Azure Security Keyvault Keys Java

import com.azure.core.credential.TokenCredential;import com.azure.identity.AzureIdentityEnvVars;import com.azure.identity.DefaultAzureCredentialBuilder;import com.azure.identity.ManagedIdentityCredentialBuilder;import com.azure.security.keyvault.keys.KeyClient;import com.azure.security.keyvault.keys.KeyClientBuilder;import com.azure.security.keyvault.keys.cryptography.CryptographyClient;import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;
// Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>TokenCredential credential = new DefaultAzureCredentialBuilder()    .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)    .build();// Or use a specific credential directly in production:// See https://learn.microsoft.com/java/api/overview/azure/identity-readme?view=azure-java-stable#credential-classes// TokenCredential credential = new ManagedIdentityCredentialBuilder().build();
// Key management clientKeyClient keyClient = new KeyClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildClient();
// Async clientKeyAsyncClient keyAsyncClient = new KeyClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildAsyncClient();
// Cryptography client (for encrypt/decrypt/sign/verify)CryptographyClient cryptoClient = new CryptographyClientBuilder()    .keyIdentifier("https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>")    .credential(credential)    .buildClient();

import com.azure.security.keyvault.keys.models.*;
// Simple RSA keyKeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key")    .setKeySize(2048));
System.out.println("Key name: " + rsaKey.getName());System.out.println("Key ID: " + rsaKey.getId());System.out.println("Key type: " + rsaKey.getKeyType());
// RSA key with optionsKeyVaultKey rsaKeyWithOptions = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key-2")    .setKeySize(4096)    .setExpiresOn(OffsetDateTime.now().plusYears(1))    .setNotBefore(OffsetDateTime.now())    .setEnabled(true)    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT,                        KeyOperation.WRAP_KEY, KeyOperation.UNWRAP_KEY)    .setTags(Map.of("environment", "production")));
// HSM-backed RSA keyKeyVaultKey hsmKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-hsm-key")    .setKeySize(2048)    .setHardwareProtected(true));

// EC key with P-256 curveKeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key")    .setCurveName(KeyCurveName.P_256));
// EC key with other curvesKeyVaultKey ecKey384 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-384")    .setCurveName(KeyCurveName.P_384));
KeyVaultKey ecKey521 = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key-521")    .setCurveName(KeyCurveName.P_521));
// HSM-backed EC keyKeyVaultKey ecHsmKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-hsm-key")    .setCurveName(KeyCurveName.P_256)    .setHardwareProtected(true));

KeyVaultKey octKey = keyClient.createOctKey(new CreateOctKeyOptions("my-symmetric-key")    .setKeySize(256)    .setHardwareProtected(true));

// Get latest versionKeyVaultKey key = keyClient.getKey("my-key");
// Get specific versionKeyVaultKey keyVersion = keyClient.getKey("my-key", "<version-id>");
// Get only key properties (no key material)KeyProperties keyProps = keyClient.getKey("my-key").getProperties();

KeyVaultKey key = keyClient.getKey("my-key");
// Update propertieskey.getProperties()    .setEnabled(false)    .setExpiresOn(OffsetDateTime.now().plusMonths(6))    .setTags(Map.of("status", "archived"));
KeyVaultKey updatedKey = keyClient.updateKeyProperties(key.getProperties(),    KeyOperation.ENCRYPT, KeyOperation.DECRYPT);

import com.azure.core.util.paging.PagedIterable;
// List all keysfor (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {    System.out.println("Key: " + keyProps.getName());    System.out.println("  Enabled: " + keyProps.isEnabled());    System.out.println("  Created: " + keyProps.getCreatedOn());}
// List key versionsfor (KeyProperties version : keyClient.listPropertiesOfKeyVersions("my-key")) {    System.out.println("Version: " + version.getVersion());    System.out.println("Created: " + version.getCreatedOn());}

