--- title: "Export Key" slug: "fortanix-dsm-export-key" updated: 2026-04-01T08:01:06Z published: 2026-03-18T09:10:40Z canonical: "support.fortanix.com/fortanix-dsm-export-key" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Export Key ## 1.0 Introduction This article describes the **Fortanix-Data-Security-Manager (DSM) Export Key** feature. It also contains the information related to: - Export key as encrypted key material - Export key as clear key material - Export key as components ## 2.0 Export Key This section explains how you, as a group administrator, can export a key in Fortanix DSM, including the requirements for different key types and the available formats. > [!WARNING] > WARNING > > **EXPORT KEY** will be disabled: > > - If the key type is LMS or XMSS. > - If the key does not have the **Export** permission selected. ### 2.1 Export as Encrypted Key Material Fortanix DSM allows you to export a key **AS ENCRYPTED KEY MATERIAL** by selecting a wrapping key to encrypt it before export. This ensures that the exported key remains protected and can only be decrypted by an authorized entity with the correct wrapping key. > [!WARNING] > WARNING > > The export **AS ENCRYPTED KEY MATERIAL** will be disabled: > > - If Quorum approval policy is not set in the group. > - The wrapping key must have the **WrapKey** permission. It is assumed that: - A key with **Export** key permissions exists in the group. - The group, **Group1**, has the following Quorum approval policy configured: the members **Approver1** and **Approver2** form a quorum group, and 1 out of the 2 member’s approvals are required to approve an operation in the group. In the following example, - As a group administrator, you create an export key **AS ENCRYPTED KEY MATERIAL** request. - The goal is to export an AES key named **AES_Key** in **Group1** so that you can download the key. Perform the following steps to export a key: 1. Go to the detailed view of the created key, **AES_Key**. 2. Scroll to the end of the page and click **EXPORT KEY**. > [!NOTE] > NOTE > > **EXPORT KEY** is enabled only if the key type is AES, DES, DES3, HMAC, EC, ARIA, EC-KCDSA, KCDSA, SEED, BIP32, SLIP10, BLS, ML-KEM, ML-DSA and XMSS. However, the XMSS key can only be exported using the Fortanix REST API and is not exportable through the Fortanix DSM user interface (UI). 3. In the **EXPORT KEY** window, > [!NOTE] > NOTE > > Only AES keys can be used as wrapping keys. 1. Select **AS ENCRYPTED KEY MATERIAL**. 2. **Select Wrapping Key**: Select a key with the **WrayKey** permission to wrap (encrypt) the **AES_Key** before export. 1. **Cipher mode**: Select the cipher mode of encryption that should be applied to the key material. There are three types of encryption cipher modes to choose from: > [!NOTE] > NOTE > > A cipher mode of operation may not be available for selection based on the source and selected wrapping key combination. 1. **ECB (Electronic Codebook Mode)** – In this method, plain text is divided into blocks of size 64 bits each. Each such block is encrypted independently of other blocks. For all blocks, the same key is used for encryption. 2. **KW (Key Wrap Algorithm)** – In this method, symmetric encryption is used to encapsulate the key material. 3. **KWP (Key Wrap with Padding)** – In this method, additional padding of bits or bytes is appended to the encapsulated key material. 4. Click **SUBMIT EXPORT REQUEST** to submit the export request. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Export_Key_Landing_Screen(1).png) **Figure 1: Export key as encrypted key material** ### 2.2 Export as Clear Key Material Fortanix DSM allows you to export a key **AS CLEAR KEY MATERIAL** to export the keys in formats such as Hex, Base64, or Raw. It is assumed that: - A key with **Export** key permissions exists in the group. - The group, **Group2**, does not have a Quorum approval policy configured. In the following example, - As a group administrator, you create an export key **AS CLEAR KEY MATERIA**L request. - The goal is to export an RSA key named **RSA_Key** in **Group2** so that you can download the key. Perform the following steps to export a key: 1. Go to the detailed view of created key, **RSA_Key**. 2. Scroll to the end of the page and click **EXPORT KEY**. > [!NOTE] > NOTE > > **EXPORT KEY** is enabled only if the key type is RSA, DSA, or Secret. 3. In the **EXPORT KEY** window, 1. Select **AS CLEAR KEY MATERIAL**. 2. Select the format in which the key must be exported. The available options are **Hex**, **Base64**, and **Raw**. 4. Click **DOWNLOAD THE KEY** to download the key material in the format selected in *Step 3(b)*. > [!NOTE] > NOTE > > If a Quorum approval policy is set in the group and you export an RSA, DSA, or Secret key, it will still be exported **AS CLEAR KEY MATERIAL**. *To download the key, refer to* [*Section 2.3: Download the Key from Tasks Tab*](/v1/docs/users-guide-export-key#23-download-the-key-from-tasks-tab)*.* ### 2.3 Download the Key from Tasks Tab You can download the key material from the **Tasks** tab in Fortanix DSM UI. Perform the following steps to download the key material: 1. After the export key **AS ENCRYPTED KEY MATERIAL** or **AS CLEAR KEY MATERIAL** request is created, a quorum approval request is sent to the quorum members that form the group Quorum approval policy. 2. The approvers, **Approver1** and **Approver2**, receive a notification regarding the export request for the key. One of the approvers can either **APPROVE** or **DECLINE** the request from **TASKS** → **PENDING** → **Import/Export** tab or the DSM **Home** page in the Fortanix DSM UI. If at least one quorum member approves, the request is accepted. If an approver clicks **DECLINE**, the request is permanently rejected, and the key cannot be exported. Once the request is declined, it cannot be reapproved, even if other quorum members have approved it. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768859845661.png) **Figure 2: Approve export request** 3. After the quorum approval request is accepted, you can download the key material from **TASKS** → **COMPLETED** → **Import/Export** tab or the DSM **Home** page in the Fortanix DSM UI. 4. Click **DOWNLOAD THE KEY** to retrieve the key in the encrypted format. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768859858137.png) **Figure 3: Download the key** 5. Click **DOWNLOAD THE KEY** again to securely retrieve the key. 1. If you are exporting the key **AS CLEAR KEY MATERIAL**, the export key details include export format. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Export_Policy_RSA_Key(1).png) **Figure 4: RSA key details** 2. If you are exporting the key **AS ENCRYPTED KEY MATERIAL**, the export key details include: wrapping key used for encryption, Key Check Value (KCV), and export format. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Export_Policy_Download_Key_Box(1).png) **Figure 5: AES key details** 6. After the key is downloaded, a ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360082238652(9).png) tick mark appears in the **Download** column. ### 2.4 Export Key as Components The Export Key as Components feature allows a user to export a key as components to other users such that each user has a component of the key. To export a key as components: - A Key Custodian policy should be set at the group level. - A Quorum approval policy should exist for the group. - In the absence of the above policies, **EXPORT KEY** will be disabled. *For more information on exporting the key as a component feature, refer to the* [*User's Guide: Key Components*](/v1/docs/users-guide-key-components)*.* Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. ## Related - [Key Components](/fortanix-dsm-key-components.md) - [Sysadmin Settings - IP Policy](/fortanix-data-security-manager-sysadmin-settings-ip-policy.md) - [PKCS#11 Library](/fortanix-dsm-clients-pkcs11-library.md) - [Algorithm Support](/dsm-algorithm-support.md) - [Fortanix DSM with Nutanix](/fortanix-dsm-with-nutanix.md)