A CMK contains key metadata (key ID, key alias, description, key status, and creation date) and key materials used for encrypting and decrypting data.

When a CMK is created on the KMS console, the KMS system will automatically generate key materials for the CMK.
If you want to use your own key material, you can use the KMS console to create a CMK with an empty key material and import your own key material.

Precautions

If you select the external source for key materials, you need to focus on the following for BYOK:

Ensure that you use a random source that meets the security requirements to generate key materials;
When importing the key, you must be responsible for the reliability of your own key materials;
Save the original backup of key materials to re-import the backup key materials into KMS in time if the key materials are accidentally deleted.

Functional Characteristics of Importing Key Materials

Availability and Persistence

Before importing key materials into KMS, ensure the availability and durability of the key materials.

The following table shows the differences between imported key materials and those automatically generated when a key is created by KMS.

Source of Key Material	Description
Import a Key Material from External Sources	You can delete the key materials manually, but the CMK and its metadata are retained. When importing key materials,you can set the expiration time of the key materials. After the expiration of the key materials, KMS will automatically delete them,but the CMK and metadata will be retained. After the imported key materials are deleted, you can re-import the same key materials to make CMK available again.You need to back up the key materials, so that they can be re-imported when the key materials become invalid or are accidentally deleted.
Create a Key Material on KMS	You cannot delete the key materials manually, or set the expiration time of the key materials. Key materials can only be deleted with CMK after the scheduled deletion time of CMK is reached.

Source of Key Material

Description

Import a Key Material from External Sources

You can delete the key materials manually, but the CMK and its metadata are retained. When importing key materials,you can set the expiration time of the key materials. After the expiration of the key materials, KMS will automatically delete them,but the CMK and metadata will be retained. After the imported key materials are deleted, you can re-import the same key materials to make CMK available again.You need to back up the key materials, so that they can be re-imported when the key materials become invalid or are accidentally deleted.

Create a Key Material on KMS

You cannot delete the key materials manually, or set the expiration time of the key materials. Key materials can only be deleted with CMK after the scheduled deletion time of CMK is reached.

Relevance

When you import a key material into a CMK, the CMK is permanently associated with the key material, and other key materials cannot be imported into the CMK, even if the key material has expired or been deleted.

Independence

CMK is unique. Specifically, the data you encrypt with the CMK cannot be decrypted with other CMKs, even if these CMKs use the same key material.

Constraints

For AES_256 CMKs, you need to import a 256-bit symmetric key as the key material.
The import token obtained from KMS is bound with the public key of the encryption key material, and a token can only be used to import the key material for the CMK specified when it was generated. The import token is valid for 24 hours and can be repeatedly used within the validity period. After 24 hours, you must download a new import token and a new public key.

Operation Steps - Import a Key Material

Create a CMK, select External as the source of key material, and check "I understand the methods and significance of using external key materials";
Obtain the parameters for importing the key material.
1. In the key list, click **Key ID **to enter the Key Details page. In the key material area, click Obtain Import Parameter .
2. In the Obtain Import Key Material Parameters dialog box, select the public key type and encryption algorithm , and click OK .
  
  Configuration Item Description
Parameter Description

Public Key Type l Value: RSA_2048 (default)

Encryption Algorithm Value: RSAES_PKCS1_V1_5 RSAES_OAEP_SHA_1 RSAES_OAEP_SHA_256
1. In the Obtain Import Key Material Parameters dialog box, download the encryption public key and import token , then click OK .
Note : The import token has an expiration time. Please import it in time before the expiration.
1. Use OPENSSL to encrypt key materials.
The encryption public key is a 2048-bit RSA public key, and the encryption algorithm must be consistent with that specified when the system is obtaining import key material

parameters. The Base64-encoded encryption public key must be decoded by Base64 before you can use it. You can use OPENSSL to obtain encryption key materials in the following steps:
1. Create a key material and use OPENSSL to generate a random number.
2. Perform Base64 decoding of the encryption public key.
3. Encrypt the key material based on the specified encryption algorithm (for example, RSAES_OAEP_SHA_1).
4. Perform Base64 encoding of the encrypted key material and save it as a text file.
Sample Code:
```
openssl rand -out KeyMaterial.bin 32
openssl enc -d -base64 -A -in PublicKey_base64.txt -out PublicKey.bin
openssl rsautl -encrypt -in KeyMaterial.bin -oaep -inkey PublicKey.bin  -keyform DER  -pubin -out EncryptedKeyMaterial.bin
openssl enc -e -base64 -A -in EncryptedKeyMaterial.bin -out EncryptedKeyMaterial_base64.txt
```

Parameter	Description
Public Key Type	l Value: RSA_2048 (default)
Encryption Algorithm	Value: RSAES_PKCS1_V1_5 RSAES_OAEP_SHA_1 RSAES_OAEP_SHA_256

OpenSSL is used to encrypt key materials, and three key algorithms, namely RSAES_OAEP_SHA_256, RSAES_PKCS1_V1_5 and RSAES_OAEP_SH A_1, are supported. The following table shows an example of the OpenSSL code:

Key Algorithm	Example of code for generating key materials by OpenSSL encryption
RSAES_OAEP_SHA_256	openssl pkeyutl -in PlaintextKeyMaterial.bin -inkey PublicKey.bin -out EncryptedKeyMaterial.bin -keyform der -pubin –encrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256
RSAES_PKCS1_V1_5	openssl rsautl –encrypt -in PlaintextKeyMaterial.bin –pkcs -inkey PublicKey.bin -keyform der –pubin -out EncryptedKeyMaterial.bin
RSAES_OAEP_SHA_1	openssl rsautl -encrypt -in KeyMaterial.bin -oaep -inkey PublicKey.bin -keyform DER -pubin -out EncryptedKeyMaterial.bin

Import key materials.

1）In the key list, click the key ID to go to the Key Details page. In the Key Material area, click Import Key Material .

2）In the Import Key Material dialog box, upload the encryption key material and import token and click OK .

3）Set the expiration time of key materials, and click OK . After the key material is successfully imported, the key status is updated from Pending Import to Enabling .

Operation Steps-Delete a Key Material

Log in to the KMS console.
In the navigation bar at the top of the page, select the area where the key is located.
In the key list, click More to go to the Key Details page. In the Key Details area, click Delete Key Material .
In the Delete Key Material dialog box, click OK . After the key material is successfully deleted, the key status is changed from Enabling to Pending Import .

Key Management Service