Skip to main content Home Creators beko2210 firstbrain azure-security-keyvault-keys-java
azure-security-keyvault-keys-java Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/BEKO2210/Firstbrain --skill azure-security-keyvault-keys-javaThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... name azure-security-keyvault-keys-java description Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys. type skill created 2026-02-27T00:00:00.000Z domain cloud-infrastructure category azure risk unknown source community tags ["skill","cloud-infrastructure","azure","security","keyvault"]
Azure Key Vault Keys (Java)
Manage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.
Installation
<dependency >
<groupId > com.azure</groupId >
<artifactId > azure-security-keyvault-keys</artifactId >
<version > 4.9.0</version >
</dependency >
Client Creation
import com.azure.security.keyvault.keys.KeyClient;
import com.azure.security.keyvault.keys.KeyClientBuilder;
import com.azure.security.keyvault.keys.cryptography.CryptographyClient;
import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;
import com.azure.identity.DefaultAzureCredentialBuilder;
KeyClient keyClient = new KeyClientBuilder ()
.vaultUrl("https://<vault-name>.vault.azure.net" )
.credential(new DefaultAzureCredentialBuilder ().build())
.buildClient();
KeyAsyncClient keyAsyncClient = new KeyClientBuilder ()
.vaultUrl("https://<vault-name>.vault.azure.net" )
.credential(new DefaultAzureCredentialBuilder ().build())
.buildAsyncClient();
CryptographyClient cryptoClient
=
new
CryptographyClientBuilder
"https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>"
new
DefaultAzureCredentialBuilder
Key Types Type Description RSARSA key (2048, 3072, 4096 bits) RSA_HSMRSA key in HSM ECElliptic Curve key EC_HSMElliptic Curve key in HSM OCTSymmetric key (Managed HSM only) OCT_HSMSymmetric key in HSM
Create Keys
Create RSA Key import com.azure.security.keyvault.keys.models.*;
KeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions ("my-rsa-key" )
.setKeySize(2048 ));
System.out.println("Key name: " + rsaKey.getName());
System.out.println("Key ID: " + rsaKey.getId());
System.out.println("Key type: " + rsaKey.getKeyType());
KeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions ("my-rsa-key-2" )
.setKeySize(4096 )
.setExpiresOn(OffsetDateTime.now().plusYears(1 ))
.setNotBefore(OffsetDateTime.now())
.setEnabled(true )
.setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT,
KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)
.setTags(Map.of("environment" , "production" )));
KeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions ("my-hsm-key" )
.setKeySize(2048 )
.setHardwareProtected(true ));
Create EC Key
KeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions ("my-ec-key" )
.setCurveName(KeyCurveName.P_256));
KeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions ("my-ec-key-384" )
.setCurveName(KeyCurveName.P_384));
KeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions ("my-ec-key-521" )
.setCurveName(KeyCurveName.P_521));
KeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions ("my-ec-hsm-key" )
.setCurveName(KeyCurveName.P_256)
.setHardwareProtected(true ));
Create Symmetric Key (Managed HSM only) KeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions ("my-symmetric-key" )
.setKeySize(256 )
.setHardwareProtected(true ));
Get Key
KeyVaultKey key = keyClient.getKey("my-key" );
KeyVaultKey keyVersion = keyClient.getKey("my-key" , "<version-id>" );
KeyProperties keyProps = keyClient.getKey("my-key" ).getProperties();
Update Key Properties KeyVaultKey key = keyClient.getKey("my-key" );
key.getProperties()
.setEnabled(false )
.setExpiresOn(OffsetDateTime.now().plusMonths(6 ))
.setTags(Map.of("status" , "archived" ));
KeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),
KeyOperation.ENCRYPT, KeyOperation.DECRYPT);
List Keys import com.azure.core.util.paging.PagedIterable;
for (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {
System.out.println("Key: " + keyProps.getName());
System.out.println(" Enabled: " + keyProps.isEnabled());
System.out.println(" Created: " + keyProps.getCreatedOn());
}
for (KeyProperties version : keyClient.listPropertiesOfKeyVersions("my-key" )) {
System.out.println("Version: " + version.getVersion());
System.out.println("Created: " + version.getCreatedOn());
}
Delete Key import com.azure.core.util.polling.SyncPoller;
SyncPoller<DeletedKey, Void> deletePoller = keyClient.beginDeleteKey("my-key" );
DeletedKey deletedKey = deletePoller.poll().getValue();
System.out.println("Deleted: " + deletedKey.getDeletedOn());
deletePoller.waitForCompletion();
