用户类型要求语法示例参数相关主题

使用 CloudHSM CLI 生成非对称 ML-DSA 密钥对

使用 CloudHSM CLI 中的key generate-asymmetric-pair ml-dsa命令在集群中生成非对称 ML-DSA 密钥对。 AWS CloudHSM ML-DSA 是一种后量子数字签名算法。当您需要使用抗量子算法对数据进行签名或验证时，生成 ML-DSA 密钥对。

用户类型

以下类型的用户均可运行此命令。

加密用户（CU）

要求

要运行此命令，必须以 CU 身份登录。

语法


aws-cloudhsm > help key generate-asymmetric-pair ml-dsa
Generate an ML-DSA key pair

Usage: key generate-asymmetric-pair ml-dsa [OPTIONS] --public-label <PUBLIC_LABEL> --private-label <PRIVATE_LABEL> --mldsa-algorithm <MLDSA_ALGORITHM>

Options:
      --cluster-id <CLUSTER_ID>
          Unique Id to choose which of the clusters in the config file to run the operation against. If not provided, will fall back to the value provided when interactive mode was started, or error
      --public-label <PUBLIC_LABEL>
          Label for the public key
      --private-label <PRIVATE_LABEL>
          Label for the private key
      --session
          Creates a session key pair that exists only in the current session. The key cannot be recovered after the session ends
      --mldsa-algorithm <MLDSA_ALGORITHM>
          ML-DSA algorithm [possible values: ML-DSA-44, ML-DSA-65, ML-DSA-87]
      --public-attributes [<PUBLIC_KEY_ATTRIBUTES>...]
          Space separated list of key attributes to set for the generated ML-DSA public key in the form of KEY_ATTRIBUTE_NAME=KEY_ATTRIBUTE_VALUE
      --private-attributes [<PRIVATE_KEY_ATTRIBUTES>...]
          Space separated list of key attributes to set for the generated ML-DSA private key in the form of KEY_ATTRIBUTE_NAME=KEY_ATTRIBUTE_VALUE
      --share-crypto-users [<SHARE_CRYPTO_USERS>...]
          Space separated list of Crypto User usernames to share the ML-DSA key with
      --manage-private-key-quorum-value <MANAGE_PRIVATE_KEY_QUORUM_VALUE>
          The quorum value for key management operations for the private key
      --use-private-key-quorum-value <USE_PRIVATE_KEY_QUORUM_VALUE>
          The quorum value for key usage operations for the private key
  -h, --help
          Print help

示例

这些示例说明key generate-asymmetric-pair ml-dsa如何使用创建 ML-DSA 密钥对。

例示例：创建 ML-DSA-44 密钥对


aws-cloudhsm > key generate-asymmetric-pair ml-dsa \
    --mldsa-algorithm ML-DSA-44 \
    --public-label ml-dsa-public-key-example \
    --private-label ml-dsa-private-key-example
{
  "error_code": 0,
  "data": {
    "public_key": {
      "key-reference": "0x000000000000240b",
      "key-info": {
        "key-owners": [
          {
            "username": "cu1",
            "key-coverage": "full"
          }
        ],
        "shared-users": [],
        "key-quorum-values": {
          "manage-key-quorum-value": 0,
          "use-key-quorum-value": 0
        },
        "cluster-coverage": "full"
      },
      "attributes": {
        "key-type": "ml-dsa",
        "label": "ml-dsa-public-key-example",
        "id": "0x",
        "check-value": "0x988721",
        "class": "public-key",
        "encrypt": false,
        "decrypt": false,
        "token": true,
        "always-sensitive": false,
        "derive": false,
        "destroyable": true,
        "extractable": true,
        "local": true,
        "modifiable": true,
        "never-extractable": false,
        "private": true,
        "mldsa-algorithm": "ML-DSA-44",
        "sensitive": false,
        "sign": false,
        "trusted": false,
        "unwrap": false,
        "verify": false,
        "wrap": false,
        "wrap-with-trusted": false,
        "key-length-bytes": 1312
      }
    },
    "private_key": {
      "key-reference": "0x0000000000000f63",
      "key-info": {
        "key-owners": [
          {
            "username": "cu1",
            "key-coverage": "full"
          }
        ],
        "shared-users": [],
        "key-quorum-values": {
          "manage-key-quorum-value": 0,
          "use-key-quorum-value": 0
        },
        "cluster-coverage": "full"
      },
      "attributes": {
        "key-type": "ml-dsa",
        "label": "ml-dsa-private-key-example",
        "id": "0x",
        "check-value": "0x988721",
        "class": "private-key",
        "encrypt": false,
        "decrypt": false,
        "token": true,
        "always-sensitive": true,
        "derive": false,
        "destroyable": true,
        "extractable": true,
        "local": true,
        "modifiable": true,
        "never-extractable": false,
        "private": true,
        "mldsa-algorithm": "ML-DSA-44",
        "sensitive": true,
        "sign": false,
        "trusted": false,
        "unwrap": false,
        "verify": false,
        "wrap": false,
        "wrap-with-trusted": false,
        "key-length-bytes": 2560
      }
    }
  }
}

