[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EXQP70EVV0E2B5YXTSNE2G":3,"skill-same:01M6EXQP70EVV0E2B5YXTSNE2G":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6EXQP70EVV0E2B5YXTSNE2G","azure-security-keyvault-keys-dotnet",null,"Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification. Triggers: \"Key Vault keys\", \"KeyClient\", \"CryptographyClient\", \"RSA key\", \"EC key\", \"encrypt decrypt .NET\", \"key rotation\", \"HSM\".","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-dotnet\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"security","azure security","azure security keyvault keys dotnet","dotnet","azure","sdk","client","ec","triggers","creation","azure key vault","use","decryption","vault","rsa","hsm","encryption","library","encrypt","verification","2026-11-10 10:12:30",false,"---\nname: azure-security-keyvault-keys-dotnet\ndescription: |\n  Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification. Triggers: \"Key Vault keys\", \"KeyClient\", \"CryptographyClient\", \"RSA key\", \"EC key\", \"encrypt decrypt .NET\", \"key rotation\", \"HSM\".\npackage: Azure.Security.KeyVault.Keys\n---\n\n# Azure.Security.KeyVault.Keys (.NET)\n\nClient library for managing cryptographic keys in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```bash\ndotnet add package Azure.Security.KeyVault.Keys\ndotnet add package Azure.Identity\n```\n\n**Current Version**: 4.7.0 (stable)\n\n## Environment Variables\n\n```bash\nKEY_VAULT_NAME=\u003Cyour-key-vault-name>\n# Or full URI\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Client Hierarchy\n\n```\nKeyClient (key management)\n├── CreateKey \u002F CreateRsaKey \u002F CreateEcKey\n├── GetKey \u002F GetKeys\n├── UpdateKeyProperties\n├── DeleteKey \u002F PurgeDeletedKey\n├── BackupKey \u002F RestoreKey\n└── GetCryptographyClient() → CryptographyClient\n\nCryptographyClient (cryptographic operations)\n├── Encrypt \u002F Decrypt\n├── WrapKey \u002F UnwrapKey\n├── Sign \u002F Verify\n└── SignData \u002F VerifyData\n\nKeyResolver (key resolution)\n└── Resolve(keyId) → CryptographyClient\n```\n\n## Authentication\n\n### DefaultAzureCredential (Recommended)\n\n```csharp\nusing Azure.Identity;\nusing Azure.Security.KeyVault.Keys;\n\nvar keyVaultName = Environment.GetEnvironmentVariable(\"KEY_VAULT_NAME\");\nvar kvUri = $\"https:\u002F\u002F{keyVaultName}.vault.azure.net\";\n\nvar client = new KeyClient(new Uri(kvUri), new DefaultAzureCredential());\n```\n\n### Service Principal\n\n```csharp\nvar credential = new ClientSecretCredential(\n    tenantId: \"\u003Ctenant-id>\",\n    clientId: \"\u003Cclient-id>\",\n    clientSecret: \"\u003Cclient-secret>\");\n\nvar client = new KeyClient(new Uri(kvUri), credential);\n```\n\n## Key Management\n\n### Create Keys\n\n```csharp\n\u002F\u002F Create RSA key\nKeyVaultKey rsaKey = await client.CreateKeyAsync(\"my-rsa-key\", KeyType.Rsa);\nConsole.WriteLine($\"Created key: {rsaKey.Name}, Type: {rsaKey.KeyType}\");\n\n\u002F\u002F Create RSA key with options\nvar rsaOptions = new CreateRsaKeyOptions(\"my-rsa-key-2048\")\n{\n    KeySize = 2048,\n    HardwareProtected = false, \u002F\u002F true for HSM-backed\n    ExpiresOn = DateTimeOffset.UtcNow.AddYears(1),\n    NotBefore = DateTimeOffset.UtcNow,\n    Enabled = true\n};\nrsaOptions.KeyOperations.Add(KeyOperation.Encrypt);\nrsaOptions.KeyOperations.Add(KeyOperation.Decrypt);\n\nKeyVaultKey rsaKey2 = await client.CreateRsaKeyAsync(rsaOptions);\n\n\u002F\u002F Create EC key\nvar ecOptions = new CreateEcKeyOptions(\"my-ec-key\")\n{\n    CurveName = KeyCurveName.P256,\n    HardwareProtected = true \u002F\u002F HSM-backed\n};\nKeyVaultKey ecKey = await client.CreateEcKeyAsync(ecOptions);\n\n\u002F\u002F Create Oct (symmetric) key for wrap\u002Funwrap\nvar octOptions = new CreateOctKeyOptions(\"my-oct-key\")\n{\n    KeySize = 256,\n    HardwareProtected = true\n};\nKeyVaultKey octKey = await client.CreateOctKeyAsync(octOptions);\n```\n\n### Retrieve Keys\n\n```csharp\n\u002F\u002F Get specific key (latest version)\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"Key ID: {key.Id}\");\nConsole.WriteLine($\"Key Type: {key.KeyType}\");\nConsole.WriteLine($\"Version: {key.Properties.Version}\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = await client.GetKeyAsync(\"my-rsa-key\", \"version-id\");\n\n\u002F\u002F List all keys\nawait foreach (KeyProperties keyProps in client.GetPropertiesOfKeysAsync())\n{\n    Console.WriteLine($\"Key: {keyProps.Name}, Enabled: {keyProps.Enabled}\");\n}\n\n\u002F\u002F List key versions\nawait foreach (KeyProperties version in client.GetPropertiesOfKeyVersionsAsync(\"my-rsa-key\"))\n{\n    Console.WriteLine($\"Version: {version.Version}, Created: {version.CreatedOn}\");\n}\n```\n\n### Update Key Properties\n\n```csharp\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\n\nkey.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddYears(2);\nkey.Properties.Tags[\"environment\"] = \"production\";\n\nKeyVaultKey updatedKey = await client.UpdateKeyPropertiesAsync(key.Properties);\n```\n\n### Delete and Purge Keys\n\n```csharp\n\u002F\u002F Start delete operation\nDeleteKeyOperation operation = await client.StartDeleteKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Wait for deletion to complete (required before purge)\nawait operation.WaitForCompletionAsync();\nConsole.WriteLine($\"Deleted key scheduled purge date: {operation.Value.ScheduledPurgeDate}\");\n\n\u002F\u002F Purge immediately (if soft-delete is enabled)\nawait client.PurgeDeletedKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Or recover deleted key\nKeyVaultKey recoveredKey = await client.StartRecoverDeletedKeyAsync(\"my-rsa-key\");\n```\n\n### Backup and Restore\n\n```csharp\n\u002F\u002F Backup key\nbyte[] backup = await client.BackupKeyAsync(\"my-rsa-key\");\nawait File.WriteAllBytesAsync(\"key-backup.bin\", backup);\n\n\u002F\u002F Restore key\nbyte[] backupData = await File.ReadAllBytesAsync(\"key-backup.bin\");\nKeyVaultKey restoredKey = await client.RestoreKeyBackupAsync(backupData);\n```\n\n## Cryptographic Operations\n\n### Get CryptographyClient\n\n```csharp\n\u002F\u002F From KeyClient\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nCryptographyClient cryptoClient = client.GetCryptographyClient(\n    key.Name, \n    key.Properties.Version);\n\n\u002F\u002F Or create directly with key ID\nCryptographyClient cryptoClient = new CryptographyClient(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-rsa-key\u002Fversion\"),\n    new DefaultAzureCredential());\n```\n\n### Encrypt and Decrypt\n\n```csharp\nbyte[] plaintext = Encoding.UTF8.GetBytes(\"Secret message to encrypt\");\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\nConsole.WriteLine($\"Encrypted: {Convert.ToBase64String(encryptResult.Ciphertext)}\");\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = await cryptoClient.DecryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    encryptResult.Ciphertext);\nstring decrypted = Encoding.UTF8.GetString(decryptResult.Plaintext);\nConsole.WriteLine($\"Decrypted: {decrypted}\");\n```\n\n### Wrap and Unwrap Keys\n\n```csharp\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32]; \u002F\u002F 256-bit key\nRandomNumberGenerator.Fill(keyToWrap);\n\n\u002F\u002F Wrap key\nWrapResult wrapResult = await cryptoClient.WrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    keyToWrap);\n\n\u002F\u002F Unwrap key\nUnwrapResult unwrapResult = await cryptoClient.UnwrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    wrapResult.EncryptedKey);\n```\n\n### Sign and Verify\n\n```csharp\n\u002F\u002F Data to sign\nbyte[] data = Encoding.UTF8.GetBytes(\"Data to sign\");\n\n\u002F\u002F Sign data (computes hash internally)\nSignResult signResult = await cryptoClient.SignDataAsync(\n    