The key used for HMAC and AES.
getKey(): Uint8Array; setKey(key: Uint8Array): void;
This property specifies the key used when signing with an HMAC algorithm or encrypting with an AES algorithm.
This property is applicable when SigningAlgorithm is set to an HMAC algorithm.
It is recommended that the length of the key be equal to or larger than the hash size of the algorithm. Use of keys shorter than the hash size is discouraged.
Sizes (in bytes)
|Recommended Key Size||20||28||32||48||64||16||20|
Key Length Details
As mentioned above it is recommended to use a key size equal to the hash size. Use of keys larger than the hash size does not typically significantly increase the function strength. Keys of any length are technically valid however see the below processing rules to understand how keys of varying lengths are treated:
- If the key length is equal to the hash size (recommended) it is used without modification.
- If the key length is less than the hash size it is used without modification.
- If the key length is less than or equal to the block size it is used without modification.
- If the key length is larger than the block size is it first hashed with the same algorithm.
When EncryptionAlgorithm is set to an AES algorithm this property must hold the symmetric key used for encryption and decryption. The size of the key must match the size of the algorithm. For instance when selecting the algorithm A256GCMKW (AES 256) the size of the key must also be 256 bits (32 bytes).
In the case where EncryptionAlgorithm is set to Direct this key is used directly with the algorithm specified by ContentEncryptionAlgorithm and must be an appropriate size for the selected ContentEncryptionAlgorithm.