例示例：创建具有可选属性的 ML-DSA 密钥对


aws-cloudhsm > key generate-asymmetric-pair ml-dsa \
    --mldsa-algorithm ML-DSA-65 \
    --public-label ml-dsa-public-key-example \
    --private-label ml-dsa-private-key-example \
    --public-attributes verify=true \
    --private-attributes sign=true
{
  "error_code": 0,
  "data": {
    "public_key": {
      "key-reference": "0x00000000002806eb",
      "key-info": {
        "key-owners": [
          {
            "username": "cu1",
            "key-coverage": "full"
          }
        ],
        "shared-users": [],
        "key-quorum-values": {
          "manage-key-quorum-value": 0,
          "use-key-quorum-value": 0
        },
        "cluster-coverage": "full"
      },
      "attributes": {
        "key-type": "ml-dsa",
        "label": "ml-dsa-public-key-example",
        "mldsa-algorithm": "ML-DSA-65",
        "verify": true,
        "key-length-bytes": 1952
      }
    },
    "private_key": {
      "key-reference": "0x00000000002806ec",
      "key-info": {
        "key-owners": [
          {
            "username": "cu1",
            "key-coverage": "full"
          }
        ],
        "shared-users": [],
        "key-quorum-values": {
          "manage-key-quorum-value": 0,
          "use-key-quorum-value": 0
        },
        "cluster-coverage": "full"
      },
      "attributes": {
        "key-type": "ml-dsa",
        "label": "ml-dsa-private-key-example",
        "mldsa-algorithm": "ML-DSA-65",
        "sign": true,
        "key-length-bytes": 4032
      }
    }
  }
}

参数

<CLUSTER_ID>

要运行此操作的集群的 ID。

必需：如果已配置多个集群。

<MLDSA_ALGORITHM>

指定 ML-DSA 算法。

ML-DSA-44
ML-DSA-65
ML-DSA-87

是否必需：是

<PUBLIC_KEY_ATTRIBUTES>

以KEY_ATTRIBUTE_NAME=KEY_ATTRIBUTE_VALUE（例如verify=true）的形式指定要为生成的 ML-DSA 公钥设置的以空格分隔的密钥属性列表。

有关支持的密钥属性的列表，请参阅 CloudHSM CLI 的密钥属性。

必需：否

<PUBLIC_LABEL>

为公有密钥指定用户定义的标签。对于 Client SDK 5.11 及更高版本，label 允许的最大大小为 127 个字符。Client SDK 5.10 及更低版本的字符数限制为 126 个。

是否必需：是

<PRIVATE_KEY_ATTRIBUTES>

以KEY_ATTRIBUTE_NAME=KEY_ATTRIBUTE_VALUE（例如sign=true）的形式指定要为生成的 ML-DSA 私钥设置的以空格分隔的密钥属性列表。

有关支持的密钥属性的列表，请参阅 CloudHSM CLI 的密钥属性。

必需：否

<PRIVATE_LABEL>

为私有密钥指定用户定义的标签。对于 Client SDK 5.11 及更高版本，label 允许的最大大小为 127 个字符。Client SDK 5.10 及更低版本的字符数限制为 126 个。

是否必需：是

<SESSION>

创建仅在当前会话中存在的密钥。会话结束后，密钥无法恢复。

仅在短时间内需要密钥时使用此参数。

默认情况下，HSM 生成永久（令牌）密钥。传入会<SESSION>对此进行更改，确保 HSM 改为生成会话（临时）密钥。

必需：否

<SHARE_CRYPTO_USERS>

指定以空格分隔的加密用户名列表以与之共享 ML-DSA 私钥。

必需：否

<MANAGE_PRIVATE_KEY_QUORUM_VALUE>

私有密钥的密钥管理操作的仲裁值。此值必须小于或等于与该密钥关联的用户数。这包括与之共享密钥的用户和密钥所有者。最大值为 8。

必需：否

<USE_PRIVATE_KEY_QUORUM_VALUE>

私钥使用操作的法定值。此值必须小于或等于与该密钥关联的用户数。这包括与之共享密钥的用户和密钥所有者。最大值为 8。

必需：否