SignatureAlgorithm.RS256, \n    data);\n\n\u002F\u002F Verify signature\nVerifyResult verifyResult = await cryptoClient.VerifyDataAsync(\n    SignatureAlgorithm.RS256, \n    data, \n    signResult.Signature);\nConsole.WriteLine($\"Signature valid: {verifyResult.IsValid}\");\n\n\u002F\u002F Or sign pre-computed hash\nusing var sha256 = SHA256.Create();\nbyte[] hash = sha256.ComputeHash(data);\n\nSignResult signHashResult = await cryptoClient.SignAsync(\n    SignatureAlgorithm.RS256, \n    hash);\n```\n\n## Key Resolver\n\n```csharp\nusing Azure.Security.KeyVault.Keys.Cryptography;\n\nvar resolver = new KeyResolver(new DefaultAzureCredential());\n\n\u002F\u002F Resolve key by ID to get CryptographyClient\nCryptographyClient cryptoClient = await resolver.ResolveAsync(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-key\u002Fversion\"));\n\n\u002F\u002F Use for encryption\nEncryptResult result = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\n```\n\n## Key Rotation\n\n```csharp\n\u002F\u002F Rotate key (creates new version)\nKeyVaultKey rotatedKey = await client.RotateKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"New version: {rotatedKey.Properties.Version}\");\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy policy = await client.GetKeyRotationPolicyAsync(\"my-rsa-key\");\n\n\u002F\u002F Update rotation policy\npolicy.ExpiresIn = \"P90D\"; \u002F\u002F 90 days\npolicy.LifetimeActions.Add(new KeyRotationLifetimeAction\n{\n    Action = KeyRotationPolicyAction.Rotate,\n    TimeBeforeExpiry = \"P30D\" \u002F\u002F Rotate 30 days before expiry\n});\n\nawait client.UpdateKeyRotationPolicyAsync(\"my-rsa-key\", policy);\n```\n\n## Key Types Reference\n\n| Type | Purpose |\n|------|---------|\n| `KeyClient` | Key management operations |\n| `CryptographyClient` | Cryptographic operations |\n| `KeyResolver` | Resolve key ID to CryptographyClient |\n| `KeyVaultKey` | Key with cryptographic material |\n| `KeyProperties` | Key metadata (no crypto material) |\n| `CreateRsaKeyOptions` | RSA key creation options |\n| `CreateEcKeyOptions` | EC key creation options |\n| `CreateOctKeyOptions` | Symmetric key options |\n| `EncryptResult` | Encryption result |\n| `DecryptResult` | Decryption result |\n| `SignResult` | Signing result |\n| `VerifyResult` | Verification result |\n| `WrapResult` | Key wrap result |\n| `UnwrapResult` | Key unwrap result |\n\n## Algorithms Reference\n\n### Encryption Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `Rsa15` | RSA | RSA 1.5 (legacy) |\n| `A128Gcm` | Oct | AES-128-GCM |\n| `A256Gcm` | Oct | AES-256-GCM |\n\n### Signature Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RS256` | RSA | RSASSA-PKCS1-v1_5 SHA-256 |\n| `RS384` | RSA | RSASSA-PKCS1-v1_5 SHA-384 |\n| `RS512` | RSA | RSASSA-PKCS1-v1_5 SHA-512 |\n| `PS256` | RSA | RSASSA-PSS SHA-256 |\n| `ES256` | EC | ECDSA P-256 SHA-256 |\n| `ES384` | EC | ECDSA P-384 SHA-384 |\n| `ES512` | EC | ECDSA P-521 SHA-512 |\n\n### Key Wrap Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `A128KW` | Oct | AES-128 Key Wrap |\n| `A256KW` | Oct | AES-256 Key Wrap |\n\n## Best Practices\n\n1. **Use Managed Identity** — Prefer `DefaultAzureCredential` over secrets\n2. **Enable soft-delete** — Protect against accidental deletion\n3. **Use HSM-backed keys** — Set `HardwareProtected = true` for sensitive keys\n4. **Implement key rotation** — Use automatic rotation policies\n5. **Limit key operations** — Only enable required `KeyOperations`\n6. **Set expiration dates** — Always set `ExpiresOn` for keys\n7. **Use specific versions** — Pin to versions in production\n8. **Cache CryptographyClient** — Reuse for multiple operations\n\n## Error Handling\n\n```csharp\nusing Azure;\n\ntry\n{\n    KeyVaultKey key = await client.GetKeyAsync(\"my-key\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 404)\n{\n    Console.WriteLine(\"Key not