What cryptographic operations does this skill support?

This skill supports encrypt and decrypt using algorithms like RSA-OAEP-256, wrap and unwrap for protecting symmetric keys under an RSA key, and sign and verify operations on both raw data and pre-computed hashes.

What RBAC roles are required to use this skill?

Key Vault Crypto Officer is required for full key management, Key Vault Crypto User for crypto operations only, or Key Vault Reader for metadata access only.

What types of keys can be created with this skill?

You can create RSA, EC, and Oct symmetric keys with configurable options including key size, curve name, hardware protection for HSM-backed keys, expiration, and enabled key operations.

How does key rotation work in this skill?

Key rotation supports both manual rotation via RotateKeyAsync, which creates a new version, and automatic rotation policies such as rotating 30 days before a 90-day expiry.

What authentication methods does this skill support?

Authentication is via DefaultAzureCredential (the recommended approach) or ClientSecretCredential for service principals.

Skill

Manage Azure Key Vault Cryptographic Keys

Name: Azure.Security.KeyVault.Keys (.NET)
Availability: OnlineOnly
Author: Antigravity

.NET skill for Azure Key Vault Keys - RSA/EC/symmetric key management, encrypt/sign/wrap operations, and rotation policies.

Get skill

Works with azure

Antigravity

Own this? Claim it

Spark score

out of 100

Updated 21 days ago

Version 14.1.0

Add to Favorites

Why it matters

Securely manage cryptographic keys within Azure Key Vault and Managed HSM. This asset enables programmatic creation, retrieval, updating, deletion, backup, and restoration of keys, along with performing cryptographic operations like encryption, decryption, signing, and key wrapping.

Outcomes

What it gets done

Create, retrieve, and update RSA, EC, and Oct keys.

Perform cryptographic operations: encrypt, decrypt, sign, verify, wrap, and unwrap keys.

Manage key lifecycle: delete, purge, recover, backup, and restore keys.

Automate key rotation and manage rotation policies.

Install

Add it to your toolbox

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/ag-azure-security-keyvault-keys-dotnet | bash

Overview

Azure.Security.KeyVault.Keys (.NET)

.NET skill for Azure Key Vault Keys, covering RSA/EC/symmetric key creation and lifecycle management, cryptographic operations (encrypt/decrypt, wrap/unwrap, sign/verify), automated key rotation policies, and RBAC roles for Key Vault access. Use when a .NET application needs to create, manage, or use cryptographic keys stored in Azure Key Vault or Managed HSM.

What it does

This skill manages cryptographic keys in Azure Key Vault and Managed HSM using Azure.Security.KeyVault.Keys (.NET, stable 4.7.0), authenticated via DefaultAzureCredential (recommended) or a ClientSecretCredential service principal. Its client hierarchy separates key management (KeyClient: create/get/list/update/delete/purge/backup/restore keys) from cryptographic operations (CryptographyClient, obtained via client.GetCryptographyClient() or constructed directly from a key ID: encrypt/decrypt, wrap/unwrap, sign/verify) and key resolution (KeyResolver, resolving a key ID URI directly to a CryptographyClient). Key creation covers RSA (with size, HSM-backed flag, expiration, not-before, enabled state, and specific KeyOperations), EC (with a named curve like P256, optionally HSM-backed), and Oct/symmetric keys (for wrap/unwrap) via dedicated options classes. Retrieval covers fetching the latest or a specific version of a key, listing all keys and all versions of one key. Updating modifies mutable properties like expiration and tags without changing the key material. Deletion is a two-step soft-delete flow - StartDeleteKeyAsync then WaitForCompletionAsync before an optional immediate PurgeDeletedKeyAsync, or recovery via StartRecoverDeletedKeyAsync. Backup/restore round-trips a key's encrypted material to/from a byte array for disaster recovery. Cryptographic operations cover EncryptAsync/DecryptAsync (e.g. RSA-OAEP-256), WrapKeyAsync/UnwrapKeyAsync for protecting a symmetric key like an AES key with an asymmetric one, and SignDataAsync/VerifyDataAsync (computing the hash internally) or SignAsync against a precomputed hash directly. Key rotation is built in: RotateKeyAsync creates a new key version, and a rotation policy (ExpiresIn, plus lifetime actions like rotating a set number of days before expiry) automates future rotations. Reference tables enumerate supported encryption algorithms (RSA-OAEP/OAEP-256/1.5, AES-GCM), signature algorithms (RSASSA-PKCS1 and PSS variants, ECDSA for P-256/384/521), and key-wrap algorithms (RSA-OAEP variants, AES key wrap). Error handling distinguishes 404 (key not found) and 403 (RBAC permission denied) via RequestFailedException, and three built-in RBAC roles are documented: Key Vault Crypto Officer (full management), Crypto User (use keys for crypto ops), and Reader (metadata only). Best practices: prefer managed identity over secrets, enable soft-delete, use HSM-backed keys for sensitive material, implement automatic rotation policies, grant only the minimal required key operations, always set expiration dates, pin to specific versions in production, and cache/reuse CryptographyClient instances.

When to use - and when NOT to

Use this skill when a .NET application needs to create, manage, or use cryptographic keys stored in Azure Key Vault or Managed HSM - encryption/decryption, key wrapping, digital signatures, or automated key rotation. It is not for storing secrets or certificates directly (those are the separate Azure.Security.KeyVault.Secrets and Azure.Security.KeyVault.Certificates SDKs) and RBAC role assignment itself happens outside this SDK, in Azure's access-control configuration.

Inputs and outputs

Input is key names, creation options (type, size/curve, HSM backing, expiration), or plaintext/ciphertext/signatures for cryptographic operations. Output is created/retrieved KeyVaultKey objects and their metadata, encrypted/decrypted/wrapped/unwrapped byte payloads, and signature verification results.

Integrations

Built on Azure Key Vault / Managed HSM via Azure.Security.KeyVault.Keys, authenticated with Azure Identity's DefaultAzureCredential or ClientSecretCredential, alongside the companion Azure.Security.KeyVault.Secrets and Azure.Security.KeyVault.Certificates SDKs.

dotnet add package Azure.Security.KeyVault.Keys

Who it's for

.NET developers managing cryptographic keys and performing encryption, signing, or key-wrapping operations backed by Azure Key Vault or Managed HSM, including automated key rotation.

FAQ

Common questions

Discussion