AWS CloudHSM SDK5 Keystore aliases

When using the AWS CloudHSM SDK 5 to create a keystore from data in the HSM, the aliases of the resulting key entries are derived from the key labels of the HSM keys, but they are not exactly the same. The SDK creates aliases based on a specific convention that includes additional information.

Key Aliases in AWS CloudHSM SDK 5

When you load the keystore using the KeyStoreWithAttributes class, the aliases for the keys in the keystore are constructed using a specific format that combines the key label with other identifying information.

Here’s how the process generally works:

1. Key Labels: Each key in the HSM has a label, which is a human-readable identifier that you assign when creating or importing the key.

2. Key Aliases in Keystore: The SDK constructs the aliases for the keystore entries using a combination of the key label and possibly other attributes, ensuring that each alias uniquely identifies a key entry.

Example Workflow

1. Key Creation in HSM:

• When you create or import a key into the HSM, you assign it a label. For example, myKeyLabel.

2. Loading the Keystore:

• When you load the keystore using the SDK, it fetches the keys from the HSM.

KeyStoreWithAttributes keystore = KeyStoreWithAttributes.getInstance(CloudHsmProvider.PROVIDER_NAME);
keystore.load(null, null);

3. Constructing Aliases:

• The SDK constructs aliases for each key entry in the keystore. The exact format of these aliases can vary but typically includes the key label and other identifying attributes to ensure uniqueness. For example, the alias might be a combination of the key label and a unique identifier like the key handle.

Alias Format

The exact format of the alias depends on the SDK implementation. It might look something like:

alias = "label:keyLabel-<unique-identifier>"

where <unique-identifier> could be the key handle or another attribute that ensures the alias is unique within the keystore.

Verification and Customization

To verify the exact format used in your implementation, you can list the aliases after loading the keystore:

Enumeration<String> aliases = keystore.aliases();
while (aliases.hasMoreElements()) {
    String alias = aliases.nextElement();
    System.out.println("Alias: " + alias);
}

If the default alias format does not meet your needs, you might need to manage aliases explicitly within your application logic.

Summary

The aliases of key entries in the KeyStoreWithAttributes are derived from the key labels of the HSM keys. The SDK combines the key label with other identifying attributes to create unique aliases. You can inspect the aliases by enumerating them after loading the keystore to understand the exact format used by the SDK.

This approach ensures that each key entry in the keystore has a unique alias that reflects its origin in the HSM while accommodating any necessary distinguishing attributes.