keyClient.purgeDeletedKey("my-key" );
SyncPoller<KeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey("my-key" );
recoverPoller.waitForCompletion();
Cryptographic Operations
Encrypt/Decrypt import com.azure.security.keyvault.keys.cryptography.models.*;
CryptographyClient cryptoClient = new CryptographyClientBuilder ()
.keyIdentifier("https://<vault>.vault.azure.net/keys/<key-name>" )
.credential(new DefaultAzureCredentialBuilder ().build())
.buildClient();
byte [] plaintext = "Hello, World!" .getBytes(StandardCharsets.UTF_8);
EncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);
byte [] ciphertext = encryptResult.getCipherText();
System.out.println("Ciphertext length: " + ciphertext.length);
DecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);
String decrypted = new String (decryptResult.getPlainText(), StandardCharsets.UTF_8);
System.out.println("Decrypted: " + decrypted);
Sign/Verify import java.security.MessageDigest;
byte [] data = "Data to sign" .getBytes(StandardCharsets.UTF_8);
MessageDigest md = MessageDigest.getInstance("SHA-256" );
byte [] digest = md.digest(data);
SignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);
byte [] signature = signResult.getSignature();
VerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);
System.out.println("Valid signature: " + verifyResult.isValid());
Wrap/Unwrap Key
byte [] keyToWrap = new byte [32 ];
new SecureRandom ().nextBytes(keyToWrap);
WrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);
byte [] wrappedKey = wrapResult.getEncryptedKey();
UnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);
byte [] unwrappedKey = unwrapResult.getKey();
Backup and Restore
byte [] backup = keyClient.backupKey("my-key" );
Files.write(Paths.get("key-backup.blob" ), backup);
byte [] backupData = Files.readAllBytes(Paths.get("key-backup.blob" ));
KeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);
Key Rotation
KeyVaultKey rotatedKey = keyClient.rotateKey("my-key" );
System.out.println("New version: " + rotatedKey.getProperties().getVersion());
KeyRotationPolicy policy = new KeyRotationPolicy ()
.setExpiresIn("P90D" )
.setLifetimeActions(Arrays.asList(
new KeyRotationLifetimeAction (KeyRotationPolicyAction.ROTATE)
.setTimeBeforeExpiry("P30D" )));
keyClient.updateKeyRotationPolicy("my-key" , policy);
KeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy("my-key" );
Import Key import com.azure.security.keyvault.keys.models.ImportKeyOptions;
import com.azure.security.keyvault.keys.models.JsonWebKey;
JsonWebKey jsonWebKey = new JsonWebKey ()
.setKeyType(KeyType.RSA)
.setN(modulus)
.setE(exponent)
.setD(privateExponent)
;
ImportKeyOptions importOptions = new ImportKeyOptions ("imported-key" , jsonWebKey)
.setHardwareProtected(false );
KeyVaultKey importedKey = keyClient.importKey(importOptions);
Encryption Algorithms Algorithm Key Type Description RSA1_5RSA RSAES-PKCS1-v1_5 RSA_OAEPRSA RSAES with OAEP (recommended) RSA_OAEP_256RSA RSAES with OAEP using SHA-256 A128GCMOCT AES-GCM 128-bit A256GCMOCT AES-GCM 256-bit A128CBCOCT AES-CBC 128-bit A256CBCOCT AES-CBC 256-bit
Signature Algorithms Algorithm Key Type Hash RS256RSA SHA-256 RS384RSA SHA-384 RS512RSA SHA-512 PS256RSA SHA-256 (PSS) ES256EC P-256 SHA-256 ES384EC P-384 SHA-384 ES512EC P-521 SHA-512
Error Handling import com.azure.core.exception.HttpResponseException;
import com.azure.core.exception.ResourceNotFoundException;
try {
KeyVaultKey key = keyClient.getKey("non-existent-key" );
} catch (ResourceNotFoundException e) {
System.out.println("Key not found: " + e.getMessage());
} catch (HttpResponseException e) {
System.out.println("HTTP error " + e.getResponse().getStatusCode());
System.out.println("Message: " + e.getMessage());
}
Environment Variables AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net
Best Practices
Use HSM Keys for Production - Set setHardwareProtected(true) for sensitive keysEnable Soft Delete - Protects against accidental deletionKey Rotation - Set up automatic rotation policiesLeast Privilege - Use separate keys for different operationsLocal Crypto When Possible - Use CryptographyClient with local key material to reduce round-trips
Trigger Phrases
"Key Vault keys Java", "cryptographic keys Java"
"encrypt decrypt Java", "sign verify Java"
"RSA key", "EC key", "HSM key"
"key rotation", "wrap unwrap key"
When to Use This skill is applicable to execute the workflow or actions described in the overview.
Connections
Domain: [[Cloud & Infrastruktur]]Kategorie: [[Microsoft Azure]]Navigation: [[Skills Uebersicht]], [[Home]] More from this repository
Related occupations SOC
Based on SOC occupation classification