found\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 403)\n{\n    Console.WriteLine(\"Access denied - check RBAC permissions\");\n}\ncatch (RequestFailedException ex)\n{\n    Console.WriteLine($\"Key Vault error: {ex.Status} - {ex.Message}\");\n}\n```\n\n## Required RBAC Roles\n\n| Role | Permissions |\n|------|-------------|\n| Key Vault Crypto Officer | Full key management |\n| Key Vault Crypto User | Use keys for crypto operations |\n| Key Vault Reader | Read key metadata |\n\n## Related SDKs\n\n| SDK | Purpose | Install |\n|-----|---------|---------|\n| `Azure.Security.KeyVault.Keys` | Keys (this SDK) | `dotnet add package Azure.Security.KeyVault.Keys` |\n| `Azure.Security.KeyVault.Secrets` | Secrets | `dotnet add package Azure.Security.KeyVault.Secrets` |\n| `Azure.Security.KeyVault.Certificates` | Certificates | `dotnet add package Azure.Security.KeyVault.Certificates` |\n| `Azure.Identity` | Authentication | `dotnet add package Azure.Identity` |\n\n## Reference Links\n\n| Resource | URL |\n|----------|-----|\n| NuGet Package | https:\u002F\u002Fwww.nuget.org\u002Fpackages\u002FAzure.Security.KeyVault.Keys |\n| API Reference | https:\u002F\u002Flearn.microsoft.com\u002Fdotnet\u002Fapi\u002Fazure.security.keyvault.keys |\n| Quickstart | https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fkey-vault\u002Fkeys\u002Fquick-create-net |\n| GitHub Source | https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-for-net\u002Ftree\u002Fmain\u002Fsdk\u002Fkeyvault\u002FAzure.Security.KeyVault.Keys |\n","# Azure.Security.KeyVault.Keys (.NET)\n\nClient library for managing cryptographic keys in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```bash\ndotnet add package Azure.Security.KeyVault.Keys\ndotnet add package Azure.Identity\n```\n\n**Current Version**: 4.7.0 (stable)\n\n## Environment Variables\n\n```bash\nKEY_VAULT_NAME=\u003Cyour-key-vault-name>\n# Or full URI\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Client Hierarchy\n\n```\nKeyClient (key management)\n├── CreateKey \u002F CreateRsaKey \u002F CreateEcKey\n├── GetKey \u002F GetKeys\n├── UpdateKeyProperties\n├── DeleteKey \u002F PurgeDeletedKey\n├── BackupKey \u002F RestoreKey\n└── GetCryptographyClient() → CryptographyClient\n\nCryptographyClient (cryptographic operations)\n├── Encrypt \u002F Decrypt\n├── WrapKey \u002F UnwrapKey\n├── Sign \u002F Verify\n└── SignData \u002F VerifyData\n\nKeyResolver (key resolution)\n└── Resolve(keyId) → CryptographyClient\n```\n\n## Authentication\n\n### DefaultAzureCredential (Recommended)\n\n```csharp\nusing Azure.Identity;\nusing Azure.Security.KeyVault.Keys;\n\nvar keyVaultName = Environment.GetEnvironmentVariable(\"KEY_VAULT_NAME\");\nvar kvUri = $\"https:\u002F\u002F{keyVaultName}.vault.azure.net\";\n\nvar client = new KeyClient(new Uri(kvUri), new DefaultAzureCredential());\n```\n\n### Service Principal\n\n```csharp\nvar credential = new ClientSecretCredential(\n    tenantId: \"\u003Ctenant-id>\",\n    clientId: \"\u003Cclient-id>\",\n    clientSecret: \"\u003Cclient-secret>\");\n\nvar client = new KeyClient(new Uri(kvUri), credential);\n```\n\n## Key Management\n\n### Create Keys\n\n```csharp\n\u002F\u002F Create RSA key\nKeyVaultKey rsaKey = await client.CreateKeyAsync(\"my-rsa-key\", KeyType.Rsa);\nConsole.WriteLine($\"Created key: {rsaKey.Name}, Type: {rsaKey.KeyType}\");\n\n\u002F\u002F Create RSA key with options\nvar rsaOptions = new CreateRsaKeyOptions(\"my-rsa-key-2048\")\n{\n    KeySize = 2048,\n    HardwareProtected = false, \u002F\u002F true for HSM-backed\n    ExpiresOn = DateTimeOffset.UtcNow.AddYears(1),\n    NotBefore = DateTimeOffset.UtcNow,\n    Enabled = true\n};\nrsaOptions.KeyOperations.Add(KeyOperation.Encrypt);\nrsaOptions.KeyOperations.Add(KeyOperation.Decrypt);\n\nKeyVaultKey rsaKey2 = await client.CreateRsaKeyAsync(rsaOptions);\n\n\u002F\u002F Create EC key\nvar ecOptions = new CreateEcKeyOptions(\"my-ec-key\")\n{\n    