Creating root keys

Creating root keys in the console

After you create an instance of the service, complete the following steps to create a root key in the IBM Cloud console.

If you enable dual authorization settings for your Key Protect instance, keep in mind that any keys that you add to the service require an authorization from two users to delete keys.

1. Log in to the IBM Cloud console.

2. Go to Menu > Resource List to view a list of your resources.

3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.

4. To create a new key, click Add. A side panel will open. Make sure the Create a key option is selected. Note that to set a Key alias, Key Ring, or Rotation policy for this key, you must click the Advanced Options tab to reveal them.

If you are not a Manager (or have an equivalent level of permissions), the Rotation policy option does not appear.

Specify the key's details:

When you are finished filling out the key's details, click Create key to confirm.

If you know which key ring you want a key to be placed in, and you are a Manager of that key ring, you can also navigate to the Key rings panel, select ⋯ and click Add key to key ring. This will open the same panel you see by clicking Add on the Keys page with the Key rings variable filled in with the name of the key ring.

Keys that are created in the service are symmetric 256-bit keys, supported by the AES-CBC-PAD algorithm. For added security, keys are generated by FIPS 140-2 Level 3 certified hardware security modules (HSMs) that are located in secure IBM Cloud data centers.

Creating root keys with the API

Create a root key by making a POST call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys

1. Retrieve your authentication credentials to work with keys in the service.

2. Create a root key by running the following curl command.

   $ curl -X POST \
       "https://<region>.kms.cloud.ibm.com/api/v2/keys" \
       -H "authorization: Bearer <IAM_token>" \
       -H "bluemix-instance: <instance_ID>" \
       -H "content-type: application/vnd.ibm.kms.key+json" \
       -H "x-kms-key-ring: <key_ring_ID>" \
       -H "correlation-id: <correlation_ID>" \
       -d '{
               "metadata": {
                   "collectionType": "application/vnd.ibm.kms.key+json",
                   "collectionTotal": 1
               },
               "resources": [
                   {
                       "type": "application/vnd.ibm.kms.key+json",
                       "name": "<key_name>",
                       "aliases": [alias_list],
                       "description": "<key_description>",
                       "expirationDate": "<expiration_date>",
                       "extractable": <key_type>
                   }
               ]
           }'
   

   Replace the variables in the example request according to the following table.

To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service.

If the expirationDate is provided in your create key request, the key will transition to the deactivated state within one hour past the key's expiration date.

A successful POST api/v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Key Protect API.

{
    "metadata": {
        "collectionType": "application/vnd.ibm.kms.key+json",
        "collectionTotal": 1
    },
    "resources": [
        {
            "type": "application/vnd.ibm.kms.key+json",
            "id": "02fd6835-6001-4482-a892-13bd2085f75d",
            "name": "test-root-key",
            "aliases": [
                "alias-1",
                "alias-2"
              ],
            "description": "A test root key",
            "state": 1,
            "extractable": false,
            "crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
            "imported": false,
            "creationDate": "2020-03-12T03:37:32Z",
            "createdBy": "...",
            "algorithmType": "Deprecated",
            "algorithmMetadata": {
                "bitLength": "256",
                "mode": "Deprecated"
            },
            "algorithmBitSize": 256,
            "algorithmMode": "Deprecated",
            "lastUpdateDate": "2020-03-12T03:37:32Z",
            "keyVersion": {
                "id": "2291e4ae-a14c-4af9-88f0-27c0cb2739e2",
                "creationDate": "2020-03-12T03:37:32Z"
            },
            "dualAuthDelete": {
                "enabled": false
            },
            "deleted": false
        }
    ]
}

For a detailed description of the response parameters, see the Key Protect REST API reference doc.