Generate a PKCS #11 key in the nShield HSM

According to the AWS documentation, you must create keys in your HSM and map them to the external key store resource in KMS. These keys are used for data encryption with AWS services that support customer keys or within your applications. For more information, refer to https://aws.amazon.com/blogs/aws/announcing-aws-kms-external-key-store-xks/.

The key must be a 256-bit AES key that is enabled and capable of performing encryption and decryption. For more information, refer to https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html.

  1. On the AWS EC2 instance, run the following command. Note the key type and size used.

    For example:

    $ /opt/nfast/bin/generatekey pkcs11
module: Module to use? (1, 2) [1] > 1
protect: Protected by? (token, module) [token] > module
type: Key type? (DES3, DH, DHEx, DSA, HMACSHA1, HMACSHA256, HMACSHA384,
                 HMACSHA512, RSA, DES2, AES, Rijndael, ECDSA, ECDH, Ed25519,
                 Ed448, X25519, MLDSA, MLKEM, SLHDSA) [RSA] > AES
size: Key size? (bits, 128-256) [] > 256
plainname: Key name? [] > nshield-xks-hsm-key
nvram: Blob in NVRAM (needs ACS)? (yes/no) [no] > no
key generation parameters:
 operation    Operation to perform       generate
 application  Application                pkcs11
 module       Module to use              1
 protect      Protected by               module
 verify       Verify security of key     yes
 type         Key type                   AES
 size         Key size                   256
 plainname    Key name                   nshield-xks-hsm-key
 nvram        Blob in NVRAM (needs ACS)  no
Key successfully generated.
Path to key: /opt/nfast/kmdata/local/key_pkcs11_uab9d4256896a7dc8fad4966f9081bd873dab12262

  2. Verify that the key was generated using one of the following methods.

    nfkminfo
    $ /opt/nfast/bin/nfkminfo -l

Keys with module protection:
 key_pkcs11_uab9d4256896a7dc8fad4966f9081bd873dab12262 'nshield-xks-hsm-key'
    rocs
    $ rocs
`rocs' key recovery tool
Useful commands: `help', `help intro', `quit'.
rocs> list keys
  No. Name                App    Protected by
    1 nshield-xks-hsm-key pkcs11 module
rocs> quit