020-11-02T09:45:06+00:00",
    "enabled": true,
    "expires": null,
    "notBefore": null,
    "recoveryLevel": "Recoverable+Purgeable",
    "updated": "2020-11-02T09:45:06+00:00"
  },
  "key": {
    "crv": null,
    "d": null,
    "dp": null,
    "dq": null,
    "e": "AAEAAQ==",
    "k": null,
    "keyOps": [
      "encrypt",
      "decrypt",
      "sign",
      "verify",
      "wrapKey",
      "unwrapKey"
    ],
    "kid": "https://securosysprimuskeyvault.vault.azure.net/keys/SecurosysPrimusByokR4k/6c7eadd70c734e85928f58d60e83acd8",
    "kty": "RSA-HSM",
    "n": "zBnrPgwWrv9Q5y+/837rpWixWRgwTKy6pWRD9ba9HDA72ClbMqxzw/wpTbTioa187wu9jLa3sfACIycZDPYawF/DvaJfQQQdketG60gxDybqoBVBmmoHtbMjYDQMIFTcE0NEPRigL0FQNnKF0KC7zEVcPm7tVJL/FgX40TSiL6Sc
mYgOxqRICs3daSAW2Qg+hgfN4T5hSzKYji8cLHVGHCHI+7mdvwVdDevtWlL9nMQfoxbVIT+JFTOuUafz9TzqJpYLf2L2cUcXJJT/1H14xyhdsftP3HYgoQEzkdRBK/v/b9izafEFxKpkE82WBnHkADLjAaE6tKSfOFFNAaXNOj84rL4OwAcR7J
93WYNZRCBmXu/0tTFTwoiyxfMVK+hyUwyBeTyi/J5fmHS+vek84XKXxc+S9Zkw4EtyJwULopHwT58KUlEc9nVu+NNbJyxetx7ytSzVpKPp5Lf01EBwMQa+uZ4LpYaRAy3Rtw64Cvmq5yAFMAXOhtYA5yZ8xYjpy0Cldf+1k1SROThFFg5NQ4di
DpbSJJ1rvoO2Ub0Cy6t0z2X+S0yLFP91zn7bvmRg+z4pI5Tc+pKKYTlmFZbpnXuNqX7K8u3CMfildlRMfG9ELSImaR/mYrhy2kuUkkDzbHnETBfmjJOIhdVvNbd+7aB3VxsBGOzw1rGsP4C9qpc=",
    "p": null,
    "q": null,
    "qi": null,
    "t": null,
    "x": null,
    "y": null
  },
  "managed": null,
  "tags": null
}