--- title: "Deriving Security Objects" slug: "dsm-deriving-security-objects" updated: 2025-07-23T03:15:57Z published: 2025-07-23T03:15:57Z canonical: "support.fortanix.com/dsm-deriving-security-objects" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Deriving Security Objects ## 1.0 Security Object Derivation Fortanix-Data-Security-Manager (DSM) can generate new keys by deriving them from existing keys and some additional data. Currently, the only supported mechanism for deriving keys is by encrypting some data with a key. ## 2.0 Prerequisites Generating new security objects (keys) using derivation requires a Fortanix DSM account, a group, a user or application configured in that group, and a key in that group. *For more information, refer to the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](/v1/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ## 3.0 Required Operations The key being used to derive the new key must have the `DeriveKey` operation enabled. ## 4.0 Authorization and Configuration You must first authenticate and optionally configure a default API client as described in [*Configure API Client and Client Authentication*](/v1/docs/configure-api-client-and-client-authentication). You must authenticate as an application. Users may not create new keys via derivation. ## 5.0 Create a SecurityObjectsApi Client Object Deriving keys is performed with a `SecurityObjectsApi` object. ```bash import com.fortanix.sdkms.v1.api.SecurityObjectsApi(); SecurityObjectsApi sobjectsApi = new SecurityObjectsApi(); ``` ## 6.0 Construct a DeriveKeyRequest Object A `DeriveKeyRequest` object contains information about how the new key material is to be derived, as well as the properties that the new key should have. The `customMetadata`, `description`, `enabled`, `keyOps`, `keySize`, `keyType`, and `name` properties of the `DeriveKeyRequest` object define the properties of the key that is to be created. These properties have the same meaning as the like-named properties in the `SobjectRequest` object, as described in [*Generating Security Objects*](/v1/docs/generating-security-objects). The mechanism property of the `DeriveKeyRequest` object is a `DeriveKeyMechanism` object that describes how the new key is to be generated. Currently, the only supported mechanism is encrypting data. The `encryptData` property of the `DeriveKeyMechanism` object is an `EncryptRequest` object that describes the data to be encrypted and how it is to be encrypted. Details of configuring `EncryptRequest` objects are in [*Public Key Cryptography*](/v1/docs/public-key-cryptography) or [*Symmetric Cryptography*](/v1/docs/symmetric-cryptography). ```bash import com.fortanix.sdkms.v1.model.DeriveKeyMechanism; import com.fortanix.sdkms.v1.model.DeriveKeyRequest; import com.fortanix.sdkms.v1.model.EncryptRequest; import com.fortanix.sdkms.v1.model.ObjectType; EncryptRequest encryptRequest = new EncryptRequest().alg(ObjectType.).mode().plain(); DeriveKeyMechanism mechanism = new DeriveKeyMechanism().encryptData(encryptRequest); DeriveKeyRequest deriveRequest = new DeriveKeyRequest().name("my new key").keyType(ObjectType.).keySize().mechanism(mechanism); ``` ## 7.0 Make the Derive Call The new key is derived using the `deriveKey()` method of a `SecurityObjectsApi()` object. The key used to perform the derivation and the derive key request are passed to this method. The new key object’s properties are returned. ```bash import com.fortanix.sdkms.v1.model.KeyObject; KeyObject derivedKey = sobjectsApi.deriveKey(, deriveRequest); ``` ## 8.0 HMAC-Based Key Derivation HMAC-based key derivation function (HKDF) is a new key derivation mechanism for the Fortanix DSM crypto API endpoint `/crypto/v1/derive`. This API has a `mechanism` field that will have a new variant `DeriveKeyMechanism::hkdf` HKDF gives a secret key as its output by extracting a strong pseudorandom key from the input provided to it. > [!NOTE] > NOTE > > HKDF is only applicable with input security object types `Secret` or `AES`. The following is the request payload (`PUT` API) to import a `SECRET` key with a `DERIVEKEY` permission. ```bash curl -k --location --request PUT 'https://qa1.sit.fortanix.net/crypto/v1/keys' \ --header 'Authorization: Bearer BecIP57dnV1rj8nlGEbxqMnKLA9s_Yf7uKN0hG9sCz-PG7OJ9BXnB8Ee5szHF-E9pUi13ZSvnjiGg0_CnFyQPg' \ --header 'Content-Type: application/json' \ --data-raw '{    "name": "test secret3",    "description": "",    "obj_type": "SECRET",    "key_ops": [        "APPMANAGEABLE",        "EXPORT",        "DERIVEKEY"    ],    "value": "", //base64 encoded value    "expirationDate": null,    "enabled": true,    "group_id": "aee400e1-a83c-4480-bf3f-179a67652329" }' ``` The following is the request payload (`POST` API) for deriving a key using HKDF mechanism: ```bash curl -k --location --request POST 'https://qa1.sit.fortanix.net/crypto/v1/derive' \ --header 'Authorization: Bearer BecIP57dnV1rj8nlGEbxqMnKLA9s_Yf7uKN0hG9sCz-PG7OJ9BXnB8Ee5szHF-E9pUi13ZSvnjiGg0_CnFyQPg' \ --header 'Content-Type: application/json' \ --data-raw '{    "key": {        "kid": "c8a17ea9-e335-4083-9a9f-f080bd50788e"    },    "key_type": "AES",    "key_size": 256,    "name": "testhkdf3",    "mechanism": {        "hkdf": {            "hash_alg": "SHA256",            "info": "RGF0YWJhc2UgRW5jcnlwdGlvbkRhdGFiYXNlIEVuY3J5cHRpb24="        }    },"transient": false,    "group_id": "aee400e1-a83c-4480-bf3f-179a67652329" }'     ``` The following is the request payload (`POST` API) for encrypting the derived HKDF key using encrypt_data mechanism. ```bash curl -k --location --request POST 'https://qa1.sit.fortanix.net/crypto/v1/keys/fc05122f-879f-49fd-8cbd-e47a64e2a91b/derive' \ --header 'Authorization: Basic OTgwNTI0MjktNWIwNi00YTNhLTg5NjktZWVkMTU5MjA2NWE2OjdxUlp5SnEwN0JiTldkMEVaZWdFZ0dxVlU4VktETjF3Wk9YUnYxR3ozVFV0Z0hFUnZHSngyNTFwZC1NU2Jjc2ZLalhJajY5M05GT0diZi05SkJtdnF3' \ --header 'Content-Type: application/json' \ --data-raw '{        "name": "testHKDF3",    "key_type": "AES",    "key_size": 128,    "mechanism": {        "encrypt_data": {            "alg": "AES",            "plain": "RGF0YWJhc2UgRW5jcnlwdERhdGFiYXNlIEVuY3J5cHQ=","mode": "ECB"        }    },    "group_id": "aee400e1-a83c-4480-bf3f-179a67652329" }' ``` Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. ## Related - [Exporting Fortanix DSM Keys to Cloud Providers for BYOK - Alibaba](/exporting-dsm-keys-to-cloud-providers-for-byok-alibaba.md) - [Wrapping a Key](/dsm-example-code-wrapping-a-key.md) - [Azure Key Vault Bring Your Own Key](/fortanix-dsm-azure-key-vault-byok-bring-your-own-key.md) - [Account Customization](/fortanix-dsm-account-customization.md)