---
title: "Wrapping a Key"
slug: "dsm-example-code-wrapping-a-key"
updated: 2026-06-09T15:19:23Z
published: 2026-06-09T15:19:23Z
canonical: "support.fortanix.com/dsm-example-code-wrapping-a-key"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wrapping a Key

This operation allows a Security-object to be encrypted by another key for export and transfer out of Fortanix-Data-Security-Manager (DSM) to other systems.

**Requirements:**

- The target key to be wrapped, need to be marked **Exportable**.
- The wrapping key needs to have **WRAPKEY** operation enabled.
- Symmetric keys (AES, DES, DES3), HMAC keys, Opaque objects, and Secret objects can be wrapped with other symmetric or asymmetric keys.
  - Note: Asymmetric Keys (RSA/DSA), cannot wrap keys/secrets with a size larger than the key size.
- Asymmetric keys (RSA/DSA) can be wrapped with symmetric keys (AES etc) only. Wrapping an asymmetric key with an asymmetric key is **not** supported.
- The wrapping parameters will follow the same guidelines as general Encryption operation by the wrapping key. *For more information, refer to* [*Encryption*](/v1/docs/encryption) *example.*

**C#**

```bash
public void wrapKey() {
    // kid of key being wrapped
    WrapKeyRequest wrapKeyRequest = new WrapKeyRequest
    {
        Alg = ObjectType.AES,
        Kid = kid,
        Mode = CryptMode.CBC
    };

    WrappingAndUnwrappingApi wrappingAndUnwrappingApi =
        new WrappingAndUnwrappingApi();

    // kid of wrapping key
    WrapKeyResponse wrapResponse =
        wrappingAndUnwrappingApi.WrapKey(kid, wrapKeyRequest);
}
```

**Go**

```bash
//Wrapping Key with an AES Key
wrapKeyReq := sdkms.WrapKeyRequest {
            Subject: sdkms.SobjectById(<Target Key UUID>),
            Alg: sdkms.AlgorithmAes,
            Key: sdkms.SobjectById(<Wrapping Key UUID>),
            Mode: sdkms.CryptModeSymmetric(sdkms.CipherModeCbc),
}
wrapKeyResp, err := client.Wrap(ctx, wrapKeyReq)
wrapKeyResp.WrappedKey //wrapped key bytes
```

**Java**

```bash
// Wrapping Key with an AES Key
WrapKeyRequest wrapKeyRequest = new WrapKeyRequest()
                  .alg(ObjectType.AES)
                  .kid(<Target Key UUID>)
                  .mode(CryptMode.CBC);
WrappingAndUnwrappingApi wrappingAndUnwrappingApi = new WrappingAndUnwrappingApi(apiClient);
WrapKeyResponse wrapKeyResponse = wrappingAndUnwrappingApi
            .wrapKey(<Wrapping Key UUID>, wrapKeyRequest);
wrapKeyResponse.wrappedKey // wrapped key bytes
```

**Python**

```bash
#Wrapping Key with an AES Key
api_instance = sdkms.v1.WrappingAndUnwrappingApi(api_client=client)

request = sdkms.v1.WrapKeyRequest(alg=ObjectType.AES, kid=<target Key UUID>, mode=CryptMode.CBC)
wrapping_response = api_instance
                     .wrap_key(<Wrapping Key UUID, request)
wrapping_response.wrapped_key #wrapped key bytes
```

**PHP**

```bash
public function wrapKey() {
    //  kid of key being wrapped
    $wrapKeyRequestBody = array('alg' => $objType::AES, 'mode' => $cryptMode::CBC, 'kid' => kid);
    $wrapKeyRequest = new Swagger\Client\Model\WrapKeyRequest($wrapKeyRequestBody);
    $wrappingAndUnwrappingApi = new Swagger\Client\Api\WrappingAndUnwrappingApi($client);
    // kid of wrapping key
    $wrapKeyResponse = $wrappingAndUnwrappingApi->wrapKey(kid, $wrapKeyRequest);
}
```

**Javascript**

```bash
var wrapKeyCallback = function(error, data, response) {
    if (error) {
        console.error("Error: " + JSON.stringify(response));
    } else {
        console.log('Key wrapped successfully. result: ' + JSON.stringify(data));
    }
};

//  kid of key being wrapped
var wrapKeyRequest = new FortanixSdkmsRestApi.WrapKeyRequest.constructFromObject({"alg": "AES", "kid": kid, "mode": "CBC"});
var wrappingAndUnwrappingApi = new FortanixSdkmsRestApi.WrappingAndUnwrappingApi();
// kid of wrapping key
wrappingAndUnwrappingApi.wrapKey(kid, wrapKeyRequest, wrapKeyCallback);
```

**REST API using curl**

```bash
$ curl <Endpoint URL>/crypto/v1/wrapkey -H 'Authorization: Bearer YhXwwa-6C...ig5g' -d '{"key": {"kid": "Wrapping-Key-UUID"}, "subject": {"kid": "Target Key UUID"}, "alg": "AES", "mode": "CBC"}'

{"wrapped_key": "YiBmaHViIGNpdXJl…ZyB1eXZpZyB2ZQoK", "iv" = "Y25lYm4gdmVidmllamJ2ZWlqYgo="}
```

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Key Operations](/fortanix-dsm-key-operations.md)
- [Fortanix DSM for Google Workspace Client-Side Encryption](/fortanix-dsm-for-google-workspace-client-side-encryption.md)
- [Google Cloud Platform Keyring KMS Bring Your Own Key](/fortanix-dsm-google-cloud-kms.md)
- [Fortanix DSM with Google Cloud EKM Interface](/fortanix-dsm-with-google-cloud-ekm-interface.md)
- [Creating a Security Object](/dsm-example-code-creating-a-security-object.md)