How to generate ECC keys on HSM - Key Management Service

Generates an ECC (Elliptic Curve Cryptography) key pair on a Hardware Security Module (HSM).

Prerequisites

Before running this command:

Start key_mgmt_tool.
Log on to the HSM with a CU identity.

Syntax

genECCKeyPair -i <EC curve id>
              -l <label>
              [-id <key ID>]
              [-min_srv <minimum number of servers>]
              [-m_value <0..8>]
              [-nex]
              [-sess]
              [-timeout <number of seconds>]
              [-u <user-ids>]
              [-attest]

Important

Enter parameters in the order shown in the syntax.

Example

The following example generates a key pair using the NID_secp384r1 curve (curve ID 14) with the label ecc. The output shows the public key handle as 12 and the private key handle as 13.

Command:   genECCKeyPair -i 14 -l ecc

           Cfm3GenerateKeyPair returned: 0x00 : HSM Return: SUCCESS

           Cfm3GenerateKeyPair:    public key handle: 12    private key handle: 13

           Cluster Status:
           Node id 0 status: 0x00000000 : HSM Return: SUCCESS

Parameters

Parameter	Description	Required	Valid values
`-i`	The curve ID.	Yes	1: NID_X9_62_prime192v1<br>2: NID_X9_62_prime256v1<br>3: NID_sect163k1<br>4: NID_sect163r2<br>5: NID_sect233k1<br>6: NID_sect233r1<br>7: NID_sect283k1<br>8: NID_sect283r1<br>9: NID_sect409k1<br>10: NID_sect409r1<br>11: NID_sect571k1<br>12: NID_sect571r1<br>13: NID_secp224r1<br>14: NID_secp384r1<br>15: NID_secp521r1<br>16: NID_secp256k1
`-l`	The key label.	Yes	No specific requirements
`-id`	The ID to assign to the generated key.	Optional	No specific requirements
`-sess`	Marks the key as a session key.	Optional	No specific requirements
`-nex`	Sets the key as non-exportable.	Optional	No specific requirements
`-u`	The IDs of users authorized to share the key, separated by commas.	Optional	No specific requirements
`-m_value`	The maximum number of users that can use the private key.	Optional	0 to 8
`-attest`	Runs firmware response integrity verification.	Optional	No specific requirements
`-min_srv`	The minimum number of servers the key must synchronize to within the time set by `-timeout`. If synchronization does not reach this threshold within the allotted time, the key is not created.	Optional	No specific requirements
`-timeout`	The time, in seconds, allowed for key synchronization to the number of servers specified by `-min_srv`. Only effective when used with `-min_srv`. Default: no timeout (waits indefinitely).	Optional	No specific requirements