Using version 5 of the CloudHSM JCE, how do I ready a key's attributes or get it's key material

Question

I can retrieve keys from CloudHSM as shown below, but once I have them I can't read their attributes or key material. 
1. I can't find any docs describing how to read key attributes such as label
2. I'm not sure how to read the key material key.getEncoded returns null

Here is my current code:

```
KeyAttributesMap findSpec = new KeyAttributesMap(); // Empty findSpec should get all keys
KeyStoreWithAttributes keyStore = KeyStoreWithAttributes.getInstance(CloudHsmProvider.PROVIDER_NAME, provider);
keyStore.load(null, null);
List keys = keyStore.getKeys(findSpec);
System.out.println("Number of keys " + keys.size()); // 4
for (Key key : keys) {
    // How can I get the key attributes of `key`? For example how woudl I get the label?

// How can I get the key material, key.getEncoded() is always null, note that key.toString() does return a string
}
```

re:Post Agent · Accepted Answer

To read key attributes and key material using version 5 of the CloudHSM JCE provider, you'll need to consider a few important points:

1. Reading key attributes:
Unfortunately, there isn't a direct method to read key attributes like the label using the JCE provider. The KeyAttributesMap is primarily used for setting attributes during key generation or import, not for retrieving them afterwards. To get key attributes, you would typically need to use the CloudHSM CLI or other management tools.

2. Retrieving key material:
By default, the AWS CloudHSM JCE Provider doesn't allow extraction of key bytes in clear for private or secret keys. This is why key.getEncoded() is returning null. This is a security measure to protect sensitive key material.

However, if your use case requires it, you can enable extraction of key bytes in clear for private or secret keys under specific conditions:

a. The EXTRACTABLE attribute for the key must be set to true (which is the default).
b. The WRAP_WITH_TRUSTED attribute for the key must be set to false.

Keep in mind that allowing key extraction in clear text should only be done when absolutely necessary, as it can pose security risks.

If you need to work with the key material, it's generally recommended to use secure key wrapping and unwrapping mechanisms instead of extracting the raw key bytes.

For public keys, you should be able to use getEncoded() without any special configuration.

To modify your code to potentially extract key material (assuming the necessary attributes are set correctly):

```java
for (Key key : keys) {
    if (key instanceof PublicKey) {
        byte[] encodedKey = key.getEncoded();
        if (encodedKey != null) {
            System.out.println("Public key material: " + Base64.getEncoder().encodeToString(encodedKey));
        }
    } else if (key instanceof PrivateKey || key instanceof SecretKey) {
        // Be cautious with this part, as it may not work by default
        byte[] encodedKey = key.getEncoded();
        if (encodedKey != null) {
            System.out.println("Private/Secret key material: " + Base64.getEncoder().encodeToString(encodedKey));
        } else {
            System.out.println("Unable to extract key material (null)");
        }
    }
}
```

Remember, extracting key material, especially for private or secret keys, should be done with caution and only when absolutely necessary for your specific use case.  
**Sources**  
[Key extraction using JCE for AWS CloudHSM - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-lib-configs-getencoded.html)  
[Supported Java key attributes for AWS CloudHSM Client SDK 5 - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-lib-attributes_5.html)

Using version 5 of the CloudHSM JCE, how do I ready a key's attributes or get it's key material

Add your answer

Relevant content