Azure Security Keyvault Keys Java

by microsoft354361d83247MITListed Oct 8, 2026Updated Oct 8, 2026

Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys.

FeaturedInstructions onlySecurity

AI-generated overview

Guides Java developers in managing Azure Key Vault cryptographic keys and running encrypt, decrypt, sign and verify operations.

What it does: Explains how to use the Azure Key Vault Keys Java SDK to create, retrieve, update, list, delete, back up, restore, import and rotate RSA, EC and symmetric keys, including HSM-backed keys. It shows client setup with KeyClient, KeyAsyncClient and CryptographyClient, plus code for encrypt/decrypt, sign/verify and wrap/unwrap operations. It also lists key types, encryption and signature algorithms, error handling, environment variables and best practices.
When to use it: Use when writing Java code that manages keys in Azure Key Vault or Managed HSM, or that performs cryptographic operations through the Key Vault Keys SDK. Also useful for setting key rotation policies, importing existing key material, or choosing appropriate encryption and signature algorithms. Not intended for non-Azure key management or general application development.
Requirements: Requires Java with the com.azure:azure-security-keyvault-keys Maven dependency, Azure identity libraries, an Azure Key Vault or Managed HSM vault URL, and Azure credentials such as DefaultAzureCredential or Managed Identity. Network access to Azure is needed. No scripts are shipped; instructions only.

Azure Key Vault Keys (Java)

Manage cryptographic keys and perform cryptographic operations in Azure Key Vault and Managed HSM.

Installation

xml

<dependency>    <groupId>com.azure</groupId>    <artifactId>azure-security-keyvault-keys</artifactId>    <version>4.9.0</version></dependency>

<dependency>    <groupId>com.azure</groupId>    <artifactId>azure-security-keyvault-keys</artifactId>    <version>4.9.0</version></dependency>

Client Creation

java

import com.azure.core.credential.TokenCredential;import com.azure.identity.AzureIdentityEnvVars;import com.azure.identity.DefaultAzureCredentialBuilder;import com.azure.identity.ManagedIdentityCredentialBuilder;import com.azure.security.keyvault.keys.KeyClient;import com.azure.security.keyvault.keys.KeyClientBuilder;import com.azure.security.keyvault.keys.cryptography.CryptographyClient;import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;
// Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>TokenCredential credential = new DefaultAzureCredentialBuilder()    .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)    .build();// Or use a specific credential directly in production:// See https://learn.microsoft.com/java/api/overview/azure/identity-readme?view=azure-java-stable#credential-classes// TokenCredential credential = new ManagedIdentityCredentialBuilder().build();
// Key management clientKeyClient keyClient = new KeyClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildClient();
// Async clientKeyAsyncClient keyAsyncClient = new KeyClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildAsyncClient();
// Cryptography client (for encrypt/decrypt/sign/verify)CryptographyClient cryptoClient = new CryptographyClientBuilder()    .keyIdentifier("https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>")    .credential(credential)    .buildClient();

import com.azure.core.credential.TokenCredential;import com.azure.identity.AzureIdentityEnvVars;import com.azure.identity.DefaultAzureCredentialBuilder;import com.azure.identity.ManagedIdentityCredentialBuilder;import com.azure.security.keyvault.keys.KeyClient;import com.azure.security.keyvault.keys.KeyClientBuilder;import com.azure.security.keyvault.keys.cryptography.CryptographyClient;import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;
// Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>TokenCredential credential = new DefaultAzureCredentialBuilder()    .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)    .build();// Or use a specific credential directly in production:// See https://learn.microsoft.com/java/api/overview/azure/identity-readme?view=azure-java-stable#credential-classes// TokenCredential credential = new ManagedIdentityCredentialBuilder().build();
// Key management clientKeyClient keyClient = new KeyClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildClient();
// Async clientKeyAsyncClient keyAsyncClient = new KeyClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildAsyncClient();
// Cryptography client (for encrypt/decrypt/sign/verify)CryptographyClient cryptoClient = new CryptographyClientBuilder()    .keyIdentifier("https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>")    .credential(credential)    .buildClient();

Key Types

Create Keys

Create RSA Key

java

import com.azure.security.keyvault.keys.models.*;
// Simple RSA keyKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key")    .setKeySize(2048));
System.out.println("Key name: " + rsaKey.getName());System.out.println("Key ID: " + rsaKey.getId());System.out.println("Key type: " + rsaKey.getKeyType());
// RSA key with optionsKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key-2")    .setKeySize(4096)    .setExpiresOn(OffsetDateTime.now().plusYears(1))    .setNotBefore(OffsetDateTime.now())    .setEnabled(true)    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT,                        KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)    .setTags(Map.of("environment", "production")));
// HSM-backed RSA keyKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-hsm-key")    .setKeySize(2048)    .setHardwareProtected(true));

import com.azure.security.keyvault.keys.models.*;
// Simple RSA keyKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key")    .setKeySize(2048));
System.out.println("Key name: " + rsaKey.getName());System.out.println("Key ID: " + rsaKey.getId());System.out.println("Key type: " + rsaKey.getKeyType());
// RSA key with optionsKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key-2")    .setKeySize(4096)    .setExpiresOn(OffsetDateTime.now().plusYears(1))    .setNotBefore(OffsetDateTime.now())    .setEnabled(true)    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT,                        KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)    .setTags(Map.of("environment", "production")));
// HSM-backed RSA keyKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-hsm-key")    .setKeySize(2048)    .setHardwareProtected(true));

