[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EXQV2TV6SC60CGFZXXVDYH":3,"skill-same:01M6EXQV2TV6SC60CGFZXXVDYH":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":50,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6EXQV2TV6SC60CGFZXXVDYH","azure-security-keyvault-keys-java",null,"Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA\u002FEC keys, performing encrypt\u002Fdecrypt\u002Fsign\u002Fverify operations, or working with HSM-backed keys.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-java\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"security","azure","azure security keyvault keys java","java","azure security","with","sdk","key management","ec","sign","azure key vault","use","operations","management","verify","azure-security","vault","rsa","hsm","encrypt","2026-11-10 10:12:30",false,"---\nname: azure-security-keyvault-keys-java\ndescription: Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA\u002FEC keys, performing encrypt\u002Fdecrypt\u002Fsign\u002Fverify operations, or working with HSM-backed keys.\npackage: com.azure:azure-security-keyvault-keys\n---\n\n# Azure Key Vault Keys (Java)\n\nManage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-keys\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.security.keyvault.keys.KeyClient;\nimport com.azure.security.keyvault.keys.KeyClientBuilder;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClient;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Key management client\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\n\u002F\u002F Async client\nKeyAsyncClient keyAsyncClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Cryptography client (for encrypt\u002Fdecrypt\u002Fsign\u002Fverify)\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\u002F\u003Ckey-version>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n```\n\n## Key Types\n\n| Type | Description |\n|------|-------------|\n| `RSA` | RSA key (2048, 3072, 4096 bits) |\n| `RSA_HSM` | RSA key in HSM |\n| `EC` | Elliptic Curve key |\n| `EC_HSM` | Elliptic Curve key in HSM |\n| `OCT` | Symmetric key (Managed HSM only) |\n| `OCT_HSM` | Symmetric key in HSM |\n\n## Create Keys\n\n### Create RSA Key\n\n```java\nimport com.azure.security.keyvault.keys.models.*;\n\n\u002F\u002F Simple RSA key\nKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key\")\n    .setKeySize(2048));\n\nSystem.out.println(\"Key name: \" + rsaKey.getName());\nSystem.out.println(\"Key ID: \" + rsaKey.getId());\nSystem.out.println(\"Key type: \" + rsaKey.getKeyType());\n\n\u002F\u002F RSA key with options\nKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key-2\")\n    .setKeySize(4096)\n    .setExpiresOn(OffsetDateTime.now().plusYears(1))\n    .setNotBefore(OffsetDateTime.now())\n    .setEnabled(true)\n    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT, \n                       KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)\n    .setTags(Map.of(\"environment\", \"production\")));\n\n\u002F\u002F HSM-backed RSA key\nKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-hsm-key\")\n    .setKeySize(2048)\n    .setHardwareProtected(true));\n```\n\n### Create EC Key\n\n```java\n\u002F\u002F EC key with P-256 curve\nKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key\")\n    .setCurveName(KeyCurveName.P_256));\n\n\u002F\u002F EC key with other curves\nKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-384\")\n    .setCurveName(KeyCurveName.P_384));\n\nKeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-521\")\n    .setCurveName(KeyCurveName.P_521));\n\n\u002F\u002F HSM-backed EC key\nKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-hsm-key\")\n    .setCurveName(KeyCurveName.P_256)\n    .setHardwareProtected(true));\n```\n\n### Create Symmetric Key (Managed HSM only)\n\n```java\nKeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions(\"my-symmetric-key\")\n    .setKeySize(256)\n    .setHardwareProtected(true));\n```\n\n## Get Key\n\n```java\n\u002F\u002F Get latest version\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = keyClient.getKey(\"my-key\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only key properties (no key material)\nKeyProperties keyProps = keyClient.getKey(\"my-key\").getProperties();\n```\n\n## Update Key Properties\n\n```java\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Update properties\nkey.