CurveName = KeyCurveName.P256,\n    HardwareProtected = true \u002F\u002F HSM-backed\n};\nKeyVaultKey ecKey = await client.CreateEcKeyAsync(ecOptions);\n\n\u002F\u002F Create Oct (symmetric) key for wrap\u002Funwrap\nvar octOptions = new CreateOctKeyOptions(\"my-oct-key\")\n{\n    KeySize = 256,\n    HardwareProtected = true\n};\nKeyVaultKey octKey = await client.CreateOctKeyAsync(octOptions);\n```\n\n### Retrieve Keys\n\n```csharp\n\u002F\u002F Get specific key (latest version)\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"Key ID: {key.Id}\");\nConsole.WriteLine($\"Key Type: {key.KeyType}\");\nConsole.WriteLine($\"Version: {key.Properties.Version}\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = await client.GetKeyAsync(\"my-rsa-key\", \"version-id\");\n\n\u002F\u002F List all keys\nawait foreach (KeyProperties keyProps in client.GetPropertiesOfKeysAsync())\n{\n    Console.WriteLine($\"Key: {keyProps.Name}, Enabled: {keyProps.Enabled}\");\n}\n\n\u002F\u002F List key versions\nawait foreach (KeyProperties version in client.GetPropertiesOfKeyVersionsAsync(\"my-rsa-key\"))\n{\n    Console.WriteLine($\"Version: {version.Version}, Created: {version.CreatedOn}\");\n}\n```\n\n### Update Key Properties\n\n```csharp\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\n\nkey.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddYears(2);\nkey.Properties.Tags[\"environment\"] = \"production\";\n\nKeyVaultKey updatedKey = await client.UpdateKeyPropertiesAsync(key.Properties);\n```\n\n### Delete and Purge Keys\n\n```csharp\n\u002F\u002F Start delete operation\nDeleteKeyOperation operation = await client.StartDeleteKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Wait for deletion to complete (required before purge)\nawait operation.WaitForCompletionAsync();\nConsole.WriteLine($\"Deleted key scheduled purge date: {operation.Value.ScheduledPurgeDate}\");\n\n\u002F\u002F Purge immediately (if soft-delete is enabled)\nawait client.PurgeDeletedKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Or recover deleted key\nKeyVaultKey recoveredKey = await client.StartRecoverDeletedKeyAsync(\"my-rsa-key\");\n```\n\n### Backup and Restore\n\n```csharp\n\u002F\u002F Backup key\nbyte[] backup = await client.BackupKeyAsync(\"my-rsa-key\");\nawait File.WriteAllBytesAsync(\"key-backup.bin\", backup);\n\n\u002F\u002F Restore key\nbyte[] backupData = await File.ReadAllBytesAsync(\"key-backup.bin\");\nKeyVaultKey restoredKey = await client.RestoreKeyBackupAsync(backupData);\n```\n\n## Cryptographic Operations\n\n### Get CryptographyClient\n\n```csharp\n\u002F\u002F From KeyClient\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nCryptographyClient cryptoClient = client.GetCryptographyClient(\n    key.Name, \n    key.Properties.Version);\n\n\u002F\u002F Or create directly with key ID\nCryptographyClient cryptoClient = new CryptographyClient(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-rsa-key\u002Fversion\"),\n    new DefaultAzureCredential());\n```\n\n### Encrypt and Decrypt\n\n```csharp\nbyte[] plaintext = Encoding.UTF8.GetBytes(\"Secret message to encrypt\");\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\nConsole.WriteLine($\"Encrypted: {Convert.ToBase64String(encryptResult.Ciphertext)}\");\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = await cryptoClient.DecryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    encryptResult.Ciphertext);\nstring decrypted = Encoding.UTF8.GetString(decryptResult.Plaintext);\nConsole.WriteLine($\"Decrypted: {decrypted}\");\n```\n\n### Wrap and Unwrap Keys\n\n```csharp\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32]; \u002F\u002F 256-bit key\nRandomNumberGenerator.Fill(keyToWrap);\n\n\u002F\u002F Wrap key\nWrapResult wrapResult = await cryptoClient.WrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    keyToWrap);\n\n\u002F\u002F Unwrap key\nUnwrapResult