[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6XETY4S7FPWSHSYQRWT231T":3,"skill-same:01M6XETY4S7FPWSHSYQRWT231T":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":14,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M6XETY4S7FPWSHSYQRWT231T","azure-security-keyvault-keys-java",null,"Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA\u002FEC keys, performing encrypt\u002Fdecrypt\u002Fsign\u002Fverify operations, or working with HSM-backed keys.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fazure-security-keyvault-keys-java\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"azure","azure security keyvault keys java","security","java","keys","azure security","2026","when","unknown","for","with","key management","ec","azure key vault","community","use","verify","vault","rsa","hsm","encrypt","2026-11-10 10:12:30",false,"---\nname: azure-security-keyvault-keys-java\ndescription: \"Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA\u002FEC keys, performing encrypt\u002Fdecrypt\u002Fsign\u002Fverify operations, or working with HSM-backed keys.\"\nrisk: unknown\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# Azure Key Vault Keys (Java)\n\nManage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-keys\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.security.keyvault.keys.KeyClient;\nimport com.azure.security.keyvault.keys.KeyClientBuilder;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClient;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Key management client\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\n\u002F\u002F Async client\nKeyAsyncClient keyAsyncClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Cryptography client (for encrypt\u002Fdecrypt\u002Fsign\u002Fverify)\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\u002F\u003Ckey-version>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n```\n\n## Key Types\n\n| Type | Description |\n|------|-------------|\n| `RSA` | RSA key (2048, 3072, 4096 bits) |\n| `RSA_HSM` | RSA key in HSM |\n| `EC` | Elliptic Curve key |\n| `EC_HSM` | Elliptic Curve key in HSM |\n| `OCT` | Symmetric key (Managed HSM only) |\n| `OCT_HSM` | Symmetric key in HSM |\n\n## Create Keys\n\n### Create RSA Key\n\n```java\nimport com.azure.security.keyvault.keys.models.*;\n\n\u002F\u002F Simple RSA key\nKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key\")\n    .setKeySize(2048));\n\nSystem.out.println(\"Key name: \" + rsaKey.getName());\nSystem.out.println(\"Key ID: \" + rsaKey.getId());\nSystem.out.println(\"Key type: \" + rsaKey.getKeyType());\n\n\u002F\u002F RSA key with options\nKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key-2\")\n    .setKeySize(4096)\n    .setExpiresOn(OffsetDateTime.now().plusYears(1))\n    .setNotBefore(OffsetDateTime.now())\n    .setEnabled(true)\n    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT, \n                       KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)\n    .setTags(Map.of(\"environment\", \"production\")));\n\n\u002F\u002F HSM-backed RSA key\nKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-hsm-key\")\n    .setKeySize(2048)\n    .setHardwareProtected(true));\n```\n\n### Create EC Key\n\n```java\n\u002F\u002F EC key with P-256 curve\nKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key\")\n    .setCurveName(KeyCurveName.P_256));\n\n\u002F\u002F EC key with other curves\nKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-384\")\n    .setCurveName(KeyCurveName.P_384));\n\nKeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-521\")\n    .setCurveName(KeyCurveName.P_521));\n\n\u002F\u002F HSM-backed EC key\nKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-hsm-key\")\n    .setCurveName(KeyCurveName.P_256)\n    .setHardwareProtected(true));\n```\n\n### Create Symmetric Key (Managed HSM only)\n\n```java\nKeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions(\"my-symmetric-key\")\n    .setKeySize(256)\n    .setHardwareProtected(true));\n```\n\n## Get Key\n\n```java\n\u002F\u002F Get latest version\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = keyClient.getKey(\"my-key\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only key properties (no key material)\nKeyProperties keyProps = keyClient.getKey(\"my-key\").getProperties();\n```\n\n## Update Key Properties\n\n```java\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Update properties\nkey.