IBM Key Protect for IBM Cloud helps you provision encrypted keys for apps across IBM Cloud services. This tutorial shows you how to create and add existing cryptographic keys by using the Key Protect dashboard, so you can manage data encryption from one central location.

Getting started with encryption keys

From the Key Protect dashboard, we can create new keys for cryptography, or you can import your existing keys.

Choose from two key types:

Root keys

Root keys are symmetric key-wrapping keys that you fully manage in Key Protect. We can use a root key to protect other cryptographic keys with advanced encryption. To learn more, see Protecting data with envelope encryption.

Standard keys

Standard keys are symmetric keys that are used for cryptography. We can use a standard key to directly encrypt and decrypt data.




Creating new keys

After you create an instance of Key Protect, you're ready to designate keys in the service.

Complete the following steps to create your first cryptographic key.

1. On the application details page, click Manage > Add key.

2. To create a new key, select the Create a key window.

   Specify the key's details:

   Setting	Description
   Name	A human-readable alias for easy identification of your key. Length must be within 2 - 90 characters (inclusive). To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location.
   Key type	The type of key that you would like to manage in Key Protect.

3. When you are finished filling out the key's details, click Create key to confirm.

Keys that are created in the service are symmetric 256-bit keys, supported by the AES-CBC-PAD algorithm. For added security, keys are generated by FIPS 140-2 Level 3 certified hardware security modules (HSMs) that are located in secure IBM Cloud data centers.




Importing your own keys

We can enable the security benefits of Bring Your Own Key (BYOK) by introducing your existing keys to the service.

Complete the following steps to add an existing key.

1. On the application details page, click Manage > Add key.

2. To upload an existing key, select the Import your own key window.

   Specify the key's details:

   Setting	Description
   Name	A human-readable alias for easy identification of your key. Length must be within 2 - 90 characters (inclusive). To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location.
   Key type	The type of key that you would like to manage in Key Protect.
   Key material	The key material, such as a symmetric key, that you want to store in the Key Protect service. The key that you provide must be base64 encoded.

3. When you are finished filling out the key's details, click Import key to confirm.

From the Key Protect dashboard, you can inspect the general characteristics of your new keys.

We can programmatically enable an extra layer of protection to Bring Your Own Key (BYOK) by encrypting your key material before you import a key into Key Protect.

For more information about securely importing your keys, see Creating import tokens.




What's next

Now you can use your keys to code your apps and services. If you added a root key to the service, you might want to learn more about using the root key to protect the keys that encrypt your at-rest data. Check out Wrapping keys to get started.

• To find out more about managing and protecting your encryption keys with a root key, check out Protecting data with envelope encryption.

• To find out more about integrating the Key Protect service with other cloud data solutions, check out the Integrations doc.

• To find out more about programmatically managing your keys, check out the Key Protect API reference doc.