unwrapResult = await cryptoClient.UnwrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    wrapResult.EncryptedKey);\n```\n\n### Sign and Verify\n\n```csharp\n\u002F\u002F Data to sign\nbyte[] data = Encoding.UTF8.GetBytes(\"Data to sign\");\n\n\u002F\u002F Sign data (computes hash internally)\nSignResult signResult = await cryptoClient.SignDataAsync(\n    SignatureAlgorithm.RS256, \n    data);\n\n\u002F\u002F Verify signature\nVerifyResult verifyResult = await cryptoClient.VerifyDataAsync(\n    SignatureAlgorithm.RS256, \n    data, \n    signResult.Signature);\nConsole.WriteLine($\"Signature valid: {verifyResult.IsValid}\");\n\n\u002F\u002F Or sign pre-computed hash\nusing var sha256 = SHA256.Create();\nbyte[] hash = sha256.ComputeHash(data);\n\nSignResult signHashResult = await cryptoClient.SignAsync(\n    SignatureAlgorithm.RS256, \n    hash);\n```\n\n## Key Resolver\n\n```csharp\nusing Azure.Security.KeyVault.Keys.Cryptography;\n\nvar resolver = new KeyResolver(new DefaultAzureCredential());\n\n\u002F\u002F Resolve key by ID to get CryptographyClient\nCryptographyClient cryptoClient = await resolver.ResolveAsync(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-key\u002Fversion\"));\n\n\u002F\u002F Use for encryption\nEncryptResult result = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\n```\n\n## Key Rotation\n\n```csharp\n\u002F\u002F Rotate key (creates new version)\nKeyVaultKey rotatedKey = await client.RotateKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"New version: {rotatedKey.Properties.Version}\");\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy policy = await client.GetKeyRotationPolicyAsync(\"my-rsa-key\");\n\n\u002F\u002F Update rotation policy\npolicy.ExpiresIn = \"P90D\"; \u002F\u002F 90 days\npolicy.LifetimeActions.Add(new KeyRotationLifetimeAction\n{\n    Action = KeyRotationPolicyAction.Rotate,\n    TimeBeforeExpiry = \"P30D\" \u002F\u002F Rotate 30 days before expiry\n});\n\nawait client.UpdateKeyRotationPolicyAsync(\"my-rsa-key\", policy);\n```\n\n## Key Types Reference\n\n| Type | Purpose |\n|------|---------|\n| `KeyClient` | Key management operations |\n| `CryptographyClient` | Cryptographic operations |\n| `KeyResolver` | Resolve key ID to CryptographyClient |\n| `KeyVaultKey` | Key with cryptographic material |\n| `KeyProperties` | Key metadata (no crypto material) |\n| `CreateRsaKeyOptions` | RSA key creation options |\n| `CreateEcKeyOptions` | EC key creation options |\n| `CreateOctKeyOptions` | Symmetric key options |\n| `EncryptResult` | Encryption result |\n| `DecryptResult` | Decryption result |\n| `SignResult` | Signing result |\n| `VerifyResult` | Verification result |\n| `WrapResult` | Key wrap result |\n| `UnwrapResult` | Key unwrap result |\n\n## Algorithms Reference\n\n### Encryption Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `Rsa15` | RSA | RSA 1.5 (legacy) |\n| `A128Gcm` | Oct | AES-128-GCM |\n| `A256Gcm` | Oct | AES-256-GCM |\n\n### Signature Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RS256` | RSA | RSASSA-PKCS1-v1_5 SHA-256 |\n| `RS384` | RSA | RSASSA-PKCS1-v1_5 SHA-384 |\n| `RS512` | RSA | RSASSA-PKCS1-v1_5 SHA-512 |\n| `PS256` | RSA | RSASSA-PSS SHA-256 |\n| `ES256` | EC | ECDSA P-256 SHA-256 |\n| `ES384` | EC | ECDSA P-384 SHA-384 |\n| `ES512` | EC | ECDSA P-521 SHA-512 |\n\n### Key Wrap Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `A128KW` | Oct | AES-128 Key Wrap |\n| `A256KW` | Oct | AES-256 Key Wrap |\n\n## Best Practices\n\n1. **Use Managed Identity** — Prefer `DefaultAzureCredential` over secrets\n2. **Enable soft-delete** — Protect against accidental deletion\n3. **Use HSM-backed keys** — Set `HardwareProtected = true` for sensitive keys\n4. **Implement key rotation** — Use automatic rotation policies\n5. **Limit key operations** — Only enable required `KeyOperations`\n6. **Set expiration dates** — Always set `ExpiresOn` for