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"archived\"));\n\nKeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),\n    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);\n```\n\n## List Keys\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\n\n\u002F\u002F List all keys\nfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {\n    System.out.println(\"Key: \" + keyProps.getName());\n    System.out.println(\"  Enabled: \" + keyProps.isEnabled());\n    System.out.println(\"  Created: \" + keyProps.getCreatedOn());\n}\n\n\u002F\u002F List key versions\nfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions(\"my-key\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n}\n```\n\n## Delete Key\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\n\n\u002F\u002F Begin delete (soft-delete enabled vaults)\nSyncPoller\u003CDeletedKey, Void> deletePoller = keyClient.beginDeleteKey(\"my-key\");\n\n\u002F\u002F Wait for deletion\nDeletedKey deletedKey = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted: \" + deletedKey.getDeletedOn());\n\ndeletePoller.waitForCompletion();\n\n\u002F\u002F Purge deleted key (permanent deletion)\nkeyClient.purgeDeletedKey(\"my-key\");\n\n\u002F\u002F Recover deleted key\nSyncPoller\u003CKeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey(\"my-key\");\nrecoverPoller.waitForCompletion();\n```\n\n## Cryptographic Operations\n\n### Encrypt\u002FDecrypt\n\n```java\nimport com.azure.security.keyvault.keys.cryptography.models.*;\n\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\nbyte[] plaintext = \"Hello, World!\".getBytes(StandardCharsets.UTF_8);\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);\nbyte[] ciphertext = encryptResult.getCipherText();\nSystem.out.println(\"Ciphertext length: \" + ciphertext.length);\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);\nString decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);\nSystem.out.println(\"Decrypted: \" + decrypted);\n```\n\n### Sign\u002FVerify\n\n```java\nimport java.security.MessageDigest;\n\n\u002F\u002F Create digest of data\nbyte[] data = \"Data to sign\".getBytes(StandardCharsets.UTF_8);\nMessageDigest md = MessageDigest.getInstance(\"SHA-256\");\nbyte[] digest = md.digest(data);\n\n\u002F\u002F Sign\nSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);\nbyte[] signature = signResult.getSignature();\n\n\u002F\u002F Verify\nVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);\nSystem.out.println(\"Valid signature: \" + verifyResult.isValid());\n```\n\n### Wrap\u002FUnwrap Key\n\n```java\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32];  \u002F\u002F 256-bit key\nnew SecureRandom().nextBytes(keyToWrap);\n\n\u002F\u002F Wrap\nWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);\nbyte[] wrappedKey = wrapResult.getEncryptedKey();\n\n\u002F\u002F Unwrap\nUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);\nbyte[] unwrappedKey = unwrapResult.getKey();\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup\nbyte[] backup = keyClient.backupKey(\"my-key\");\n\n\u002F\u002F Save backup to file\nFiles.write(Paths.get(\"key-backup.blob\"), backup);\n\n\u002F\u002F Restore\nbyte[] backupData = Files.readAllBytes(Paths.get(\"key-backup.blob\"));\nKeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);\n```\n\n## Key Rotation\n\n```java\n\u002F\u002F Rotate to new version\nKeyVaultKey rotatedKey = keyClient.rotateKey(\"my-key\");\nSystem.out.println(\"New version: \" + rotatedKey.getProperties().getVersion());\n\n\u002F\u002F Set rotation policy\nKeyRotationPolicy policy = new KeyRotationPolicy()\n    .setExpiresIn(\"P90D\")  \u002F\u002F Expire after 90 days\n    .setLifetimeActions(Arrays.asList(\n        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)\n            .setTimeBeforeExpiry(\"P30D\")));  \u002F\u002F Rotate 30 days before expiry\n\nkeyClient.updateKeyRotationPolicy(\"my-key\", policy);\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy(\"my-key\");\n```\n\n## Import Key\n\n```java\nimport com.azure.security.keyvault.keys.models.ImportKeyOptions;\nimport com.azure.security.keyvault.keys.models.JsonWebKey;\n\n\u002F\u002F Import existing key material\nJsonWebKey jsonWebKey = new JsonWebKey()\n    .setKeyType(KeyType.RSA)\n    .setN(modulus)\n    .setE(exponent)\n    .setD(privateExponent)\n    \u002F\u002F ... other RSA components\n    ;\n\nImportKeyOptions importOptions = new ImportKeyOptions(\"imported-key\", jsonWebKey)\n    .setHardwareProtected(false);\n\nKeyVaultKey importedKey = keyClient.importKey(importOptions);\n```\n\n## Encryption Algorithms\n\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |\n| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |\n| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |\n| `A128GCM` | OCT | AES-GCM 128-bit |\n| `A256GCM` | OCT | AES-GCM 256-bit |\n| `A128CBC` | OCT | AES-CBC 128-bit |\n| `A256CBC` | OCT | AES-CBC 256-bit |\n\n## Signature Algorithms\n\n| Algorithm | Key Type | Hash |\n|-----------|----------|------|\n| `RS256` | RSA | SHA-256 |\n| `RS384` | RSA | SHA-384 |\n| `RS512` | RSA | SHA-512 |\n| `PS256` | RSA | SHA-256 (PSS) |\n| `ES256` | EC P-256 | SHA-256 |\n| `ES384` | EC P-384 | SHA-384 |\n| `ES512` | EC P-521 | SHA-512 |\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultKey key = keyClient.getKey(\"non-existent-key\");\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Key not found: \" + e.getMessage());\n} catch (HttpResponseException e) {\n    System.out.println(\"HTTP error \" + e.getResponse().getStatusCode());\n    System.out.println(\"Message: \" + e.getMessage());\n}\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Best Practices\n\n1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys\n2. **Enable Soft Delete** - Protects against accidental deletion\n3. **Key Rotation** - Set up automatic rotation policies\n4. **Least Privilege** - Use separate keys for different operations\n5. **Local Crypto When Possible** - Use `CryptographyClient` with local key material to reduce round-trips\n\n## Trigger Phrases\n\n- \"Key Vault keys Java\", \"cryptographic keys Java\"\n- \"encrypt decrypt Java\", \"sign verify Java\"\n- \"RSA key\", \"EC key\", \"HSM key\"\n- \"key rotation\", \"wrap unwrap key\"\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Azure Key Vault Keys (Java)\n\nManage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-keys\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.security.keyvault.keys.KeyClient;\nimport com.azure.security.keyvault.keys.KeyClientBuilder;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClient;\nimport com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Key management client\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\n\u002F\u002F Async client\nKeyAsyncClient keyAsyncClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Cryptography client (for encrypt\u002Fdecrypt\u002Fsign\u002Fverify)\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\u002F\u003Ckey-version>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n```\n\n## Key Types\n\n| Type | Description |\n|------|-------------|\n| `RSA` | RSA key (2048, 3072, 4096 bits) |\n| `RSA_HSM` | RSA key in HSM |\n| `EC` | Elliptic Curve key |\n| `EC_HSM` | Elliptic Curve key in HSM |\n| `OCT` | Symmetric key (Managed HSM only) |\n| `OCT_HSM` | Symmetric key in HSM |\n\n## Create Keys\n\n### Create RSA Key\n\n```java\nimport com.azure.security.keyvault.keys.models.*;\n\n\u002F\u002F Simple RSA key\nKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key\")\n    .setKeySize(2048));\n\nSystem.out.println(\"Key name: \" + rsaKey.getName());\nSystem.out.println(\"Key ID: \" + rsaKey.getId());\nSystem.out.println(\"Key type: \" + rsaKey.getKeyType());\n\n\u002F\u002F RSA key with options\nKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-rsa-key-2\")\n    .setKeySize(4096)\n    .setExpiresOn(OffsetDateTime.now().plusYears(1))\n    .setNotBefore(OffsetDateTime.now())\n    .setEnabled(true)\n    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT, \n                       KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)\n    .setTags(Map.of(\"environment\", \"production\")));\n\n\u002F\u002F HSM-backed RSA key\nKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions(\"my-hsm-key\")\n    .setKeySize(2048)\n    .setHardwareProtected(true));\n```\n\n### Create EC Key\n\n```java\n\u002F\u002F EC key with P-256 curve\nKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key\")\n    .setCurveName(KeyCurveName.P_256));\n\n\u002F\u002F EC key with other curves\nKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-384\")\n    .setCurveName(KeyCurveName.P_384));\n\nKeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-key-521\")\n    .setCurveName(KeyCurveName.P_521));\n\n\u002F\u002F HSM-backed EC key\nKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions(\"my-ec-hsm-key\")\n    .setCurveName(KeyCurveName.P_256)\n    .setHardwareProtected(true));\n```\n\n### Create Symmetric Key (Managed HSM only)\n\n```java\nKeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions(\"my-symmetric-key\")\n    .setKeySize(256)\n    .setHardwareProtected(true));\n```\n\n## Get Key\n\n```java\n\u002F\u002F Get latest version\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = keyClient.getKey(\"my-key\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only key properties (no key material)\nKeyProperties keyProps = keyClient.getKey(\"my-key\").getProperties();\n```\n\n## Update Key Properties\n\n```java\nKeyVaultKey key = keyClient.getKey(\"my-key\");\n\n\u002F\u002F Update properties\nkey.