Azure Security Keyvault Keys Java

# Azure Key Vault Keys (Java)

Manage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.

Installation

```xml

<dependency>

<groupId>com.azure</groupId>

<artifactId>azure-security-keyvault-keys</artifactId>

<version>4.9.0</version>

</dependency>

```

Client Creation

```java

import com.azure.security.keyvault.keys.KeyClient;

import com.azure.security.keyvault.keys.KeyClientBuilder;

import com.azure.security.keyvault.keys.cryptography.CryptographyClient;

import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;

import com.azure.identity.DefaultAzureCredentialBuilder;

// Key management client

KeyClient keyClient = new KeyClientBuilder()

.vaultUrl("https://<vault-name>.vault.azure.net")

.credential(new DefaultAzureCredentialBuilder().build())

.buildClient();

// Async client

KeyAsyncClient keyAsyncClient = new KeyClientBuilder()

.vaultUrl("https://<vault-name>.vault.azure.net")

.credential(new DefaultAzureCredentialBuilder().build())

.buildAsyncClient();

// Cryptography client (for encrypt/decrypt/sign/verify)

CryptographyClient cryptoClient = new CryptographyClientBuilder()

.keyIdentifier("https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>")

.credential(new DefaultAzureCredentialBuilder().build())

.buildClient();

```

Key Types

| Type | Description |

|------|-------------|

| `RSA` | RSA key (2048, 3072, 4096 bits) |

| `RSA_HSM` | RSA key in HSM |

| `EC` | Elliptic Curve key |

| `EC_HSM` | Elliptic Curve key in HSM |

| `OCT` | Symmetric key (Managed HSM only) |

| `OCT_HSM` | Symmetric key in HSM |

Create Keys

Create RSA Key

```java

import com.azure.security.keyvault.keys.models.*;

// Simple RSA key

KeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key")

.setKeySize(2048));

System.out.println("Key name: " + rsaKey.getName());

System.out.println("Key ID: " + rsaKey.getId());

System.out.println("Key type: " + rsaKey.getKeyType());

// RSA key with options

KeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key-2")

.setKeySize(4096)

.setExpiresOn(OffsetDateTime.now().plusYears(1))

.setNotBefore(OffsetDateTime.now())

.setEnabled(true)

.setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT,

KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)

.setTags(Map.of("environment", "production")));

// HSM-backed RSA key

KeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-hsm-key")

.setKeySize(2048)

.setHardwareProtected(true));

```

Create EC Key

```java

// EC key with P-256 curve

KeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key")

.setCurveName(KeyCurveName.P_256));

// EC key with other curves

KeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-384")

.setCurveName(KeyCurveName.P_384));

KeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-521")

.setCurveName(KeyCurveName.P_521));

// HSM-backed EC key

KeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-hsm-key")

.setCurveName(KeyCurveName.P_256)

.setHardwareProtected(true));

```

Create Symmetric Key (Managed HSM only)

```java

KeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions("my-symmetric-key")

.setKeySize(256)

.setHardwareProtected(true));

```

Get Key

```java

// Get latest version

KeyVaultKey key = keyClient.getKey("my-key");

// Get specific version

KeyVaultKey keyVersion = keyClient.getKey("my-key", "<version-id>");

// Get only key properties (no key material)

KeyProperties keyProps = keyClient.getKey("my-key").getProperties();

```

Update Key Properties

```java

KeyVaultKey key = keyClient.getKey("my-key");

// Update properties

key.getProperties()

.setEnabled(false)

.setExpiresOn(OffsetDateTime.now().plusMonths(6))

.setTag