Creating a KMS key wrapped by an HSM key

The —wrapping-key-id argument must specify the unique identifier of the HSM key to create a KMS key wrapped by an HSM key.

The user creating the key must be the HSM admin (see above) or have been granted the Encrypt operation on the HSM key.

For instance, the following command creates a 256-bit AES key wrapped by the HSM RSA (public) key hsm::4::my_rsa_key_pk:

> cosmian kms sym keys create --algorithm aes --number-of-bits 256 --sensitive \

  --wrapping-key-id hsm::4::my_rsa_key_pk my_sym_key

The symmetric key was successfully generated.

      Unique identifier: my_sym_key

The symmetric key is now stored in the database, encrypted (wrapped) by the HSM key. The encryption happened in the HSM.

The symmetric key can now be used to encrypt and decrypt data, and the KMS will transparently unwrap the key using the HSM key.

This unwrapping will happen once, and the unwrapped symmetric key will be cached in memory for later operations; no clear text symmetric key will be stored in the KMS database.