Create EC Key

java

// EC key with P-256 curveKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key")    .setCurveName(KeyCurveName.P_256));
// EC key with other curvesKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-384")    .setCurveName(KeyCurveName.P_384));
KeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-521")    .setCurveName(KeyCurveName.P_521));
// HSM-backed EC keyKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-hsm-key")    .setCurveName(KeyCurveName.P_256)    .setHardwareProtected(true));

// EC key with P-256 curveKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key")    .setCurveName(KeyCurveName.P_256));
// EC key with other curvesKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-384")    .setCurveName(KeyCurveName.P_384));
KeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-521")    .setCurveName(KeyCurveName.P_521));
// HSM-backed EC keyKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-hsm-key")    .setCurveName(KeyCurveName.P_256)    .setHardwareProtected(true));

Create Symmetric Key (Managed HSM only)

java

KeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions("my-symmetric-key")    .setKeySize(256)    .setHardwareProtected(true));

KeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions("my-symmetric-key")    .setKeySize(256)    .setHardwareProtected(true));

Get Key

java

// Get latest versionKeyVaultKey key = keyClient.getKey("my-key");
// Get specific versionKeyVaultKey keyVersion = keyClient.getKey("my-key", "<version-id>");
// Get only key properties (no key material)KeyProperties keyProps = keyClient.getKey("my-key").getProperties();

// Get latest versionKeyVaultKey key = keyClient.getKey("my-key");
// Get specific versionKeyVaultKey keyVersion = keyClient.getKey("my-key", "<version-id>");
// Get only key properties (no key material)KeyProperties keyProps = keyClient.getKey("my-key").getProperties();

Update Key Properties

java

KeyVaultKey key = keyClient.getKey("my-key");
// Update propertieskey.getProperties()    .setEnabled(false)    .setExpiresOn(OffsetDateTime.now().plusMonths(6))    .setTags(Map.of("status", "archived"));
KeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);

KeyVaultKey key = keyClient.getKey("my-key");
// Update propertieskey.getProperties()    .setEnabled(false)    .setExpiresOn(OffsetDateTime.now().plusMonths(6))    .setTags(Map.of("status", "archived"));
KeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);

List Keys

java

import com.azure.core.util.paging.PagedIterable;
// List all keysfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {    System.out.println("Key: " + keyProps.getName());    System.out.println("  Enabled: " + keyProps.isEnabled());    System.out.println("  Created: " + keyProps.getCreatedOn());}
// List key versionsfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions("my-key")) {    System.out.println("Version: " + version.getVersion());    System.out.println("Created: " + version.getCreatedOn());}

import com.azure.core.util.paging.PagedIterable;
// List all keysfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {    System.out.println("Key: " + keyProps.getName());    System.out.println("  Enabled: " + keyProps.isEnabled());    System.out.println("  Created: " + keyProps.getCreatedOn());}
// List key versionsfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions("my-key")) {    System.out.println("Version: " + version.getVersion());    System.out.println("Created: " + version.getCreatedOn());}

Delete Key

java

import com.azure.core.util.polling.SyncPoller;
// Begin delete (soft-delete enabled vaults)SyncPoller<DeletedKey, Void> deletePoller = keyClient.beginDeleteKey("my-key");
// Wait for deletionDeletedKey deletedKey = deletePoller.poll().getValue();System.out.println("Deleted: " + deletedKey.getDeletedOn());
deletePoller.waitForCompletion();
// Purge deleted key (permanent deletion)keyClient.purgeDeletedKey("my-key");
// Recover deleted keySyncPoller<KeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey("my-key");recoverPoller.waitForCompletion();

import com.azure.core.util.polling.SyncPoller;
// Begin delete (soft-delete enabled vaults)SyncPoller<DeletedKey, Void> deletePoller = keyClient.beginDeleteKey("my-key");
// Wait for deletionDeletedKey deletedKey = deletePoller.poll().getValue();System.out.println("Deleted: " + deletedKey.getDeletedOn());
deletePoller.waitForCompletion();
// Purge deleted key (permanent deletion)keyClient.purgeDeletedKey("my-key");
// Recover deleted keySyncPoller<KeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey("my-key");recoverPoller.waitForCompletion();