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"archived\"));\n\nKeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),\n    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);\n```\n\n## List Keys\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\n\n\u002F\u002F List all keys\nfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {\n    System.out.println(\"Key: \" + keyProps.getName());\n    System.out.println(\"  Enabled: \" + keyProps.isEnabled());\n    System.out.println(\"  Created: \" + keyProps.getCreatedOn());\n}\n\n\u002F\u002F List key versions\nfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions(\"my-key\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n}\n```\n\n## Delete Key\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\n\n\u002F\u002F Begin delete (soft-delete enabled vaults)\nSyncPoller\u003CDeletedKey, Void> deletePoller = keyClient.beginDeleteKey(\"my-key\");\n\n\u002F\u002F Wait for deletion\nDeletedKey deletedKey = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted: \" + deletedKey.getDeletedOn());\n\ndeletePoller.waitForCompletion();\n\n\u002F\u002F Purge deleted key (permanent deletion)\nkeyClient.purgeDeletedKey(\"my-key\");\n\n\u002F\u002F Recover deleted key\nSyncPoller\u003CKeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey(\"my-key\");\nrecoverPoller.waitForCompletion();\n```\n\n## Cryptographic Operations\n\n### Encrypt\u002FDecrypt\n\n```java\nimport com.azure.security.keyvault.keys.cryptography.models.*;\n\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\nbyte[] plaintext = \"Hello, World!\".getBytes(StandardCharsets.UTF_8);\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);\nbyte[] ciphertext = encryptResult.getCipherText();\nSystem.out.println(\"Ciphertext length: \" + ciphertext.length);\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);\nString decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);\nSystem.out.println(\"Decrypted: \" + decrypted);\n```\n\n### Sign\u002FVerify\n\n```java\nimport java.security.MessageDigest;\n\n\u002F\u002F Create digest of data\nbyte[] data = \"Data to sign\".getBytes(StandardCharsets.UTF_8);\nMessageDigest md = MessageDigest.getInstance(\"SHA-256\");\nbyte[] digest = md.digest(data);\n\n\u002F\u002F Sign\nSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);\nbyte[] signature = signResult.getSignature();\n\n\u002F\u002F Verify\nVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);\nSystem.out.println(\"Valid signature: \" + verifyResult.isValid());\n```\n\n### Wrap\u002FUnwrap Key\n\n```java\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32];  \u002F\u002F 256-bit key\nnew SecureRandom().nextBytes(keyToWrap);\n\n\u002F\u002F Wrap\nWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);\nbyte[] wrappedKey = wrapResult.getEncryptedKey();\n\n\u002F\u002F Unwrap\nUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);\nbyte[] unwrappedKey = unwrapResult.getKey();\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup\nbyte[] backup = keyClient.backupKey(\"my-key\");\n\n\u002F\u002F Save backup to file\nFiles.write(Paths.get(\"key-backup.blob\"), backup);\n\n\u002F\u002F Restore\nbyte[] backupData = Files.readAllBytes(Paths.get(\"key-backup.blob\"));\nKeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);\n```\n\n## Key Rotation\n\n```java\n\u002F\u002F Rotate to new version\nKeyVaultKey rotatedKey = keyClient.rotateKey(\"my-key\");\nSystem.out.println(\"New version: \" + rotatedKey.getProperties().getVersion());\n\n\u002F\u002F Set rotation policy\nKeyRotationPolicy policy = new KeyRotationPolicy()\n    .setExpiresIn(\"P90D\")  \u002F\u002F Expire after 90 days\n    .setLifetimeActions(Arrays.asList(\n        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)\n            .setTimeBeforeExpiry(\"P30D\")));  \u002F\u002F Rotate 30 days before expiry\n\nkeyClient.updateKeyRotationPolicy(\"my-key\", policy);\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy(\"my-key\");\n```\n\n## Import Key\n\n```java\nimport com.azure.security.keyvault.keys.models.ImportKeyOptions;\nimport com.azure.security.keyvault.keys.models.JsonWebKey;\n\n\u002F\u002F Import existing key material\nJsonWebKey jsonWebKey = new JsonWebKey()\n    .setKeyType(KeyType.RSA)\n    .setN(modulus)\n    .setE(exponent)\n    .setD(privateExponent)\n    \u002F\u002F ... other RSA components\n    ;\n\nImportKeyOptions importOptions = new ImportKeyOptions(\"imported-key\", jsonWebKey)\n    .setHardwareProtected(false);\n\nKeyVaultKey importedKey = keyClient.importKey(importOptions);\n```\n\n## Encryption Algorithms\n\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |\n| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |\n| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |\n| `A128GCM` | OCT | AES-GCM 128-bit |\n| `A256GCM` | OCT | AES-GCM 256-bit |\n| `A128CBC` | OCT | AES-CBC 128-bit |\n| `A256CBC` | OCT | AES-CBC 256-bit |\n\n## Signature Algorithms\n\n| Algorithm | Key Type | Hash |\n|-----------|----------|------|\n| `RS256` | RSA | SHA-256 |\n| `RS384` | RSA | SHA-384 |\n| `RS512` | RSA | SHA-512 |\n| `PS256` | RSA | SHA-256 (PSS) |\n| `ES256` | EC P-256 | SHA-256 |\n| `ES384` | EC P-384 | SHA-384 |\n| `ES512` | EC P-521 | SHA-512 |\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultKey key = keyClient.getKey(\"non-existent-key\");\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Key not found: \" + e.getMessage());\n} catch (HttpResponseException e) {\n    System.out.println(\"HTTP error \" + e.getResponse().getStatusCode());\n    System.out.println(\"Message: \" + e.getMessage());\n}\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Best Practices\n\n1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys\n2. **Enable Soft Delete** - Protects against accidental deletion\n3. **Key Rotation** - Set up automatic rotation policies\n4. **Least Privilege** - Use separate keys for different operations\n5. **Local Crypto When Possible** - Use `CryptographyClient` with local key material to reduce round-trips\n\n## Trigger Phrases\n\n- \"Key Vault keys Java\", \"cryptographic keys Java\"\n- \"encrypt decrypt Java\", \"sign verify Java\"\n- \"RSA key\", \"EC key\", \"HSM key\"\n- \"key rotation\", \"wrap unwrap key\"\n","# Azure Key Vault Keys (Java)\n\nManage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-keys\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.security.keyvault.keys.KeyClient;\nimport com.azure.security.keyvault.keys.KeyClientBuilder;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClient;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Key management client\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\n\u002F\u002F Async client\nKeyAsyncClient keyAsyncClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Cryptography client (for encrypt\u002Fdecrypt\u002Fsign\u002Fverify)\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\u002F\u003Ckey-version>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n```\n\n## Key Types\n\n| Type | Description |\n|------|-------------|\n| `RSA` | RSA key (2048, 3072, 4096 bits) |\n| `RSA_HSM` | RSA key in HSM |\n| `EC` | Elliptic Curve key |\n| `EC_HSM` | Elliptic Curve key in HSM |\n| `OCT` | Symmetric key (Managed HSM only) |\n| `OCT_HSM` | Symmetric key in HSM |\n\n## Create Keys\n\n### Create RSA Key\n\n```java\nimport com.azure.security.keyvault.keys.models.*;\n\n\u002F\u002F Simple RSA key\nKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key\")\n    .setKeySize(2048));\n\nSystem.out.println(\"Key name: \" + rsaKey.getName());\nSystem.out.println(\"Key ID: \" + rsaKey.getId());\nSystem.out.println(\"Key type: \" + rsaKey.getKeyType());\n\n\u002F\u002F RSA key with options\nKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key-2\")\n    .setKeySize(4096)\n    .setExpiresOn(OffsetDateTime.now().plusYears(1))\n    .setNotBefore(OffsetDateTime.now())\n    .setEnabled(true)\n    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT, \n                       KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)\n    .setTags(Map.of(\"environment\", \"production\")));\n\n\u002F\u002F HSM-backed RSA key\nKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-hsm-key\")\n    .setKeySize(2048)\n    .setHardwareProtected(true));\n```\n\n### Create EC Key\n\n```java\n\u002F\u002F EC key with P-256 curve\nKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key\")\n    .setCurveName(KeyCurveName.P_256));\n\n\u002F\u002F EC key with other curves\nKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-384\")\n    .setCurveName(KeyCurveName.P_384));\n\nKeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-521\")\n    .setCurveName(KeyCurveName.P_521));\n\n\u002F\u002F HSM-backed EC key\nKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-hsm-key\")\n    .setCurveName(KeyCurveName.P_256)\n    .setHardwareProtected(true));\n```\n\n### Create Symmetric Key (Managed HSM only)\n\n```java\nKeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions(\"my-symmetric-key\")\n    .setKeySize(256)\n    .setHardwareProtected(true));\n```\n\n## Get Key\n\n```java\n\u002F\u002F Get latest version\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = keyClient.getKey(\"my-key\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only key properties (no key material)\nKeyProperties keyProps = keyClient.getKey(\"my-key\").getProperties();\n```\n\n## Update Key Properties\n\n```java\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Update properties\nkey.