How to generate a key pair in HSM - Key Management Service

Generates a Digital Signature Algorithm (DSA) key pair on an HSM.

Prerequisites

Before running this command, start key_mgmt_tool and log in to the HSM as a Crypto User (CU).

Syntax

genDSAKeyPair -m <modulus length>
              -l <label>
              [-id <key ID>]
              [-min_srv <minimum number of servers>]
              [-m_value <0..8>]
              [-nex]
              [-sess]
              [-timeout <number of seconds>]
              [-u <user-ids>]
              [-attest]

Important

Enter parameters in the order shown in the syntax.

Example

The following example generates a 2048-bit DSA key pair with the label DSA. The output shows that the public key handle is 10 and the private key handle is 11.

Command:  genDSAKeyPair -m 2048 -l DSA

        Cfm3GenerateKeyPair: returned: 0x00 : HSM Return: SUCCESS

        Cfm3GenerateKeyPair:    public key handle: 10    private key handle: 11

        Cluster Status:
        Node id 0 status: 0x00000000 : HSM Return: SUCCESS

Parameters

Parameter	Description	Required	Valid values
`-m`	The key size in bits.	Yes	2048
`-l`	The key label.	Yes	No special requirements
`-id`	The ID assigned to the generated key.	No	No special requirements
`-sess`	Marks the key as a session key for the current session.	No	No special requirements
`-nex`	Marks the key as non-exportable.	No	No special requirements
`-u`	The IDs of users authorized to share the key, separated by commas.	No	No special requirements
`-m_value`	The maximum number of users allowed to use the private key in the generated DSA key pair.	No	0 to 8
`-attest`	Runs a firmware integrity attestation check on the response.	No	No special requirements
`-min_srv`	The minimum number of servers that must be synchronized within the timeout period. If the key does not reach the required number of servers before the timeout, the key is not created.	No	No special requirements
`-timeout`	The synchronization timeout in seconds. The HSM waits until the key is synchronized to the number of servers specified by `-min_srv`. By default, there is no timeout and the command waits indefinitely. This parameter is only valid when used with `-min_srv`.	No	No special requirements