
关于
用于加密密钥管理的 Azure Key Vault Keys Java SDK。适用于创建、管理或使用 RSA/EC 密钥,执行加密/解密/签名/验证操作,或使用 HSM 支持的密钥。
name: azure-security-keyvault-keys-java description: "Azure Key Vault 密钥 Java SDK,用于加密密钥管理。适用于创建、管理或使用 RSA/EC 密钥,执行加密/解密/签名/验证操作,或使用 HSM 支持的密钥。" risk: unknown source: community date_added: "2026-02-27"
Azure Key Vault 密钥(Java)
在 Azure Key Vault 和托管 HSM 中管理加密密钥并执行加密操作。
安装
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-security-keyvault-keys</artifactId>
<version>4.9.0</version>
</dependency>
创建客户端
import com.azure.security.keyvault.keys.KeyClient;
import com.azure.security.keyvault.keys.KeyClientBuilder;
import com.azure.security.keyvault.keys.cryptography.CryptographyClient;
import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;
import com.azure.identity.DefaultAzureCredentialBuilder;
// Key management client
KeyClient keyClient = new KeyClientBuilder()
.vaultUrl("https://<vault-name>.vault.azure.net")
.credential(new DefaultAzureCredentialBuilder().build())
.buildClient();
// Async client
KeyAsyncClient keyAsyncClient = new KeyClientBuilder()
.vaultUrl("https://<vault-name>.vault.azure.net")
.credential(new DefaultAzureCredentialBuilder().build())
.buildAsyncClient();
// Cryptography client (for encrypt/decrypt/sign/verify)
CryptographyClient cryptoClient = new CryptographyClientBuilder()
.keyIdentifier("https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>")
.credential(new DefaultAzureCredentialBuilder().build())
.buildClient();
密钥类型
| 类型 | 描述 |
|------|-------------|
| RSA | RSA 密钥(2048、3072、4096 位) |
| RSA_HSM | HSM 中的 RSA 密钥 |
| EC | 椭圆曲线密钥 |
| EC_HSM | HSM 中的椭圆曲线密钥 |
| OCT | 对称密钥(仅限托管 HSM) |
| OCT_HSM | HSM 中的对称密钥 |
创建密钥
创建 RSA 密钥
import com.azure.security.keyvault.keys.models.*;
// Simple RSA key
KeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key")
.setKeySize(2048));
System.out.println("Key name: " + rsaKey.getName());
System.out.println("Key ID: " + rsaKey.getId());
System.out.println("Key type: " + rsaKey.getKeyType());
// RSA key with options
KeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key-2")
.setKeySize(4096)
.setExpiresOn(OffsetDateTime.now().plusYears(1))
.setNotBefore(OffsetDateTime.now())
.setEnabled(true)
.setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT,
KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)
.setTags(Map.of("environment", "production")));
// HSM-backed RSA key
KeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-hsm-key")
.setKeySize(2048)
.setHardwareProtected(true));
创建 EC 密钥
// EC key with P-256 curve
KeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key")
.setCurveName(KeyCurveName.P_256));
// EC key with other curves
KeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-384")
.setCurveName(KeyCurveName.P_384));
KeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-521")
.setCurveName(KeyCurveName.P_521));
// HSM-backed EC key
KeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-hsm-key")
.setCurveName(KeyCurveName.P_256)
.setHardwareProtected(true));
创建对称密钥(仅限托管 HSM)
KeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions("my-symmetric-key")
.setKeySize(256)
.setHardwareProtected(true));
获取密钥
// Get latest version
KeyVaultKey key = keyClient.getKey("my-key");
// Get specific version
KeyVaultKey keyVersion = keyClient.getKey("my-key", "<version-id>");
// Get only key properties (no key material)
KeyProperties keyProps = keyClient.getKey("my-key").getProperties();
更新密钥属性
KeyVaultKey key = keyClient.getKey("my-key");
// Update properties
key.getProperties()
.setEnabled(false)
.setExpiresOn(OffsetDateTime.now().plusMonths(6))
.setTags(Map.of("status", "archived"));
KeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),
KeyOperation.ENCRYPT, KeyOperation.DECRYPT);
列出密钥
import com.azure.core.util.paging.PagedIterable;
// List all keys
for (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {
System.out.println("Key: " + keyProps.getName());
System.out.println(" Enabled: " + keyProps.isEnabled());
System.out.println(" Created: " + keyProps.getCreatedOn());
}
// List key versions
for (KeyProperties version : keyClient.listPropertiesOfKeyVersions("my-key")) {
System.out.println("Version: " + version.getVersion());
System.out.println(" Created: " + version.getCreatedOn());
}
兼容工具
Claude CodeCursor
标签
安全
