OpenHarmony Universal KeyStore (HUKS) provides KeyStore (KS) capabilities for applications, including key management and key cryptography operations. HUKS also provides APIs for applications to import or generate keys.
OpenHarmony Universal KeyStore (HUKS) provides KeyStore (KS) capabilities for applications, including key management and key cryptography operations. HUKS also provides APIs for applications to import or generate keys.
## JS-based Development
> **NOTE**<br>
>
> This document is based on API version 9 and applies only to ArkTS development.
1. Import the HUKS module.
### **Prerequisites**
```js
importhuksfrom'@ohos.security.huks'
```
The HUKS module must have been imported.
2. Call **generateKey()** to generate a key.
```ts
importhuksfrom'@ohos.security.huks'
```
**keyAlias** indicates the alias of the key generated. **options** indicates the parameters used for generating the key. Set **options** based on the algorithms to be used.
### Generating a Key
The return value indicates whether the key is successfully generated.
Generate a key for an application by specifying the alias and key parameters.
```js
varalias='testAlias';
varproperties=newArray();
properties[0]={
tag:huks.HuksTag.HUKS_TAG_ALGORITHM,
value:huks.HuksKeyAlg.HUKS_ALG_ECC
};
properties[1]={
tag:huks.HuksTag.HUKS_TAG_KEY_SIZE,
value:huks.HuksKeySize.HUKS_ECC_KEY_SIZE_224
};
properties[2]={
tag:huks.HuksTag.HUKS_TAG_PURPOSE,
value:huks.HuksKeyPurpose.HUKS_KEY_PURPOSE_AGREE
};
properties[3]={
tag:huks.HuksTag.HUKS_TAG_DIGEST,
value:huks.HuksKeyDigest.HUKS_DIGEST_NONE
};
varoptions={
properties:properties
}
varresultA=huks.generateKey(alias,options);
```
3. Call **Init()** to initialize data for a key operation.
> **NOTE**
>
> 1. When a key is used if the parameters passed in does not comply with the parameters passed in during the key generation, the parameter verification will fail.
>
> 2. If an optional parameter required by the algorithm is not passed in during the key generation process, it must be passed in when the key is used.
**Alias** indicates the alias of the key, and **options** indicates the parameters used for initialization. Set **options** based on the algorithms to be used.
**Supported Key Types**
The return value indicates whether the **Init** operation is successful.
The following lists the mandatory parameters for key generation, including the key algorithm, key length, and key usage.
| HUKS_ALG_SM4 | HUKS_SM4_KEY_SIZE_128 | HUKS_KEY_PURPOSE_ENCRYPT or HUKS_KEY_PURPOSE_DECRYPT |
4. Call **update()** to add data for the key operation by segment.
Before you get started, understand the following variables:
**handle** indicates the session ID for the **update** operation. **options** indicates the parameters used for the **update** operation. Set **options** based on the algorithms to be used.
| genKeyAlias | string | Yes | Alias of the key generated. |
| genKeyProperties | HuksOptions | Yes | Tags required for generating the key. The key algorithm, key usage, and key length are mandatory.|
The return value indicates whether the **update** operation is successful.
For details about the APIs, see [HUKS](../reference/apis/js-apis-huks.md).
```js
varproperties=newArray();
properties[0]={
```ts
/* Generate an ECC key of 256 bits. */
letkeyAlias='keyAlias';
letproperties=newArray();
// Mandatory parameter.
properties[0]={
tag:huks.HuksTag.HUKS_TAG_ALGORITHM,
value:huks.HuksKeyAlg.HUKS_ALG_DH
};
properties[1]={
tag:huks.HuksTag.HUKS_TAG_PURPOSE,
value:huks.HuksKeyPurpose.HUKS_KEY_PURPOSE_AGREE
};
properties[2]={
value:huks.HuksKeyAlg.HUKS_ALG_ECC
};
// Mandatory parameter.
properties[1]={
tag:huks.HuksTag.HUKS_TAG_KEY_SIZE,
value:huks.HuksKeySize.HUKS_DH_KEY_SIZE_4096
};
varoptions={
properties:properties
};
varresult=huks.update(handle,options)
```
5. Call **finish()** to complete the operation.
**handle** indicates the session ID of the **finish** operation. **options** indicates the parameters used for this operation. Set **options** based on the algorithms to be used.
The return value indicates whether the **finish** operation is successful.
The **HUKS** module allows an application to export the public key of its own asymmetric keys (public/private key pairs) based on the key alias.
The **HUKS** module allows the public key of its own asymmetric key (public and private key pair) to be exported based on the key alias.
The **HUKS** module also supports import of external keys. Except the public keys of asymmetric keys, the keys imported into the HUKS cannot be exported in their lifecycle. If the alias of the key to be imported already exists in HUKS, the newly imported key will overwrite the existing one.
...
...
@@ -142,11 +106,11 @@ The development procedure is as follows:
The service invoker and HUKS negotiate a shared symmetric key to encrypt and decrypt the intermediate key and the key to be imported. After the encrypted key is imported, it is decrypted and saved in HUKS. The keys in plaintext can be processed in HUKS only.
The development procedure is as follows:
1. Generate a key pair in HUKS. The key pair is used to encrypt the key to import.
2. Export the public key of the key pair and obtain a shared key through key agreement.
3. Generate intermediate key materials and encrypt the key.
2. Export the public key of the key pair and obtain a shared secret through key agreement.
3. Generate intermediate key materials to encrypt the key.
