Gets the export token and the signing key certificate to initiate a TR-34 key export from Amazon Web Services Payment Cryptography¶

Description¶

Gets the export token and the signing key certificate to initiate a TR-34 key export from Amazon Web Services Payment Cryptography.

The signing key certificate signs the wrapped key under export within the TR-34 key payload. The export token and signing key certificate must be in place and operational before calling export_key. The export token expires in 30 days. You can use the same export token to export multiple keys from your service account.

To return a previously generated export token and signing key certificate instead of generating new ones, set ReuseLastGeneratedToken to true.

Cross-account use: This operation can't be used across different Amazon Web Services accounts.

Related operations:

• export_key
• get_parameters_for_import

Usage¶

paymentcryptographycontrolplane_get_parameters_for_export(
  KeyMaterialType, SigningKeyAlgorithm, ReuseLastGeneratedToken)

Arguments¶

• KeyMaterialType

  [required] The key block format type (for example, TR-34 or TR-31) to use during key material export. Export token is only required for a TR-34 key export, TR34_KEY_BLOCK. Export token is not required for TR-31 key export.

• SigningKeyAlgorithm

  [required] The signing key algorithm to generate a signing key certificate. This certificate signs the wrapped key under export within the TR-34 key block. RSA_2048 is the only signing key algorithm allowed.

• ReuseLastGeneratedToken

  Specifies whether to reuse the existing export token and signing key certificate. If set to true and a valid export token exists for the same key material type and signing key algorithm with at least 7 days of remaining validity, the existing token and signing key certificate are returned. Otherwise, a new export token and signing key certificate are generated. The default value is false, which generates a new export token and signing key certificate on every call.

Value¶

A list with the following syntax:

list(
  SigningKeyCertificate = "string",
  SigningKeyCertificateChain = "string",
  SigningKeyAlgorithm = "TDES_2KEY"|"TDES_3KEY"|"AES_128"|"AES_192"|"AES_256"|"HMAC_SHA256"|"HMAC_SHA384"|"HMAC_SHA512"|"HMAC_SHA224"|"RSA_2048"|"RSA_3072"|"RSA_4096"|"ECC_NIST_P256"|"ECC_NIST_P384"|"ECC_NIST_P521",
  ExportToken = "string",
  ParametersValidUntilTimestamp = as.POSIXct(
    "2015-01-01"
  )
)

Request syntax¶

svc$get_parameters_for_export(
  KeyMaterialType = "TR34_KEY_BLOCK"|"TR31_KEY_BLOCK"|"ROOT_PUBLIC_KEY_CERTIFICATE"|"TRUSTED_PUBLIC_KEY_CERTIFICATE"|"KEY_CRYPTOGRAM",
  SigningKeyAlgorithm = "TDES_2KEY"|"TDES_3KEY"|"AES_128"|"AES_192"|"AES_256"|"HMAC_SHA256"|"HMAC_SHA384"|"HMAC_SHA512"|"HMAC_SHA224"|"RSA_2048"|"RSA_3072"|"RSA_4096"|"ECC_NIST_P256"|"ECC_NIST_P384"|"ECC_NIST_P521",
  ReuseLastGeneratedToken = TRUE|FALSE
)