User's Guide: Copy Key

1.0 Introduction

This article describes the Fortanix-Data-Security-Manager (DSM) copy key operation that can be performed on a security object.

2.0 Copy Key

The Copy Key feature of Fortanix DSM will allow users to copy a security object from a standard Fortanix DSM group to another standard group.

This feature has the following advantages:

• It maintains a single source of key material by using/importing that key with other Fortanix DSM groups. This allows applications in respective groups to use a single key to meet some business objectives.

• It maintains a link to copies of the original key material for audit and tracking purposes.

The following actions will happen as part of the copy key operation:

• A new key will be created in the target group: The new key will have the same key material as the original key.

• The Source key links to the copied keys: A link will be maintained between all copied keys and the source key.

The Source key will also have basic metadata-based information about the linked keys, such as:

• Copied by <user-name/app id>

• Date of Copy <time stamp>

• Target copy group name

Perform the following steps to copy a key:

1. Go to the detailed view of a security object and click COPY KEY on the right of the screen.

   NOTE

   Fortanix DSM does not allow copying an LMS and XMSS keys.

   

2. In the COPY KEY window, you may update the name of the key by clicking the edit icon . Copy the new key to a group(s) from the Group section. To filter only HSM/External KMS groups, select the Import key to HSM/External KMS option.

   

3. Click EDIT PERMISSIONS if you want to modify the permissions of the key.

   

4. The Deactivation date of the security object can be set to 'Never' or to a specified time in the future. To specify the deactivation date, click EDIT.

5. Click CREATE COPY to create a copy of the key.

   NOTE

   If there is a Quorum approval policy configured in the source group that contains the original key, then a quorum approval request is created. Only after the request is approved, the copy key operation will be successful.

6. The source key will now appear as a key link in the KEY LINKS tab in the detailed view of the copied key.

   

3.0 Create New AES Key

Perform the following steps to create a new AES key with similar settings to the currently available key:

Perform the following steps:

1. Go to the detailed view of the AES key and click CREATE NEW AES KEY on the right of the screen.

   

2. On the Add New Security Object window, enter the name of the security object in the Security Object name field.

3. You can update the existing values in the sections as required.

4. After you have updated the values, click GENERATE at the bottom of the screen.

The new AES key is generated in Fortanix DSM.

Similarly, except for LMS and XMSS, you can copy other key types and create a new key of that type from the key detailed view.

4.0 Key Attestation

Fortanix DSM allows you to generate and download an attestation certificate of the asymmetric key managed in the DSM UI.

The following can be derived from a Fortanix DSM key attestation statement and certification:

• The security attributes of the Fortanix DSM cluster that houses the key, such as whether it operates on hardware with physical safeguards.

• The permissible uses of the key.

• Confirmation of whether the key was created within the DSM framework.

• Determination of whether the key has ever been made accessible externally.