use hsm with key_mgmt_tool - Key Management Service - Alibaba Cloud Documentation Center

Prerequisites

The hsm_proxy HSM client must be running. For more information, see Start the HSM client (hsm_proxy).

Download key_mgmt_tool

key_mgmt_tool is bundled with hsm_mgmt_tool in a single installation package. For more information, see Download the installation package.

Start and exit the tool

To start key_mgmt_tool:

/opt/hsm/bin/key_mgmt_tool

To exit key_mgmt_tool:

Command: exit

Obtain help

Run the following command to display all available key_mgmt_tool commands:

Command: help

Run the following command to get help for a specific command:

Command: <command-name> -h

Command reference

The following table describes the key_mgmt_tool commands.

Command	Description
aesWrapUnwrap	Encrypts and decrypts key content in a file.
deleteKey	Removes a key from an HSM instance.
Error2String	Provides the corresponding hexadecimal error code from key_mgmt_tool.
exit	Exits the key_mgmt_tool.
exportPrivateKey	Exports a private key from an HSM instance to a disk file.
exportPubKey	Exports the public key from an HSM instance to a disk file.
exSymKey	Exports the plaintext of the symmetric key from an HSM instance to a file.
extractMaskedObject	Retrieves a key as a masked object file from an HSM instance.
findKey	Searches for keys using key attribute values.
findSingleKey	Checks whether keys exist on an HSM instance.
genDSAKeyPair	Creates a DSA (Digital Signature Algorithm) key pair in an HSM instance.
genECCKeyPair	Generates an Elliptic Curve Cryptography (ECC) key pair in an HSM instance.
genRSAKeyPair	Generates RSA asymmetric key pairs in an HSM instance.
genSymKey	Generates a symmetric key in an HSM instance.
getAttribute	Generates the key attribute values from an HSM instance and writes them to a file.
getCaviumPrivKey	Generates a private key in simulated PEM format and saves it to a file.
getCert	Retrieves the partition certificate of an HSM instance and saves it to a file.
getKeyInfo	Retrieves the IDs of HSM users who can use a key. For controlled keys, the number of controlled users is also returned.
importPrivateKey	Imports a private key into an HSM instance.
importPubKey	Imports a public key into an HSM instance.
imSymKey	Imports a symmetric key in plaintext from a file to an HSM instance.
insertMaskedObject	Inserts a masked object into an HSM instance from a disk file.
IsValidKeyHandlefile	Determines whether a file contains a real private key or a fake PEM key.
listAttributes	Lists the attributes of HSM keys and their constant representations.
listUsers	Retrieves user types, IDs, and other attributes within an HSM instance.
loginHSM and logoutHSM	Logs in to or logs out of an HSM instance.
setAttribute	Converts a session key into a permanent key.
sign	Generates a signature for a file using your private keys.
unWrapKey	Imports a wrapped (encrypted) key from a file into an HSM instance.
verify	Verifies whether a file is signed with the specified key.
wrapKey	Exports an encrypted copy of a key from an HSM instance to a file.