Cryptographic Operations

Encrypt/Decrypt

java

import com.azure.security.keyvault.keys.cryptography.models.*;
CryptographyClient cryptoClient = new CryptographyClientBuilder()    .keyIdentifier("https://<vault>.vault.azure.net/keys/<key-name>")    .credential(new DefaultAzureCredentialBuilder().build())    .buildClient();
byte[] plaintext = "Hello, World!".getBytes(StandardCharsets.UTF_8);
// EncryptEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);byte[] ciphertext = encryptResult.getCipherText();System.out.println("Ciphertext length: " + ciphertext.length);
// DecryptDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);String decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);System.out.println("Decrypted: " + decrypted);

import com.azure.security.keyvault.keys.cryptography.models.*;
CryptographyClient cryptoClient = new CryptographyClientBuilder()    .keyIdentifier("https://<vault>.vault.azure.net/keys/<key-name>")    .credential(new DefaultAzureCredentialBuilder().build())    .buildClient();
byte[] plaintext = "Hello, World!".getBytes(StandardCharsets.UTF_8);
// EncryptEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);byte[] ciphertext = encryptResult.getCipherText();System.out.println("Ciphertext length: " + ciphertext.length);
// DecryptDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);String decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);System.out.println("Decrypted: " + decrypted);

Sign/Verify

java

import java.security.MessageDigest;
// Create digest of databyte[] data = "Data to sign".getBytes(StandardCharsets.UTF_8);MessageDigest md = MessageDigest.getInstance("SHA-256");byte[] digest = md.digest(data);
// SignSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);byte[] signature = signResult.getSignature();
// VerifyVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);System.out.println("Valid signature: " + verifyResult.isValid());

import java.security.MessageDigest;
// Create digest of databyte[] data = "Data to sign".getBytes(StandardCharsets.UTF_8);MessageDigest md = MessageDigest.getInstance("SHA-256");byte[] digest = md.digest(data);
// SignSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);byte[] signature = signResult.getSignature();
// VerifyVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);System.out.println("Valid signature: " + verifyResult.isValid());

Wrap/Unwrap Key

java

// Key to wrap (e.g., AES key)byte[] keyToWrap = new byte[32];  // 256-bit keynew SecureRandom().nextBytes(keyToWrap);
// WrapWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);byte[] wrappedKey = wrapResult.getEncryptedKey();
// UnwrapUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);byte[] unwrappedKey = unwrapResult.getKey();

// Key to wrap (e.g., AES key)byte[] keyToWrap = new byte[32];  // 256-bit keynew SecureRandom().nextBytes(keyToWrap);
// WrapWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);byte[] wrappedKey = wrapResult.getEncryptedKey();
// UnwrapUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);byte[] unwrappedKey = unwrapResult.getKey();

Backup and Restore

java

// Backupbyte[] backup = keyClient.backupKey("my-key");
// Save backup to fileFiles.write(Paths.get("key-backup.blob"), backup);
// Restorebyte[] backupData = Files.readAllBytes(Paths.get("key-backup.blob"));KeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);

// Backupbyte[] backup = keyClient.backupKey("my-key");
// Save backup to fileFiles.write(Paths.get("key-backup.blob"), backup);
// Restorebyte[] backupData = Files.readAllBytes(Paths.get("key-backup.blob"));KeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);

Key Rotation

java

// Rotate to new versionKeyVaultKey rotatedKey = keyClient.rotateKey("my-key");System.out.println("New version: " + rotatedKey.getProperties().getVersion());
// Set rotation policyKeyRotationPolicy policy = new KeyRotationPolicy()    .setExpiresIn("P90D")  // Expire after 90 days    .setLifetimeActions(Arrays.asList(        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)            .setTimeBeforeExpiry("P30D")));  // Rotate 30 days before expiry
keyClient.updateKeyRotationPolicy("my-key", policy);
// Get rotation policyKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy("my-key");

// Rotate to new versionKeyVaultKey rotatedKey = keyClient.rotateKey("my-key");System.out.println("New version: " + rotatedKey.getProperties().getVersion());
// Set rotation policyKeyRotationPolicy policy = new KeyRotationPolicy()    .setExpiresIn("P90D")  // Expire after 90 days    .setLifetimeActions(Arrays.asList(        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)            .setTimeBeforeExpiry("P30D")));  // Rotate 30 days before expiry
keyClient.updateKeyRotationPolicy("my-key", policy);
// Get rotation policyKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy("my-key");

