HSM on Demand with Key Export

The HSM on Demand with Key Export service enables export of high quality private asymmetric keys from the HSM for use on other devices. A service in Key Export mode has the following capabilities and restrictions:

• Private keys cannot be cloned to other HSM services.
• The service cannot be part of a HA (high availability) HA group i.e. private keys will not be replicated.
• All keys/objects, including private keys, can be wrapped off the HSM (can be exported to a file encrypted with a wrapping key).

This mode is useful when generating key pairs for identity issuance, where transient key-pairs are generated, wrapped off, and embedded on a device. They are not used on the HSM, but generated and issued securely, and then deleted from the HSM.