[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CS7G9MK84DF6KR1K8ASKB6":3,"skill-same:01M6CS7G9MK84DF6KR1K8ASKB6":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":45,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6CS7G9MK84DF6KR1K8ASKB6","azure-security-keyvault-keys-java",null,"Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA\u002FEC keys, performing encrypt\u002Fdecrypt\u002Fsign\u002Fverify operations, or working with HSM-backed keys.","Sam-06060\u002Fjarvis-assistant","Sam-06060","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F208600848?v=4","01M6CRKT7C7FXD21V6HXF293S0","Samson Frank Ganta","01M6CRKTBEKYFD8YX5Z1GT99EE",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fazure-security-keyvault-keys-java\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"security","azure","azure security keyvault keys java","java","sdk","encrypt","hsm","rsa","vault","verify","management","operations","use","community","azure key vault","2026-11-10 10:12:30",false,"---\nname: azure-security-keyvault-keys-java\ndescription: \"Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA\u002FEC keys, performing encrypt\u002Fdecrypt\u002Fsign\u002Fverify operations, or working with HSM-backed keys.\"\nrisk: unknown\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# Azure Key Vault Keys (Java)\n\nManage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-keys\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.security.keyvault.keys.KeyClient;\nimport com.azure.security.keyvault.keys.KeyClientBuilder;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClient;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Key management client\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\n\u002F\u002F Async client\nKeyAsyncClient keyAsyncClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Cryptography client (for encrypt\u002Fdecrypt\u002Fsign\u002Fverify)\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\u002F\u003Ckey-version>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n```\n\n## Key Types\n\n| Type | Description |\n|------|-------------|\n| `RSA` | RSA key (2048, 3072, 4096 bits) |\n| `RSA_HSM` | RSA key in HSM |\n| `EC` | Elliptic Curve key |\n| `EC_HSM` | Elliptic Curve key in HSM |\n| `OCT` | Symmetric key (Managed HSM only) |\n| `OCT_HSM` | Symmetric key in HSM |\n\n## Create Keys\n\n### Create RSA Key\n\n```java\nimport com.azure.security.keyvault.keys.models.*;\n\n\u002F\u002F Simple RSA key\nKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key\")\n    .setKeySize(2048));\n\nSystem.out.println(\"Key name: \" + rsaKey.getName());\nSystem.out.println(\"Key ID: \" + rsaKey.getId());\nSystem.out.println(\"Key type: \" + rsaKey.getKeyType());\n\n\u002F\u002F RSA key with options\nKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key-2\")\n    .setKeySize(4096)\n    .setExpiresOn(OffsetDateTime.now().plusYears(1))\n    .setNotBefore(OffsetDateTime.now())\n    .setEnabled(true)\n    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT, \n                       KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)\n    .setTags(Map.of(\"environment\", \"production\")));\n\n\u002F\u002F HSM-backed RSA key\nKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-hsm-key\")\n    .setKeySize(2048)\n    .setHardwareProtected(true));\n```\n\n### Create EC Key\n\n```java\n\u002F\u002F EC key with P-256 curve\nKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key\")\n    .setCurveName(KeyCurveName.P_256));\n\n\u002F\u002F EC key with other curves\nKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-384\")\n    .setCurveName(KeyCurveName.P_384));\n\nKeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-521\")\n    .setCurveName(KeyCurveName.P_521));\n\n\u002F\u002F HSM-backed EC key\nKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-hsm-key\")\n    .setCurveName(KeyCurveName.P_256)\n    .setHardwareProtected(true));\n```\n\n### Create Symmetric Key (Managed HSM only)\n\n```java\nKeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions(\"my-symmetric-key\")\n    .setKeySize(256)\n    .setHardwareProtected(true));\n```\n\n## Get Key\n\n```java\n\u002F\u002F Get latest version\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = keyClient.getKey(\"my-key\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only key properties (no key material)\nKeyProperties keyProps = keyClient.getKey(\"my-key\").getProperties();\n```\n\n## Update Key Properties\n\n```java\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Update properties\nkey.