Azure BYOK Tutorial: Key Generation & Transfer

Learn how to generate and transfer keys using Securosys Hardware Security Modules (HSMs) for Azure Bring Your Own Key (BYOK) implementation, including key exchange key (KEK) generation and target key transfer.

📄️Generate Key Exchange Key

The KEK is an RSA key that’s generated in a Microsoft Key Vault HSM. The KEK is used to encrypt the key you

📄️Generate and Wrap Target Key

The target key to transfer needs to be created on your Primus HSM or Securosys CloudHSM with the flags ACCESSEXTRACTABLE (and ACCESSSENSITIVE) set.

📄️Transfer Target Key

To complete the key import, transfer the key transfer package (the .byok file) from your HSM Client (offline) computer to the Internet-connected computer.