Import personal RSA based private key to AWS CloudHSM

Hi,

It's definitely possible ,but it can be a bit of a process—though AWS provides tooling and documentation to walk you through it.

• How was your RSA key generated ( OpenSSL, .pem file, etc.)? This affects how the key can be extracted and formatted.

https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html

• Which AWS Region are you planning to use? Not all regions support CloudHSM, and feature availability can vary.

https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/

• Have you reviewed the limitations of Bring Your Own Key (BYOK) in AWS KMS vs CloudHSM? BYOK in KMS supports symmetric keys only, not RSA.

https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html

• Have you considered using AWS KMS with a custom key store (which integrates with CloudHSM)? as alternative? easier way if main goal is signing.

https://docs.aws.amazon.com/kms/latest/developerguide/overview.html

CloudHSM allows importing keys only in specific formats. Asymmetric key import (like RSA) is more involved and the key cannot be exported once inside the HSM.

Best

Thanks for you reply. Let's say I use a PEM file. I was trying to upload it directly to cloudhsm using cloudhsm-cli. I understood I have to wrap it before uploading using a public key(which I generated directly on cloudhsm using the cli) but when trying to wrap it Im getting:

Public Key operation error 808BD559487E0000:error:0200006E:rsa routines:ossl_rsa_padding_add_PKCS1_OAEP_mgf1_ex:data too large for key size:../crypto/rsa/rsa_oaep.c:87:

So your suggestion is to upload the private key to AWS KMS and then using CloudHSM for signing? will the same process work there?

hi,

So, alternative is helpful if you need to perform signing operations using KMS APIs for easier integration and open to re-generating the key and want CloudHSM-level protection. It does not support importing asymmetric RSA keys.

https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html

But if you need to import your own RSA private key (.pem) into CloudHSM, and the file is large, direct wrapping using RSA-OAEP in CloudHSM will likely fail due to RSA's size limitation for encryption.

Here's the full walkthrough using the PKCS#11 SDK, including sample code:

https://docs.aws.amazon.com/cloudhsm/latest/userguide/ki-pkcs11-sdk.html

Best,

Got it... So any alternative for me if I do need to use my own RSA private key?

to keep the RSA private key and still operate inside AWS infrastructure, the only supported way I am aware of:

Use CloudHSM and import the key using AES Key Wrap with Padding.

full AWS walkthrough with code:-

https://docs.aws.amazon.com/cloudhsm/latest/userguide/ki-pkcs11-sdk.html

hope this help

best

Following your recommendation, I've tried to do this in Java:

    Cipher wrapCipher = Cipher.getInstance("AESWrap/ECB/PKCS5Padding", CloudHsmProvider.PROVIDER_NAME);
    wrapCipher.init(Cipher.WRAP_MODE, wrappingKey);
    byte[] wrappedKey = wrapCipher.wrap(keyToWrap);

where the wrappingKey is the AES key created in cloundHSM and the keyToWrap is my RSA private key, but Im getting this error: "Non CloudHsm key is not supported for this cipher operation" What am I missing here?

Your goal is to use a personal 2048-bit RSA private key to sign proprietary software.

In your Java code, you’re using:

AESWrap/ECB/PKCS5Padding

But this isn’t supported by the AWS CloudHSM JCE provider.

supported mechanism:-

https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-lib-supported_5.html

Instead, you can consider:- aws doc shows a simpler upload path than AES + RSA wrap in Java — all done using CloudHSM CLI.

https://docs.aws.amazon.com/cloudhsm/latest/userguide/cloudhsm_cli-key-wrap-aes-pkcs5-pad.html

can you clarify

What format is your .pem file?

is it unencrypted? You can skip all AES wrapping in Java, You can use the cloudhsm-cli importKey --pem-format command directly

is it encrypted?

best