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"archived\"));\n\nKeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),\n    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);\n```\n\n## List Keys\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\n\n\u002F\u002F List all keys\nfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {\n    System.out.println(\"Key: \" + keyProps.getName());\n    System.out.println(\"  Enabled: \" + keyProps.isEnabled());\n    System.out.println(\"  Created: \" + keyProps.getCreatedOn());\n}\n\n\u002F\u002F List key versions\nfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions(\"my-key\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n}\n```\n\n## Delete Key\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\n\n\u002F\u002F Begin delete (soft-delete enabled vaults)\nSyncPoller\u003CDeletedKey, Void> deletePoller = keyClient.beginDeleteKey(\"my-key\");\n\n\u002F\u002F Wait for deletion\nDeletedKey deletedKey = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted: \" + deletedKey.getDeletedOn());\n\ndeletePoller.waitForCompletion();\n\n\u002F\u002F Purge deleted key (permanent deletion)\nkeyClient.purgeDeletedKey(\"my-key\");\n\n\u002F\u002F Recover deleted key\nSyncPoller\u003CKeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey(\"my-key\");\nrecoverPoller.waitForCompletion();\n```\n\n## Cryptographic Operations\n\n### Encrypt\u002FDecrypt\n\n```java\nimport com.azure.security.keyvault.keys.cryptography.models.*;\n\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\nbyte[] plaintext = \"Hello, World!\".getBytes(StandardCharsets.UTF_8);\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);\nbyte[] ciphertext = encryptResult.getCipherText();\nSystem.out.println(\"Ciphertext length: \" + ciphertext.length);\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);\nString decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);\nSystem.out.println(\"Decrypted: \" + decrypted);\n```\n\n### Sign\u002FVerify\n\n```java\nimport java.security.MessageDigest;\n\n\u002F\u002F Create digest of data\nbyte[] data = \"Data to sign\".getBytes(StandardCharsets.UTF_8);\nMessageDigest md = MessageDigest.getInstance(\"SHA-256\");\nbyte[] digest = md.digest(data);\n\n\u002F\u002F Sign\nSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);\nbyte[] signature = signResult.getSignature();\n\n\u002F\u002F Verify\nVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);\nSystem.out.println(\"Valid signature: \" + verifyResult.isValid());\n```\n\n### Wrap\u002FUnwrap Key\n\n```java\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32];  \u002F\u002F 256-bit key\nnew SecureRandom().nextBytes(keyToWrap);\n\n\u002F\u002F Wrap\nWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);\nbyte[] wrappedKey = wrapResult.getEncryptedKey();\n\n\u002F\u002F Unwrap\nUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);\nbyte[] unwrappedKey = unwrapResult.getKey();\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup\nbyte[] backup = keyClient.backupKey(\"my-key\");\n\n\u002F\u002F Save backup to file\nFiles.write(Paths.get(\"key-backup.blob\"), backup);\n\n\u002F\u002F Restore\nbyte[] backupData = Files.readAllBytes(Paths.get(\"key-backup.blob\"));\nKeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);\n```\n\n## Key Rotation\n\n```java\n\u002F\u002F Rotate to new version\nKeyVaultKey rotatedKey = keyClient.rotateKey(\"my-key\");\nSystem.out.println(\"New version: \" + rotatedKey.getProperties().getVersion());\n\n\u002F\u002F Set rotation policy\nKeyRotationPolicy policy = new KeyRotationPolicy()\n    .setExpiresIn(\"P90D\")  \u002F\u002F Expire after 90 days\n    .setLifetimeActions(Arrays.asList(\n        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)\n            .setTimeBeforeExpiry(\"P30D\")));  \u002F\u002F Rotate 30 days before expiry\n\nkeyClient.updateKeyRotationPolicy(\"my-key\", policy);\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy(\"my-key\");\n```\n\n## Import Key\n\n```java\nimport com.azure.security.keyvault.keys.models.ImportKeyOptions;\nimport com.azure.security.keyvault.keys.models.JsonWebKey;\n\n\u002F\u002F Import existing key material\nJsonWebKey jsonWebKey = new JsonWebKey()\n    .setKeyType(KeyType.RSA)\n    .setN(modulus)\n    .setE(exponent)\n    .setD(privateExponent)\n    \u002F\u002F ... other RSA components\n    ;\n\nImportKeyOptions importOptions = new ImportKeyOptions(\"imported-key\", jsonWebKey)\n    .setHardwareProtected(false);\n\nKeyVaultKey importedKey = keyClient.importKey(importOptions);\n```\n\n## Encryption Algorithms\n\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |\n| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |\n| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |\n| `A128GCM` | OCT | AES-GCM 128-bit |\n| `A256GCM` | OCT | AES-GCM 256-bit |\n| `A128CBC` | OCT | AES-CBC 128-bit |\n| `A256CBC` | OCT | AES-CBC 256-bit |\n\n## Signature Algorithms\n\n| Algorithm | Key Type | Hash |\n|-----------|----------|------|\n| `RS256` | RSA | SHA-256 |\n| `RS384` | RSA | SHA-384 |\n| `RS512` | RSA | SHA-512 |\n| `PS256` | RSA | SHA-256 (PSS) |\n| `ES256` | EC P-256 | SHA-256 |\n| `ES384` | EC P-384 | SHA-384 |\n| `ES512` | EC P-521 | SHA-512 |\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultKey key = keyClient.getKey(\"non-existent-key\");\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Key not found: \" + e.getMessage());\n} catch (HttpResponseException e) {\n    System.out.println(\"HTTP error \" + e.getResponse().getStatusCode());\n    System.out.println(\"Message: \" + e.getMessage());\n}\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Best Practices\n\n1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys\n2. **Enable Soft Delete** - Protects against accidental deletion\n3. **Key Rotation** - Set up automatic rotation policies\n4. **Least Privilege** - Use separate keys for different operations\n5. **Local Crypto When Possible** - Use `CryptographyClient` with local key material to reduce round-trips\n\n## Trigger Phrases\n\n- \"Key Vault keys Java\", \"cryptographic keys Java\"\n- \"encrypt decrypt Java\", \"sign verify Java\"\n- \"RSA key\", \"EC key\", \"HSM key\"\n- \"key rotation\", \"wrap unwrap key\"\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Azure Key Vault Keys (Java)\n\nManage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-keys\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.security.keyvault.keys.KeyClient;\nimport com.azure.security.keyvault.keys.KeyClientBuilder;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClient;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Key management client\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\n\u002F\u002F Async client\nKeyAsyncClient keyAsyncClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Cryptography client (for encrypt\u002Fdecrypt\u002Fsign\u002Fverify)\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\u002F\u003Ckey-version>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n```\n\n## Key Types\n\n| Type | Description |\n|------|-------------|\n| `RSA` | RSA key (2048, 3072, 4096 bits) |\n| `RSA_HSM` | RSA key in HSM |\n| `EC` | Elliptic Curve key |\n| `EC_HSM` | Elliptic Curve key in HSM |\n| `OCT` | Symmetric key (Managed HSM only) |\n| `OCT_HSM` | Symmetric key in HSM |\n\n## Create Keys\n\n### Create RSA Key\n\n```java\nimport com.azure.security.keyvault.keys.models.*;\n\n\u002F\u002F Simple RSA key\nKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key\")\n    .setKeySize(2048));\n\nSystem.out.println(\"Key name: \" + rsaKey.getName());\nSystem.out.println(\"Key ID: \" + rsaKey.getId());\nSystem.out.println(\"Key type: \" + rsaKey.getKeyType());\n\n\u002F\u002F RSA key with options\nKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key-2\")\n    .setKeySize(4096)\n    .setExpiresOn(OffsetDateTime.now().plusYears(1))\n    .setNotBefore(OffsetDateTime.now())\n    .setEnabled(true)\n    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT, \n                       KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)\n    .setTags(Map.of(\"environment\", \"production\")));\n\n\u002F\u002F HSM-backed RSA key\nKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-hsm-key\")\n    .setKeySize(2048)\n    .setHardwareProtected(true));\n```\n\n### Create EC Key\n\n```java\n\u002F\u002F EC key with P-256 curve\nKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key\")\n    .setCurveName(KeyCurveName.P_256));\n\n\u002F\u002F EC key with other curves\nKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-384\")\n    .setCurveName(KeyCurveName.P_384));\n\nKeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-521\")\n    .setCurveName(KeyCurveName.P_521));\n\n\u002F\u002F HSM-backed EC key\nKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-hsm-key\")\n    .setCurveName(KeyCurveName.P_256)\n    .setHardwareProtected(true));\n```\n\n### Create Symmetric Key (Managed HSM only)\n\n```java\nKeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions(\"my-symmetric-key\")\n    .setKeySize(256)\n    .setHardwareProtected(true));\n```\n\n## Get Key\n\n```java\n\u002F\u002F Get latest version\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = keyClient.getKey(\"my-key\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only key properties (no key material)\nKeyProperties keyProps = keyClient.getKey(\"my-key\").getProperties();\n```\n\n## Update Key Properties\n\n```java\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Update properties\nkey.