Import Key

java

import com.azure.security.keyvault.keys.models.ImportKeyOptions;import com.azure.security.keyvault.keys.models.JsonWebKey;
// Import existing key materialJsonWebKey jsonWebKey = new JsonWebKey()    .setKeyType(KeyType.RSA)    .setN(modulus)    .setE(exponent)    .setD(privateExponent)    // ... other RSA components    ;
ImportKeyOptions importOptions = new ImportKeyOptions("imported-key", jsonWebKey)    .setHardwareProtected(false);
KeyVaultKey importedKey = keyClient.importKey(importOptions);

import com.azure.security.keyvault.keys.models.ImportKeyOptions;import com.azure.security.keyvault.keys.models.JsonWebKey;
// Import existing key materialJsonWebKey jsonWebKey = new JsonWebKey()    .setKeyType(KeyType.RSA)    .setN(modulus)    .setE(exponent)    .setD(privateExponent)    // ... other RSA components    ;
ImportKeyOptions importOptions = new ImportKeyOptions("imported-key", jsonWebKey)    .setHardwareProtected(false);
KeyVaultKey importedKey = keyClient.importKey(importOptions);

Encryption Algorithms

Algorithm	Key Type	Description
`RSA1_5`	RSA	RSAES-PKCS1-v1_5
`RSA_OAEP`	RSA	RSAES with OAEP (recommended)
`RSA_OAEP_256`	RSA	RSAES with OAEP using SHA-256
`A128GCM`	OCT	AES-GCM 128-bit
`A256GCM`	OCT	AES-GCM 256-bit
`A128CBC`	OCT	AES-CBC 128-bit
`A256CBC`	OCT	AES-CBC 256-bit

Signature Algorithms

Error Handling

java

import com.azure.core.exception.HttpResponseException;import com.azure.core.exception.ResourceNotFoundException;
try {    KeyVaultKey key = keyClient.getKey("non-existent-key");} catch (ResourceNotFoundException e) {    System.out.println("Key not found: " + e.getMessage());} catch (HttpResponseException e) {    System.out.println("HTTP error " + e.getResponse().getStatusCode());    System.out.println("Message: " + e.getMessage());}

import com.azure.core.exception.HttpResponseException;import com.azure.core.exception.ResourceNotFoundException;
try {    KeyVaultKey key = keyClient.getKey("non-existent-key");} catch (ResourceNotFoundException e) {    System.out.println("Key not found: " + e.getMessage());} catch (HttpResponseException e) {    System.out.println("HTTP error " + e.getResponse().getStatusCode());    System.out.println("Message: " + e.getMessage());}

Environment Variables

bash

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net  # Required for vault URLAZURE_TOKEN_CREDENTIALS=prod  # Required only if DefaultAzureCredential is used in production

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net  # Required for vault URLAZURE_TOKEN_CREDENTIALS=prod  # Required only if DefaultAzureCredential is used in production

Best Practices

Use HSM Keys for Production - Set setHardwareProtected(true) for sensitive keys
Enable Soft Delete - Protects against accidental deletion
Key Rotation - Set up automatic rotation policies
Least Privilege - Use separate keys for different operations
Local Crypto When Possible - Use CryptographyClient with local key material to reduce round-trips

Trigger Phrases

"Key Vault keys Java", "cryptographic keys Java"
"encrypt decrypt Java", "sign verify Java"
"RSA key", "EC key", "HSM key"
"key rotation", "wrap unwrap key"

Source and attribution

Source:microsoft/skillsin.github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-javaat commit354361d

License: MIT

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Type	Description
`RSA`	RSA key (2048, 3072, 4096 bits)
`RSA_HSM`	RSA key in HSM
`EC`	Elliptic Curve key
`EC_HSM`	Elliptic Curve key in HSM
`OCT`	Symmetric key (Managed HSM only)
`OCT_HSM`	Symmetric key in HSM

Algorithm	Key Type	Hash
`RS256`	RSA	SHA-256
`RS384`	RSA	SHA-384
`RS512`	RSA	SHA-512
`PS256`	RSA	SHA-256 (PSS)
`ES256`	EC P-256	SHA-256
`ES384`	EC P-384	SHA-384
`ES512`	EC P-521	SHA-512

Azure Security Keyvault Keys Java

Azure Key Vault Keys (Java)

Installation

Client Creation

Key Types

Create Keys

Create RSA Key

Create EC Key

Create Symmetric Key (Managed HSM only)

Get Key

Update Key Properties

List Keys

Delete Key

Cryptographic Operations

Encrypt/Decrypt

Sign/Verify

Wrap/Unwrap Key

Backup and Restore

Key Rotation

Import Key

Encryption Algorithms

Signature Algorithms

Error Handling

Environment Variables

Best Practices

Trigger Phrases

Source and attribution

More from microsoft/skills

Customize

Discover Azure Skills

Azure Resource Visualizer

Azure Resource Lookup

Azure Messaging

Azure Kusto

More in Security

Secops Triage

Secops Investigate

Gke Workload Security

Gke Productionize

Gke Platform Security

Microsoft Azure Webjobs Extensions Authentication Events Dotnet