Skip to main content

How to manage keys?

Security add-in for Microsoft 365​

With Securosys365 - DKE, you can manage HSM-protected keys directly from the Securosys365 - Cockpit.

In this guide, we will show you how to modify existing keys and explain the Double Key Encryption key lifecycle mechanisms.

Log in to the Securosys365 - DKE​

Securosys365 - DKE Key Management

Vaults​

A Vault is a logical connection to a Securosys CloudHSM KeyStore (Partition).
It provides a dedicated keystore space that only you can access — ensuring isolation, security, and full control over your cryptographic keys.

Learn more:

Key States​

The DKE-Key states follow the NIST SP 800-57 - Recommendation for Key Management, specifically Chapter 7: Key States and Transitions.

For detailed definitions, refer to Definitions - Key States.

Key States

Please carefully review the following diagram.
Important: Certain operations may permanently render the DKE-Key and any associated encrypted content inaccessible!

DKE Key States Diagram

Creating a Key​

To create a key, please follow the instructions under 1. Create Key and DKE Web Service.

Important Guidelines:

  • Only generate RSA 2048 keys.
  • Set the initial key state to either Pre-Active or Active if the key will be used for Double Key Encryption.
  • Ensure the following key attributes:
    • Usage: Decrypt
    • Enabled: True

Failure to configure these attributes correctly will prevent the key from being usable for decryption operations.

Blocking a Key (Usage)​

To block a key, click Actions next to the key you wish to block, then select Edit.

You have two options — choose carefully:

  • Temporarily block the key (the key can be unblocked later)
  • Permanently deactivate or compromise the key (the key cannot be unblocked later)

Temporarily Blocking a Key​

To temporarily prevent a key from being used for decryption operations, toggle the Enabled switch off.

Important:
Do not change the Key State to Deactivated or Compromised if you only intend a temporary block.

Permanently Deactivating a Key​

To permanently block a key from use, change its Key State to either:

  • Deactivated, or
  • Compromised

Note:
The key will not be deleted from the HSM — but once set to Deactivated or Compromised, it cannot be reactivated.

warning

This operation is permanent and cannot be undone.
Any DKE-encrypted documents relying on this key may become permanently inaccessible!

Deleting a Key​

To delete a key, click Actions next to the key you want to delete, then select Delete.

This will permanently remove the key from the HSM.

Important:
Only keys in the Active or Pre-Active state can be deleted.

Key Storage and Key Attestation​

Securosys CloudHSM provides the capability to cryptographically verify the origin of cryptographic keys, ensuring they were generated and securely stored within a Securosys HSM.

By default, the CloudHSM cluster used in Securosys365 is ECO-CH (located in Switzerland).
If a different cluster is required to meet geographic or jurisdictional requirements, please contact Securosys Support.

Within the Securosys365 Cockpit, under "Key" → "Get Attestation Files" and "Attestation Key", a key attestation can be generated and downloaded. The downloaded attestation files can be used to cryptographically prove key generation and critical key attributes, including:

  • Key generated inside the HSM
  • Key attributes marked as non-exportable

The attestation can be reviewed and validated by the customer or an independent auditor to confirm compliance with security and operational policies.

Need help?
Get started withCloudHSM for free.
Other questions?Ask Sales.
Last updated on
Feedback
Need help?