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"archived\"));\n\nKeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),\n    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);\n```\n\n## List Keys\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\n\n\u002F\u002F List all keys\nfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {\n    System.out.println(\"Key: \" + keyProps.getName());\n    System.out.println(\"  Enabled: \" + keyProps.isEnabled());\n    System.out.println(\"  Created: \" + keyProps.getCreatedOn());\n}\n\n\u002F\u002F List key versions\nfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions(\"my-key\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n}\n```\n\n## Delete Key\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\n\n\u002F\u002F Begin delete (soft-delete enabled vaults)\nSyncPoller\u003CDeletedKey, Void> deletePoller = keyClient.beginDeleteKey(\"my-key\");\n\n\u002F\u002F Wait for deletion\nDeletedKey deletedKey = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted: \" + deletedKey.getDeletedOn());\n\ndeletePoller.waitForCompletion();\n\n\u002F\u002F Purge deleted key (permanent deletion)\nkeyClient.purgeDeletedKey(\"my-key\");\n\n\u002F\u002F Recover deleted key\nSyncPoller\u003CKeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey(\"my-key\");\nrecoverPoller.waitForCompletion();\n```\n\n## Cryptographic Operations\n\n### Encrypt\u002FDecrypt\n\n```java\nimport com.azure.security.keyvault.keys.cryptography.models.*;\n\nCryptographyClient cryptoClient = new CryptographyClientBuilder()\n    .keyIdentifier(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\u002Fkeys\u002F\u003Ckey-name>\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildClient();\n\nbyte[] plaintext = \"Hello, World!\".getBytes(StandardCharsets.UTF_8);\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);\nbyte[] ciphertext = encryptResult.getCipherText();\nSystem.out.println(\"Ciphertext length: \" + ciphertext.length);\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);\nString decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);\nSystem.out.println(\"Decrypted: \" + decrypted);\n```\n\n### Sign\u002FVerify\n\n```java\nimport java.security.MessageDigest;\n\n\u002F\u002F Create digest of data\nbyte[] data = \"Data to sign\".getBytes(StandardCharsets.UTF_8);\nMessageDigest md = MessageDigest.getInstance(\"SHA-256\");\nbyte[] digest = md.digest(data);\n\n\u002F\u002F Sign\nSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);\nbyte[] signature = signResult.getSignature();\n\n\u002F\u002F Verify\nVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);\nSystem.out.println(\"Valid signature: \" + verifyResult.isValid());\n```\n\n### Wrap\u002FUnwrap Key\n\n```java\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32];  \u002F\u002F 256-bit key\nnew SecureRandom().nextBytes(keyToWrap);\n\n\u002F\u002F Wrap\nWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);\nbyte[] wrappedKey = wrapResult.getEncryptedKey();\n\n\u002F\u002F Unwrap\nUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);\nbyte[] unwrappedKey = unwrapResult.getKey();\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup\nbyte[] backup = keyClient.backupKey(\"my-key\");\n\n\u002F\u002F Save backup to file\nFiles.write(Paths.get(\"key-backup.blob\"), backup);\n\n\u002F\u002F Restore\nbyte[] backupData = Files.readAllBytes(Paths.get(\"key-backup.blob\"));\nKeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);\n```\n\n## Key Rotation\n\n```java\n\u002F\u002F Rotate to new version\nKeyVaultKey rotatedKey = keyClient.rotateKey(\"my-key\");\nSystem.out.println(\"New version: \" + rotatedKey.getProperties().getVersion());\n\n\u002F\u002F Set rotation policy\nKeyRotationPolicy policy = new KeyRotationPolicy()\n    .setExpiresIn(\"P90D\")  \u002F\u002F Expire after 90 days\n    .setLifetimeActions(Arrays.asList(\n        