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"archived\"));\n\nKeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),\n    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);\n```\n\n## List Keys\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\n\n\u002F\u002F List all keys\nfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {\n    System.out.println(\"Key: \" + keyProps.getName());\n    System.out.println(\"  Enabled: \" + keyProps.isEnabled());\n    System.out.println(\"  Created: \" + keyProps.getCreatedOn());\n}\n\n\u002F\u002F List key versions\nfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions(\"my-key\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n}\n```\n\n## Delete Key\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\n\n\u002F\u002F Begin delete (soft-delete enabled vaults)\nSyncPoller\u003CDeletedKey, Void> deletePoller = keyClient.beginDeleteKey(\"my-key\");\n\n\u002F\u002F Wait for deletion\nDeletedKey deletedKey = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted: \" + deletedKey.getDeletedOn());\n\ndeletePoller.waitForCompletion();\n\n\u002F\u002F Purge deleted key (permanent deletion)\nkeyClient.purgeDeletedKey(\"my-key\");\n\n\u002F\u002F Recover deleted key\nSyncPoller\u003CKeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey(\"my-key\");\nrecoverPoller.waitForCompletion();\n```\n\n## Cryptographic Operations\n\n### Encrypt\u002FDecrypt\n\n```java\nimport com.azure.security.keyvault.keys.cryptography.models.*;\n\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\nbyte[] plaintext = \"Hello, World!\".getBytes(StandardCharsets.UTF_8);\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);\nbyte[] ciphertext = encryptResult.getCipherText();\nSystem.out.println(\"Ciphertext length: \" + ciphertext.length);\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);\nString decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);\nSystem.out.println(\"Decrypted: \" + decrypted);\n```\n\n### Sign\u002FVerify\n\n```java\nimport java.security.MessageDigest;\n\n\u002F\u002F Create digest of data\nbyte[] data = \"Data to sign\".getBytes(StandardCharsets.UTF_8);\nMessageDigest md = MessageDigest.getInstance(\"SHA-256\");\nbyte[] digest = md.digest(data);\n\n\u002F\u002F Sign\nSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);\nbyte[] signature = signResult.getSignature();\n\n\u002F\u002F Verify\nVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);\nSystem.out.println(\"Valid signature: \" + verifyResult.isValid());\n```\n\n### Wrap\u002FUnwrap Key\n\n```java\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32];  \u002F\u002F 256-bit key\nnew SecureRandom().nextBytes(keyToWrap);\n\n\u002F\u002F Wrap\nWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);\nbyte[] wrappedKey = wrapResult.getEncryptedKey();\n\n\u002F\u002F Unwrap\nUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);\nbyte[] unwrappedKey = unwrapResult.getKey();\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup\nbyte[] backup = keyClient.backupKey(\"my-key\");\n\n\u002F\u002F Save backup to file\nFiles.write(Paths.get(\"key-backup.blob\"), backup);\n\n\u002F\u002F Restore\nbyte[] backupData = Files.readAllBytes(Paths.get(\"key-backup.blob\"));\nKeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);\n```\n\n## Key Rotation\n\n```java\n\u002F\u002F Rotate to new version\nKeyVaultKey rotatedKey = keyClient.rotateKey(\"my-key\");\nSystem.out.println(\"New version: \" + rotatedKey.getProperties().getVersion());\n\n\u002F\u002F Set rotation policy\nKeyRotationPolicy policy = new KeyRotationPolicy()\n    .setExpiresIn(\"P90D\")  \u002F\u002F Expire after 90 days\n    .setLifetimeActions(Arrays.asList(\n        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)\n            .setTimeBeforeExpiry(\"P30D\")));  \u002F\u002F Rotate 30 days before expiry\n\nkeyClient.updateKeyRotationPolicy(\"my-key\", policy);\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy(\"my-key\");\n```\n\n## Import Key\n\n```java\nimport com.azure.security.keyvault.keys.models.ImportKeyOptions;\nimport com.azure.security.keyvault.keys.models.JsonWebKey;\n\n\u002F\u002F Import existing key material\nJsonWebKey jsonWebKey = new JsonWebKey()\n    .setKeyType(KeyType.RSA)\n    .setN(modulus)\n    .setE(exponent)\n    .setD(privateExponent)\n    \u002F\u002F ... other RSA components\n    ;\n\nImportKeyOptions importOptions = new ImportKeyOptions(\"imported-key\", jsonWebKey)\n    .setHardwareProtected(false);\n\nKeyVaultKey importedKey = keyClient.importKey(importOptions);\n```\n\n## Encryption Algorithms\n\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |\n| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |\n| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |\n| `A128GCM` | OCT | AES-GCM 128-bit |\n| `A256GCM` | OCT | AES-GCM 256-bit |\n| `A128CBC` | OCT | AES-CBC 128-bit |\n| `A256CBC` | OCT | AES-CBC 256-bit |\n\n## Signature Algorithms\n\n| Algorithm | Key Type | Hash |\n|-----------|----------|------|\n| `RS256` | RSA | SHA-256 |\n| `RS384` | RSA | SHA-384 |\n| `RS512` | RSA | SHA-512 |\n| `PS256` | RSA | SHA-256 (PSS) |\n| `ES256` | EC P-256 | SHA-256 |\n| `ES384` | EC P-384 | SHA-384 |\n| `ES512` | EC P-521 | SHA-512 |\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultKey