Skip to content

Import

Main menu option: Import

Imports keys and objects into the user's partition. Importation is always performed from a file on the workstation, or, in some cases, via manual user input.

Warning

Additional, specialized import methods are available in the HSM Operation menu under the options EFT and SPB options. See the topics EFT and SPB topics for more information.

Through the console interfaces, the following object types can be imported:

  1. Symmetric keys: DES, 3DES, and AES type keys.

  2. Asymmetric keys: RSA and ECC type keys.

  3. Other objects: certificates and chains.

The imported object follows the same rules for creating objects (see topic Generation).

The indication (local) always refers to a file name on the user's workstation and the indication (hsm) refers to an object name on the HSM partition.

Provided the authenticated user has permission to create objects in other partition(s), the operation can be executed by specifying the partition name and the object name using the following naming convention:

partition/object

When operating in restricted mode, the KEK RSA method is available for symmetric key (3DES and AES) import, and the PKCS#8 method with AES 256 encryption key derivation using a 16-character password is available for asymmetric key (RSA or ECC) import.

Attention

In KEK (Key Encryption Key) operations, the encryption key cannot be weaker than the transported key.

Symmetric Keys

Symmetric keys can be imported using the following methods:

  1. Protected by KEK, a key encryption key (Key Encryption Key).

    If the KEK is an RSA key, the expected enveloping method is the PKCS#1 version 2.1 standard, with the RSAES-OAEP encryption scheme. The user must possess in their partition the private key equivalent to the originating public key that sealed the envelope.

  2. In plaintext.

Asymmetric Keys

Asymmetric keys can be imported into the HSM using the following methods:

  1. Protected by KEK, a key encryption key (Key Encryption Key).

  2. PKCS#1; the RSA public and/or private key is imported in plaintext with DER encoding. For a private key, the file format must be the ASN.1 defined in the PKCS#1 v1.5 standard, section 7.1. For a public key, the file must contain the representation from section 7.2.

  3. PKCS#8; in this option, the private key (RSA or ECC/ECDSA) can be imported in plaintext or protected by a digital envelope. For details on the standards, refer to the Public-Key Cryptography Standards (PKCS) documents from RSA Labs.

    In restricted mode, RSA keys can only be imported via the PKCS#8 standard using a digital envelope, deriving an AES 256 key from a password of at least 01 character, with the derivation performed according to the PKCS#5 version 2.0 standard.

  4. PKCS#12file; the certificate and the corresponding private key contained in a PKCS#12 file (usually files with a .pfx or .p12 extension, protected by encryption derived from a password) into the HSM; the key and certificate are imported as independent objects, and can later be removed separately without interfering with each other. For details on the standards, see the RSA Labs Public-Key Cryptography Standards (PKCS) documents.

  5. Protected by public key whose equivalent private key exists in the user's partition.

Certificates, Chains, and Files

Under Other Objects, the following object types can be imported:

  1. Certificate: the specified file must be an X.509 certificate, such as an ICP-Brazil standard certificate;

  2. PKCS#7 standard certificate chains: the file indicated must be an X.509 certificate chain;

  3. File: objects that are opaque to the HSM, interpreted as just a sequence of bytes. The HSM will always try to identify the type of the imported object, so if the file indicated is, for example, an X.509 certificate, a CRL or a chain of valid PKCS#7 standard certificates (files in BASE64 or DER format), the HSM will identify the type and indicate the correct type in the object's attributes.

  4. PSKC Translate: the file indicated must be a PSKC(Portable Symmetric Key Container) file. This type of file is normally used for importing seeds OATH (for more details see the topic oath).

Import options
Dinamo - Remote Management Console v. 4.7.12.3 2018 (c) Dinamo Networks

HSM 127.0.0.1 e - Engine 5.0.22.0 (DXP) - TCA0000000  - ID master

Keys/Objects - Import



 1 - Symmetric Keys
 2 - Asymmetric Keys
 3 - Others













 0 - Main Menu

Option:

Asymmetric key import using PKCS#12 file

Import key and certificate from a .pfx file
Dinamo - Remote Management Console v. 4.7.12.3 2018 (c) Dinamo Networks

HSM 127.0.0.1 e - Engine 5.0.22.0 (DXP) - TCA0000000  - ID master

Keys/Objects - Import - Asymmetric Keys - PKCS#12

File (local) : lab.pfx
Private key password : ********
Exportable (y/[n]):
Private key name : labk
X.509 certificate name (HSM) : labc
Public key name (ENTER for none) : labpub

File loaded successfully.

Press ENTER key to continue...