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)\n            .setTimeBeforeExpiry(\"P30D\")));  \u002F\u002F Rotate 30 days before expiry\n\nkeyClient.updateKeyRotationPolicy(\"my-key\", policy);\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy(\"my-key\");\n```\n\n## Import Key\n\n```java\nimport com.azure.security.keyvault.keys.models.ImportKeyOptions;\nimport com.azure.security.keyvault.keys.models.JsonWebKey;\n\n\u002F\u002F Import existing key material\nJsonWebKey jsonWebKey = new JsonWebKey()\n    .setKeyType(KeyType.RSA)\n    .setN(modulus)\n    .setE(exponent)\n    .setD(privateExponent)\n    \u002F\u002F ... other RSA components\n    ;\n\nImportKeyOptions importOptions = new ImportKeyOptions(\"imported-key\", jsonWebKey)\n    .setHardwareProtected(false);\n\nKeyVaultKey importedKey = keyClient.importKey(importOptions);\n```\n\n## Encryption Algorithms\n\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |\n| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |\n| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |\n| `A128GCM` | OCT | AES-GCM 128-bit |\n| `A256GCM` | OCT | AES-GCM 256-bit |\n| `A128CBC` | OCT | AES-CBC 128-bit |\n| `A256CBC` | OCT | AES-CBC 256-bit |\n\n## Signature Algorithms\n\n| Algorithm | Key Type | Hash |\n|-----------|----------|------|\n| `RS256` | RSA | SHA-256 |\n| `RS384` | RSA | SHA-384 |\n| `RS512` | RSA | SHA-512 |\n| `PS256` | RSA | SHA-256 (PSS) |\n| `ES256` | EC P-256 | SHA-256 |\n| `ES384` | EC P-384 | SHA-384 |\n| `ES512` | EC P-521 | SHA-512 |\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultKey key = keyClient.getKey(\"non-existent-key\");\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Key not found: \" + e.getMessage());\n} catch (HttpResponseException e) {\n    System.out.println(\"HTTP error \" + e.getResponse().getStatusCode());\n    System.out.println(\"Message: \" + e.getMessage());\n}\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Best Practices\n\n1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys\n2. **Enable Soft Delete** - Protects against accidental deletion\n3. **Key Rotation** - Set up automatic rotation policies\n4. **Least Privilege** - Use separate keys for different operations\n5. **Local Crypto When Possible** - Use `CryptographyClient` with local key material to reduce round-trips\n\n## Trigger Phrases\n\n- \"Key Vault keys Java\", \"cryptographic keys Java\"\n- \"encrypt decrypt Java\", \"sign verify Java\"\n- \"RSA key\", \"EC key\", \"HSM key\"\n- \"key rotation\", \"wrap unwrap key\"\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":27,"source":33,"date_added":45,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcopilot\u002Fazure-security-keyvault-keys-java","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill azure-security-keyvault-keys-java",{"tool":58,"command":59},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill azure-security-keyvault-keys-java",{"tool":61,"command":62},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill azure-security-keyvault-keys-java","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fazure-security-keyvault-keys-java\u002FSKILL.md",true,[],[67,90,115,125,138,157],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":78,"publishedAt":40},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[73],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[79,80,81,82,83,84,85,86,87,88,89,29],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":40},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[97,98,99,100,101,102,81,103,104,105,106,26,107,108,109,110,111,112,113,114],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","brew","live","data","google","install","read","across","api",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":40},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[122,123,97,107,108,109,110,101,81,112,124,113,114,26,105,104,103,111,102,100],"trend radar","radar","pulse",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":40},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[132,133,134,135,136,137],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":149,"publishedAt":40},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[140,87,150,151,152,29,107,153,154,155,99,156,111],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":40},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[159,164,165,166,111,167,154,168,169,170,171,172],"status","play","go","latest","github","discover","control","cmd","volume"]