key = keyClient.getKey(\"non-existent-key\");\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Key not found: \" + e.getMessage());\n} catch (HttpResponseException e) {\n    System.out.println(\"HTTP error \" + e.getResponse().getStatusCode());\n    System.out.println(\"Message: \" + e.getMessage());\n}\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Best Practices\n\n1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys\n2. **Enable Soft Delete** - Protects against accidental deletion\n3. **Key Rotation** - Set up automatic rotation policies\n4. **Least Privilege** - Use separate keys for different operations\n5. **Local Crypto When Possible** - Use `CryptographyClient` with local key material to reduce round-trips\n\n## Trigger Phrases\n\n- \"Key Vault keys Java\", \"cryptographic keys Java\"\n- \"encrypt decrypt Java\", \"sign verify Java\"\n- \"RSA key\", \"EC key\", \"HSM key\"\n- \"key rotation\", \"wrap unwrap key\"\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":39,"source":32,"date_added":40,"description":7},"unknown","2026-02-27","main","a50a3aa6b39fb0e1b7db88bef1bfc9c93606e126","modules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fazure-security-keyvault-keys-java",0,"https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant","https:\u002F\u002Fgithub.com\u002FSam-06060","Mobile Application Developer | Kotlin | Flutter, KMP, Swfit, Android,Swift UI | Building at Saar It Resources | Creator of Jarvis (AI Assistant)","2026-06-23 05:13:38",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add Sam-06060\u002Fjarvis-assistant --skill azure-security-keyvault-keys-java",{"tool":55,"command":56},"bunx","bunx skills add Sam-06060\u002Fjarvis-assistant --skill azure-security-keyvault-keys-java",{"tool":58,"command":59},"pnpm","pnpm dlx skills add Sam-06060\u002Fjarvis-assistant --skill azure-security-keyvault-keys-java","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fazure-security-keyvault-keys-java\u002FSKILL.md",true,[],[64,77,93,119,138,165],{"skillNo":65,"name":66,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":74,"publishedAt":34},"01M6GDRVS6FXX3ESH0C9DW01C0","test_skill","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fscratch\u002Ftest_skill\u002FSKILL.md",[69],{"categoryNo":70,"categoryName":71,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[75,76],"Test Skill","test",{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":34},"01M6GDRQ40HX22MA6XWC31RHHK","zustand-store-ts","Create Zustand stores following established patterns with proper TypeScript types and middleware.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzustand-store-ts\u002FSKILL.md",[],[84,85,86,87,88,89,90,32,91,92],"zustand store ts","zustand","store","with","types","middleware","patterns","create","typescript",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":102,"publishedAt":34},"01M6GDRKEA0WE670SPFWX5GKCN","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoom-automation\u002FSKILL.md",[99],{"categoryNo":100,"categoryName":101,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000023","Skill与智能体开发",[103,104,105,106,107,108,109,110,111,112,113,114,115,116,32,117,29,118],"automation","zoom automation","zoom","first","Tools","search","MCP","via","meeting","automate","critical","creation","webinars","composio","recordings","tracking",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":126,"publishedAt":34},"01M6GDRFS1452PC71JQ38S24HR","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoho-crm-automation\u002FSKILL.md",[125],{"categoryNo":100,"categoryName":101,"taxonomyType":72,"taxonomyTypeDesc":73},[127,103,128,129,130,131,132,32,108,133,116,134,113,112,107,135,91,136,109,137],"crm automation","zoho crm","crm","zoho crm automation","zoho","leads","contacts","records","update","tasks","manage",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":147,"publishedAt":34},"01M6GDRCKQBAVTGHX5XBH26KPZ","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzod-validation-expert\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000009","前端开发",[148,149,150,151,152,92,153,154,155,156,157,158,87,159,160,161,162,32,163,164],"expert","zod","zod validation expert","validation","react","safe","parsing","errors","schema validation","react hook form","hook","trpc","form","type","next","schema","Next.js",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":34},"01M6GDR658B08K4MY0RWD4A6EH","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzeroize-audit\u002FSKILL.md",[171],{"categoryNo":100,"categoryName":101,"taxonomyType":72,"taxonomyTypeDesc":73},[173,174,175,176,177,178,179,180,32,181,182,183,184,185,186,187,188,189,190,109],"zeroize audit","audit","write","passwords","get","project","c++","activate","assembly","read","Bash","secrets","analysis","data","flow","verification","code","rust"]