Getting started with OVHcloud Key Management Service (KMS)

View as Markdown

Discover the steps you need to take to set up your first Key Management Service (KMS), create a key, and authenticate to the data plane API

Objective

The purpose of this guide is to show you the steps you need to take to set up your first Key Management Service (KMS) and create a key. To call the regional data plane API, configure an authentication method as described in the OKMS authentication methods guide.

Requirements

An OVHcloud customer account.

OVHcloud Control Panel Access

Direct link:
Navigation path: Identity, Security & Operations > Key Management Service > Select your OKMS domain

Instructions

Ordering your KMS

Each KMS is associated with a region, so the keys stored in that region are guaranteed to stay in that region.
You can order multiple KMSs, either in different regions or in the same region.

Since the billing for a KMS is based on the number of keys stored on it, ordering a KMS does not generate billing per se.

Click the Order an OKMS domain button.

Enter the region of your KMS.

You can then finalize the command in another tab. If it has not opened automatically, the command link is displayed:

After a few seconds, the KMS will be available in your Control Panel.

OVHcloud Control Panel

OVHcloud API

Create an encryption key

In the Encryption keys tab, click the Create a Service Key button.

A form allows you to configure the key and select its type, size and usage.

Warning

Only key creation through regionalized APIs is covered by PCI-DSS certifications.

Once the key is created, click it to access its details.

The dashboard displays the cryptographic properties of the key, and the actions for renaming, disabling or deleting it.

To reduce the risks of an unwanted deletion, it is mandatory to disable a key before deleting it.

Warning

A deleted key is not recoverable by any means and such deletion involves the loss of any data encrypted with it. Any deletion should be performed with great caution.

Create an encryption key

You can create a key using the following API:

Method	Path	Description
POST	/okms/resource/{okmsId}/serviceKey	Create or import a CMK

The API expects the following values:

Field	Value	Description
name	string	Key name
context	string	Additional credential to verify key authenticity
type	oct, RSA, EC	Key type: Byte sequence (oct) for symmetric keys, RSA (RSA), Elliptic Curve (EC)
size	Integer	Key size - see lookup below
operations	Array	Key Usage - see lookup below
curve	P-256, P-384, P-521	(optional) Cryptographic curve for EC type keys

Example of symmetric key creation:

{
  "name": "My first AES key",
  "context": "project A",
  "type": "oct",
  "size": 256,
  "operations": [
    "encrypt",
    "decrypt"
  ]
}

Example of asymmetric key creation:

{
  "name": "My first RSA key",
  "context": "project A",
  "type": "RSA",
  "size": 4096,
  "operations": [
    "sign",
    "verify"
  ]
}

Example of EC key creation:

{
  "name": "My first EC key",
  "context": "project A",
  "type": "EC",
  "operations": [
    "sign",
    "verify"
  ],
  "curve": "P-256"
}

Depending on the key type, the possible sizes and operations are:

Oct:
- size: 128, 192, 256
- operations:
  - encrypt, decrypt
  - wrapKey, unwrapKey
RSA:
- size: 2048, 3072, 4096
- operations: sign, verify
EC:
- size: do not specify
- curve: P-256, P-384, P-521
- operations: sign, verify

Warning

Only key creation through regionalized APIs is covered by PCI-DSS certifications.

Authenticate to the OKMS data plane

Before calling the regional REST API, configure an authentication method (Personal Access Token, service account, or access certificate). See OKMS authentication methods.

For REST API usage, a PAT or service account is recommended. Prefer access certificates for KMIP integrations, which require certificate-based authentication.

Use the OVHcloud KMS

Once your OVHcloud KMS is set up, there are two different ways to use it:

Using the REST API to encrypt or sign your data (authenticate with a PAT, service account, or certificate).
Using the KMIP protocol to connect KMIP-compatible products (access certificate required).

Go further

OKMS authentication methods

Using the OVHcloud KMS with your data

Join our community of users.

Was this page helpful?