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"archived\"));\n\nKeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),\n    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);\n```\n\n## List Keys\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\n\n\u002F\u002F List all keys\nfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {\n    System.out.println(\"Key: \" + keyProps.getName());\n    System.out.println(\"  Enabled: \" + keyProps.isEnabled());\n    System.out.println(\"  Created: \" + keyProps.getCreatedOn());\n}\n\n\u002F\u002F List key versions\nfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions(\"my-key\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n}\n```\n\n## Delete Key\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\n\n\u002F\u002F Begin delete (soft-delete enabled vaults)\nSyncPoller\u003CDeletedKey, Void> deletePoller = keyClient.beginDeleteKey(\"my-key\");\n\n\u002F\u002F Wait for deletion\nDeletedKey deletedKey = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted: \" + deletedKey.getDeletedOn());\n\ndeletePoller.waitForCompletion();\n\n\u002F\u002F Purge deleted key (permanent deletion)\nkeyClient.purgeDeletedKey(\"my-key\");\n\n\u002F\u002F Recover deleted key\nSyncPoller\u003CKeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey(\"my-key\");\nrecoverPoller.waitForCompletion();\n```\n\n## Cryptographic Operations\n\n### Encrypt\u002FDecrypt\n\n```java\nimport com.azure.security.keyvault.keys.cryptography.models.*;\n\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\nbyte[] plaintext = \"Hello, World!\".getBytes(StandardCharsets.UTF_8);\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);\nbyte[] ciphertext = encryptResult.getCipherText();\nSystem.out.println(\"Ciphertext length: \" + ciphertext.length);\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);\nString decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);\nSystem.out.println(\"Decrypted: \" + decrypted);\n```\n\n### Sign\u002FVerify\n\n```java\nimport java.security.MessageDigest;\n\n\u002F\u002F Create digest of data\nbyte[] data = \"Data to sign\".getBytes(StandardCharsets.UTF_8);\nMessageDigest md = MessageDigest.getInstance(\"SHA-256\");\nbyte[] digest = md.digest(data);\n\n\u002F\u002F Sign\nSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);\nbyte[] signature = signResult.getSignature();\n\n\u002F\u002F Verify\nVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);\nSystem.out.println(\"Valid signature: \" + verifyResult.isValid());\n```\n\n### Wrap\u002FUnwrap Key\n\n```java\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32];  \u002F\u002F 256-bit key\nnew SecureRandom().nextBytes(keyToWrap);\n\n\u002F\u002F Wrap\nWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);\nbyte[] wrappedKey = wrapResult.getEncryptedKey();\n\n\u002F\u002F Unwrap\nUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);\nbyte[] unwrappedKey = unwrapResult.getKey();\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup\nbyte[] backup = keyClient.backupKey(\"my-key\");\n\n\u002F\u002F Save backup to file\nFiles.write(Paths.get(\"key-backup.blob\"), backup);\n\n\u002F\u002F Restore\nbyte[] backupData = Files.readAllBytes(Paths.get(\"key-backup.blob\"));\nKeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);\n```\n\n## Key Rotation\n\n```java\n\u002F\u002F Rotate to new version\nKeyVaultKey rotatedKey = keyClient.rotateKey(\"my-key\");\nSystem.out.println(\"New version: \" + rotatedKey.getProperties().getVersion());\n\n\u002F\u002F Set rotation policy\nKeyRotationPolicy policy = new KeyRotationPolicy()\n    .setExpiresIn(\"P90D\")  \u002F\u002F Expire after 90 days\n    .setLifetimeActions(Arrays.asList(\n        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)\n            .setTimeBeforeExpiry(\"P30D\")));  \u002F\u002F Rotate 30 days before expiry\n\nkeyClient.updateKeyRotationPolicy(\"my-key\", policy);\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy(\"my-key\");\n```\n\n## Import Key\n\n```java\nimport com.azure.security.keyvault.keys.models.ImportKeyOptions;\nimport com.azure.security.keyvault.keys.models.JsonWebKey;\n\n\u002F\u002F Import existing key material\nJsonWebKey jsonWebKey = new JsonWebKey()\n    .setKeyType(KeyType.RSA)\n    .setN(modulus)\n    .setE(exponent)\n    .setD(privateExponent)\n    \u002F\u002F ... other RSA components\n    ;\n\nImportKeyOptions importOptions = new ImportKeyOptions(\"imported-key\", jsonWebKey)\n    .setHardwareProtected(false);\n\nKeyVaultKey importedKey = keyClient.importKey(importOptions);\n```\n\n## Encryption Algorithms\n\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |\n| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |\n| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |\n| `A128GCM` | OCT | AES-GCM 128-bit |\n| `A256GCM` | OCT | AES-GCM 256-bit |\n| `A128CBC` | OCT | AES-CBC 128-bit |\n| `A256CBC` | OCT | AES-CBC 256-bit |\n\n## Signature Algorithms\n\n| Algorithm | Key Type | Hash |\n|-----------|----------|------|\n| `RS256` | RSA | SHA-256 |\n| `RS384` | RSA | SHA-384 |\n| `RS512` | RSA | SHA-512 |\n| `PS256` | RSA | SHA-256 (PSS) |\n| `ES256` | EC P-256 | SHA-256 |\n| `ES384` | EC P-384 | SHA-384 |\n| `ES512` | EC P-521 | SHA-512 |\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultKey key = keyClient.getKey(\"non-existent-key\");\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Key not found: \" + e.getMessage());\n} catch (HttpResponseException e) {\n    System.out.println(\"HTTP error \" + e.getResponse().getStatusCode());\n    System.out.println(\"Message: \" + e.getMessage());\n}\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Best Practices\n\n1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys\n2. **Enable Soft Delete** - Protects against accidental deletion\n3. **Key Rotation** - Set up automatic rotation policies\n4. **Least Privilege** - Use separate keys for different operations\n5. **Local Crypto When Possible** - Use `CryptographyClient` with local key material to reduce round-trips\n\n## Trigger Phrases\n\n- \"Key Vault keys Java\", \"cryptographic keys Java\"\n- \"encrypt decrypt Java\", \"sign verify Java\"\n- \"RSA key\", \"EC key\", \"HSM key\"\n- \"key rotation\", \"wrap unwrap key\"\n",{"name":5,"package":44,"description":7},"com.azure:azure-security-keyvault-keys","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-java",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill azure-security-keyvault-keys-java",{"tool":60,"command":61},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill azure-security-keyvault-keys-java",{"tool":63,"command":64},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill azure-security-keyvault-keys-java","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-java\u002FSKILL.md",true,[68],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"skill-report.json","REFERENCE","参考文档",10260,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fazure-security-keyvault-keys-java\u002Fskill-report.json",[75,89,99,107,113,120],{"skillNo":76,"name":77,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":85,"publishedAt":39},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[86,87,88],"model","model hierarchy","model hierarchy skill",{"skillNo":90,"name":91,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":95,"publishedAt":39},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[94],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},[96,97,98],"MCP","zoom","zoom mcp",{"skillNo":100,"name":101,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":39},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[25,105,106,97],"zoom apps sdk","apps",{"skillNo":108,"name":109,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":39},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[109],{"skillNo":114,"name":115,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":39},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[118],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},[115],{"skillNo":121,"name":122,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":39},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[122]]