DocsICP FilingConsole
官方文档
首页

Key attribute constants

更新时间：
复制 MD 格式
产品详情
我的收藏

hsm_mgmt_tool uses integer constants to identify key attributes in the HSM. Use listAttributes to list all attributes and their constants, and getAttribute to retrieve the attribute values for a specific key.

Key attribute constants

AttributeConstantValue
OBJ_ATTR_CLASS02: Public keys in a public-private key pair.
3: Private keys in a public-private key pair.
4: Private (symmetric) keys.

OBJ_ATTR_TOKEN10: False. Session keys.
1: True. Permanent keys.
OBJ_ATTR_PRIVATE20: False.
1: True. Indicates whether an unauthenticated user can list the attributes of the key. Because the CloudHSM PKCS#11 provider does not support public sessions, this attribute is set to 1 for all keys, including public keys in public-private key pairs.
OBJ_ATTR_LABEL3User-defined string. Does not have to be unique within the cluster.
OBJ_ATTR_TRUSTED1340: False.
1: True.
OBJ_ATTR_KEY_TYPE2560: RSA.
1: DSA.
3: EC.
16: Regular secret.
18: RC4.
21: Triple DES (3DES).
31: Advanced Encryption Standard (AES).





OBJ_ATTR_ID258User-defined string. Must be unique within the cluster. The default value is an empty string.
OBJ_ATTR_SENSITIVE2590: False. Public keys in a public-private key pair.
1: True.
OBJ_ATTR_ENCRYPT2600: False.
1: True. The key can be used to encrypt data.
OBJ_ATTR_DECRYPT2610: False.
1: True. The key can be used to decrypt data.
OBJ_ATTR_WRAP2620: False.
1: True. The key can be used to encrypt keys.
OBJ_ATTR_UNWRAP2630: False.
1: True. The key can be used to decrypt keys.
OBJ_ATTR_SIGN2640: False.
1: True. The key can be used for signing (private keys).
OBJ_ATTR_VERIFY2660: False.
1: True. The key can be used for verification (public keys).
OBJ_ATTR_DERIVE2680: False.
1: True. Derives keys.
OBJ_ATTR_MODULUS288Modulus used to generate RSA key pairs. For EC keys, this value is the DER encoding of the ANSI X9.62 ecPoint value Q in hexadecimal format. Does not exist for other key types.
OBJ_ATTR_MODULUS_BITS289Length of the modulus used to generate RSA key pairs. For EC keys, this value is the elliptic curve ID used to generate the key. Does not exist for other key types.
OBJ_ATTR_PUBLIC_EXPONENT290Public exponent used to generate RSA key pairs. Does not exist for other key types.
OBJ_ATTR_VALUE_LEN353Key length in bytes.
OBJ_ATTR_EXTRACTABLE3540: False.
1: True. The key can be exported from the HSM.
OBJ_ATTR_LOCAL3550: False. The key has been imported into the HSM.
1: True.
OBJ_ATTR_NEVER_EXTRACTABLE3560: False.
1: True. The key cannot be exported from the HSM.
OBJ_ATTR_ALWAYS_SENSITIVE3570: False.
1: True.
OBJ_ATTR_DESTROYABLE3700: False.
1: True.
OBJ_ATTR_KCV371Key Check Value. See Key Check Value (KCV).
OBJ_ATTR_ALL512Represents all properties.
OBJ_ATTR_WRAP_WITH_TRUSTED5280: False.
1: True.
OBJ_ATTR_UNWRAP_TEMPLATE1073742354The attribute template applied to any key unwrapped with this wrapping key.
OBJ_ATTR_WRAP_TEMPLATE1073742353The attribute template used to match the key wrapped with this wrapping key.

Key Check Value (KCV)

The Key Check Value (KCV) is a 3-byte hash of a key stored in the HSM. Calculate the KCV outside the HSM using the generation rules below and compare it with the value retrieved via getAttribute to verify the identity and integrity of the key.

KCV generation rules for Alibaba Cloud HSM:

  • Symmetric keys: Encrypt a zero-block (all zeros) with the key, then take the first 3 bytes of the resulting ciphertext.

  • Asymmetric key pairs: Take the first 3 bytes of the SHA-1 hash of the public key.

  • HMAC keys: KCV is not supported.

Previous：Permissions of HSM usersNext：Manage HSM instances and clusters