OpenHarmony Universal KeyStore (HUKS) provides KeyStore (KS) capabilities for applications, including key management and key cryptography operations. HUKS also provides APIs for applications to import or generate keys.
OpenHarmony Universal KeyStore (HUKS) provides KeyStore (KS) capabilities for applications, including key management and key cryptography operations. HUKS also provides APIs for applications to import or generate keys.
> **NOTE**<br>
>
## JS-based Development
> This document is based on API version 9 and applies only to ArkTS development.
1. Import the HUKS module.
### **Prerequisites**
```js
The HUKS module must have been imported.
importhuksfrom'@ohos.security.huks'
```
```ts
importhuksfrom'@ohos.security.huks'
2. Call **generateKey()** to generate a key.
```
**keyAlias** indicates the alias of the key generated. **options** indicates the parameters used for generating the key. Set **options** based on the algorithms to be used.
### Generating a Key
The return value indicates whether the key is successfully generated.
Generate a key for an application by specifying the alias and key parameters.
```js
> **NOTE**
varalias='testAlias';
>
varproperties=newArray();
> 1. When a key is used if the parameters passed in does not comply with the parameters passed in during the key generation, the parameter verification will fail.
properties[0]={
>
tag:huks.HuksTag.HUKS_TAG_ALGORITHM,
> 2. If an optional parameter required by the algorithm is not passed in during the key generation process, it must be passed in when the key is used.
value:huks.HuksKeyAlg.HUKS_ALG_ECC
};
**Supported Key Types**
properties[1]={
tag:huks.HuksTag.HUKS_TAG_KEY_SIZE,
The following lists the mandatory parameters for key generation, including the key algorithm, key length, and key usage.
**Alias** indicates the alias of the key, and **options** indicates the parameters used for initialization. Set **options** based on the algorithms to be used.
| genKeyAlias | string | Yes | Alias of the key generated. |
| genKeyProperties | HuksOptions | Yes | Tags required for generating the key. The key algorithm, key usage, and key length are mandatory.|
The return value indicates whether the **Init** operation is successful.
For details about the APIs, see [HUKS](../reference/apis/js-apis-huks.md).
4. Call **update()** to add data for the key operation by segment.
letoptions={
properties:properties
**handle** indicates the session ID for the **update** operation. **options** indicates the parameters used for the **update** operation. Set **options** based on the algorithms to be used.
};
try{
The return value indicates whether the **update** operation is successful.
**handle** indicates the session ID of the **finish** operation. **options** indicates the parameters used for this operation. Set **options** based on the algorithms to be used.
The return value indicates whether the **finish** operation is successful.
```js
varproperties=newArray();
properties[0]={
tag:huks.HuksTag.HUKS_TAG_ALGORITHM,
value:huks.HuksKeyAlg.HUKS_ALG_DH
};
properties[1]={
tag:huks.HuksTag.HUKS_TAG_PURPOSE,
value:huks.HuksKeyPurpose.HUKS_KEY_PURPOSE_AGREE
};
properties[2]={
tag:huks.HuksTag.HUKS_TAG_KEY_SIZE,
value:huks.HuksKeySize.HUKS_DH_KEY_SIZE_4096
};
varoptions={
properties:properties
};
varresult=huks.finish(handle,options)
```
## TS-based Development
### Key Import and Export
### Key Import and Export
The **HUKS** module allows an application to export the public key of its own asymmetric keys (public/private key pairs) based on the key alias.
The **HUKS** module allows the public key of its own asymmetric key (public and private key pair) to be exported based on the key alias.
The **HUKS** module also supports import of external keys. Except the public keys of asymmetric keys, the keys imported into the HUKS cannot be exported in their lifecycle. If the alias of the key to be imported already exists in HUKS, the newly imported key will overwrite the existing one.
The **HUKS** module also supports import of external keys. Except the public keys of asymmetric keys, the keys imported into the HUKS cannot be exported in their lifecycle. If the alias of the key to be imported already exists in HUKS, the newly imported key will overwrite the existing one.
...
@@ -142,11 +106,11 @@ The development procedure is as follows:
...
@@ -142,11 +106,11 @@ The development procedure is as follows:
The service invoker and HUKS negotiate a shared symmetric key to encrypt and decrypt the intermediate key and the key to be imported. After the encrypted key is imported, it is decrypted and saved in HUKS. The keys in plaintext can be processed in HUKS only.
The service invoker and HUKS negotiate a shared symmetric key to encrypt and decrypt the intermediate key and the key to be imported. After the encrypted key is imported, it is decrypted and saved in HUKS. The keys in plaintext can be processed in HUKS only.
The development procedure is as follows:
The development procedure is as follows:
1. Generate a key pair in HUKS. The key pair is used to encrypt the key to import.
1. Generate a key pair in HUKS. The key pair is used to encrypt the key to import.
2. Export the public key of the key pair and obtain a shared key through key agreement.
2. Export the public key of the key pair and obtain a shared secret through key agreement.
3. Generate intermediate key materials and encrypt the key.
3. Generate intermediate key materials to encrypt the key.