keys\n7. **Use specific versions** — Pin to versions in production\n8. **Cache CryptographyClient** — Reuse for multiple operations\n\n## Error Handling\n\n```csharp\nusing Azure;\n\ntry\n{\n    KeyVaultKey key = await client.GetKeyAsync(\"my-key\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 404)\n{\n    Console.WriteLine(\"Key not found\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 403)\n{\n    Console.WriteLine(\"Access denied - check RBAC permissions\");\n}\ncatch (RequestFailedException ex)\n{\n    Console.WriteLine($\"Key Vault error: {ex.Status} - {ex.Message}\");\n}\n```\n\n## Required RBAC Roles\n\n| Role | Permissions |\n|------|-------------|\n| Key Vault Crypto Officer | Full key management |\n| Key Vault Crypto User | Use keys for crypto operations |\n| Key Vault Reader | Read key metadata |\n\n## Related SDKs\n\n| SDK | Purpose | Install |\n|-----|---------|---------|\n| `Azure.Security.KeyVault.Keys` | Keys (this SDK) | `dotnet add package Azure.Security.KeyVault.Keys` |\n| `Azure.Security.KeyVault.Secrets` | Secrets | `dotnet add package Azure.Security.KeyVault.Secrets` |\n| `Azure.Security.KeyVault.Certificates` | Certificates | `dotnet add package Azure.Security.KeyVault.Certificates` |\n| `Azure.Identity` | Authentication | `dotnet add package Azure.Identity` |\n\n## Reference Links\n\n| Resource | URL |\n|----------|-----|\n| NuGet Package | https:\u002F\u002Fwww.nuget.org\u002Fpackages\u002FAzure.Security.KeyVault.Keys |\n| API Reference | https:\u002F\u002Flearn.microsoft.com\u002Fdotnet\u002Fapi\u002Fazure.security.keyvault.keys |\n| Quickstart | https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fkey-vault\u002Fkeys\u002Fquick-create-net |\n| GitHub Source | https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-for-net\u002Ftree\u002Fmain\u002Fsdk\u002Fkeyvault\u002FAzure.Security.KeyVault.Keys |\n",{"name":5,"package":44,"description":45},"Azure.Security.KeyVault.Keys","Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification. Triggers: \"Key Vault keys\", \"KeyClient\", \"CryptographyClient\", \"RSA key\", \"EC key\", \"encrypt decrypt .NET\", \"key rotation\", \"HSM\".\n","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-dotnet",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill azure-security-keyvault-keys-dotnet",{"tool":61,"command":62},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill azure-security-keyvault-keys-dotnet",{"tool":64,"command":65},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill azure-security-keyvault-keys-dotnet","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-dotnet\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"skill-report.json","REFERENCE","参考文档",8036,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-dotnet\u002Fskill-report.json",[76,90,100,108,114,121],{"skillNo":77,"name":78,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":86,"publishedAt":39},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[87,88,89],"model","model hierarchy","model hierarchy skill",{"skillNo":91,"name":92,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":96,"publishedAt":39},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[95],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[97,98,99],"MCP","zoom","zoom mcp",{"skillNo":101,"name":102,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":39},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[24,106,107,98],"zoom apps sdk","apps",{"skillNo":109,"name":110,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":39},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[110],{"skillNo":115,"name":116,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":39},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[119],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[116],{"skillNo":122,"name":123,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[123]]