import com.azure.core.util.polling.SyncPoller;
// Begin delete (soft-delete enabled vaults)SyncPoller<DeletedKey, Void> deletePoller = keyClient.beginDeleteKey("my-key");
// Wait for deletionDeletedKey deletedKey = deletePoller.poll().getValue();System.out.println("Deleted: " + deletedKey.getDeletedOn());
deletePoller.waitForCompletion();
// Purge deleted key (permanent deletion)keyClient.purgeDeletedKey("my-key");
// Recover deleted keySyncPoller<KeyVaultKey, Void> recoverPoller = keyClient.beginRecoverDeletedKey("my-key");recoverPoller.waitForCompletion();

import com.azure.security.keyvault.keys.cryptography.models.*;
CryptographyClient cryptoClient = new CryptographyClientBuilder()    .keyIdentifier("https://<vault>.vault.azure.net/keys/<key-name>")    .credential(new DefaultAzureCredentialBuilder().build())    .buildClient();
byte[] plaintext = "Hello, World!".getBytes(StandardCharsets.UTF_8);
// EncryptEncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);byte[] ciphertext = encryptResult.getCipherText();System.out.println("Ciphertext length: " + ciphertext.length);
// DecryptDecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);String decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);System.out.println("Decrypted: " + decrypted);

import java.security.MessageDigest;
// Create digest of databyte[] data = "Data to sign".getBytes(StandardCharsets.UTF_8);MessageDigest md = MessageDigest.getInstance("SHA-256");byte[] digest = md.digest(data);
// SignSignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);byte[] signature = signResult.getSignature();
// VerifyVerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);System.out.println("Valid signature: " + verifyResult.isValid());

// Key to wrap (e.g., AES key)byte[] keyToWrap = new byte[32];  // 256-bit keynew SecureRandom().nextBytes(keyToWrap);
// WrapWrapResult wrapResult = cryptoClient.wrapKey(KeyWrapAlgorithm.RSA_OAEP, keyToWrap);byte[] wrappedKey = wrapResult.getEncryptedKey();
// UnwrapUnwrapResult unwrapResult = cryptoClient.unwrapKey(KeyWrapAlgorithm.RSA_OAEP, wrappedKey);byte[] unwrappedKey = unwrapResult.getKey();

// Backupbyte[] backup = keyClient.backupKey("my-key");
// Save backup to fileFiles.write(Paths.get("key-backup.blob"), backup);
// Restorebyte[] backupData = Files.readAllBytes(Paths.get("key-backup.blob"));KeyVaultKey restoredKey = keyClient.restoreKeyBackup(backupData);

// Rotate to new versionKeyVaultKey rotatedKey = keyClient.rotateKey("my-key");System.out.println("New version: " + rotatedKey.getProperties().getVersion());
// Set rotation policyKeyRotationPolicy policy = new KeyRotationPolicy()    .setExpiresIn("P90D")  // Expire after 90 days    .setLifetimeActions(Arrays.asList(        new KeyRotationLifetimeAction(KeyRotationPolicyAction.ROTATE)            .setTimeBeforeExpiry("P30D")));  // Rotate 30 days before expiry
keyClient.updateKeyRotationPolicy("my-key", policy);
// Get rotation policyKeyRotationPolicy currentPolicy = keyClient.getKeyRotationPolicy("my-key");

import com.azure.security.keyvault.keys.models.ImportKeyOptions;import com.azure.security.keyvault.keys.models.JsonWebKey;
// Import existing key materialJsonWebKey jsonWebKey = new JsonWebKey()    .setKeyType(KeyType.RSA)    .setN(modulus)    .setE(exponent)    .setD(privateExponent)    // ... other RSA components    ;
ImportKeyOptions importOptions = new ImportKeyOptions("imported-key", jsonWebKey)    .setHardwareProtected(false);
KeyVaultKey importedKey = keyClient.importKey(importOptions);

import com.azure.core.exception.HttpResponseException;import com.azure.core.exception.ResourceNotFoundException;
try {    KeyVaultKey key = keyClient.getKey("non-existent-key");} catch (ResourceNotFoundException e) {    System.out.println("Key not found: " + e.getMessage());} catch (HttpResponseException e) {    System.out.println("HTTP error " + e.getResponse().getStatusCode());    System.out.println("Message: " + e.getMessage());}