AzureKeys Class

Properties   Methods   Events   Configuration Settings   Errors  

The AzureKeys class makes it easy to interact with keys in Azure Key Vaults.

Syntax

cloudkeys.azurekeys()

Remarks

The AzureKeys class provides an easy-to-use interface for the key-related functionality of the Azure Key Vault service. Azure Key Vault allows you to works with a few different kinds of resources, one of which is asymmetric key pairs. This class helps you to create, manage, and use said key pairs (or just "keys", for short) for cryptographic operations. To work with "secrets" instead, refer to the AzureSecrets class.

To begin, register for an Azure account and create one or more Key Vaults via the Azure Portal. Set the Vault property to the name of the vault you wish to work with.

This class supports authentication via OAuth 2.0. First, perform OAuth authentication using the OAuth class or a separate process. Once complete you should have an authorization string which looks like:

Bearer ya29.AHES6ZSZEJzATdZYjeihDn5W-VrXSsxEZu5p0pclxGdKKQ

Assign this value to the Authorization property before attempting any operations. Consult the documentation for the service for more information about supported scope values and more details on OAuth authentication.

Using the Class

Keys can be created using the CreateKey method. A key's name and type (i.e., whether it is RSA or EC, and its size or curve, respectively) must be set at the time of creation, and cannot be changed later. A list of cryptographic operations that the key is valid for must also be set, but can be changed at any time using the UpdateKey. If a key with the specified name already exists, a new version of it is created; this makes it easy to "rotate" a key.

When a key will no longer be used, it can be deleted using the DeleteKey method. However, the key will only be soft-deleted; by default, Azure will permanently delete it after the waiting period configured for the vault. During this waiting period, the soft-deleted key may be recovered using RecoverKey, or permanently deleted using PurgeKey (assuming the currently-authenticated user has the permissions to do so).

azurekeys.CreateKey("mykey", "RSA_2048", "encrypt,decrypt,sign,verify,wrapKey,unwrapKey");

// ... Some time later, when the key is no longer needed ...
azurekeys.DeleteKey("mykey");

// At this point, the key is only soft-deleted. It could be recovered...
azurekeys.RecoverKey("mykey");
// ...or permanently deleted.
azurekeys.PurgeKey("mykey");

To list keys, use the ListKeys method. This method is also used to list soft-deleted keys if the GetDeleted configuration setting has been enabled first. To list a key's versions, use the ListVersions method. (You cannot list a deleted key's versions.) In all cases, the IncludeKeyDetails property can optionally be enabled to have the class attempt to retrieve the full information for each key (Azure leaves out certain fields by default when listing).

// If there are many keys to list, there may be multiple pages of results. This will
// cause all pages of results to be accumulated into the Keys collection property.
do {
  azurekeys.ListKeys();
} while (!string.IsNullOrEmpty(azurekeys.KeyMarker));

// A similar thing applies to key versions as well.
do {
  azurekeys.ListVersions("mykey");
} while (!string.IsNullOrEmpty(azurekeys.VersionMarker));

Depending on a key's "key ops" list, it can be used to perform different cryptographic operations. Keys with the encrypt and decrypt ops can be used in Encrypt and Decrypt operations. Keys with the sign and verify ops can be used in Sign and Verify. Finally, keys with the wrapKey and unwrapKey ops can be used in WrapKey and UnwrapKey operations (which are just like encryption and decryption, but which are intended to be used for wrapping a symmetric key, and which require different permissions to call successfully).

To perform a cryptographic operation, use InputData or InputFile to supply the input data that should be processed. All operations will output the result data to OutputData or OutputFile (except Verify; refer to its documentation for more information).

azurekeys.CreateKey("mykey", "RSA_2048", "encrypt,decrypt");

azurekeys.InputData = "Test123";
azurekeys.OutputFile = "C:/temp/enc.dat";
azurekeys.Encrypt("mykey", "RSA-OAEP-256");

azurekeys.InputFile = "C:/temp/enc.dat";
azurekeys.OutputFile = ""; // So that the data will be output to the OutputData property.
azurekeys.Decrypt("mykey", "RSA-OAEP-256");

The class also supports a variety of other functionality, including:

• Retrieval of a single key's information (including public key) with GetKeyInfo.
• Enabling and disabling keys with SetKeyEnabled.
• Tagging support using AddTag and the Tag* properties.
• Secure key backup and restoration using BackupKey and RestoreKey.
• And more!

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Authorization	OAuth 2.0 Authorization Token.
FirewallAutoDetect	This property tells the class whether or not to automatically detect and use firewall system settings, if available.
FirewallType	This property determines the type of firewall to connect through.
FirewallHost	This property contains the name or IP address of firewall (optional).
FirewallPassword	This property contains a password if authentication is to be used when connecting through the firewall.
FirewallPort	This property contains the TCP port for the firewall Host .
FirewallUser	This property contains a user name if authentication is to be used connecting through a firewall.
Idle	The current status of the class.
IncludeKeyDetails	Whether to attempt to retrieve fill details when listing keys.
InputData	The data to process.
InputFile	The file whose data should be processed.
KeyMarker	A marker indicating what page of keys to return next.
KeyCount	The number of records in the Key arrays.
KeyCreationDate	The creation date of the key.
KeyDeletionDate	The deletion date of the key.
KeyEnabled	Whether the key is enabled.
KeyExpiryDate	The expiration date of the key.
KeyOps	The operation that the key may be used for.
KeyType	The key's type.
KeyName	The name of the key.
KeyNotBeforeDate	The 'not before' date of the key.
KeyPublicKey	The key's public key.
KeyPurgeDate	The purge date of the key.
KeyRecoverableDays	The number of days the key will be recoverable if it gets deleted.
KeyRecoveryLevel	The key's ability to be recovered and/or purged if it gets deleted.
KeyUpdateDate	The update date of the key.
KeyVersionId	The version Id of the key.
LocalHost	The name of the local host or user-assigned IP interface through which connections are initiated or accepted.
OtherHeaders	Other headers as determined by the user (optional).
OutputData	The output data.
OutputFile	The file to which output data should be written.
Overwrite	Whether the output file should be overwritten if necessary.
ParsedHeaderCount	The number of records in the ParsedHeader arrays.
ParsedHeaderField	This property contains the name of the HTTP header (same case as it is delivered).
ParsedHeaderValue	This property contains the header contents.
ProxyAuthScheme	This property is used to tell the class which type of authorization to perform when connecting to the proxy.
ProxyAutoDetect	This property tells the class whether or not to automatically detect and use proxy system settings, if available.
ProxyPassword	This property contains a password if authentication is to be used for the proxy.
ProxyPort	This property contains the TCP port for the proxy Server (default 80).
ProxyServer	If a proxy Server is given, then the HTTP request is sent to the proxy instead of the server otherwise specified.
ProxySSL	This property determines when to use SSL for the connection to the proxy.
ProxyUser	This property contains a user name, if authentication is to be used for the proxy.
QueryParamCount	The number of records in the QueryParam arrays.
QueryParamName	The name of the query parameter.
QueryParamValue	The value of the query parameter.
SSLAcceptServerCertEncoded	The certificate (PEM/base64 encoded).
SSLCertEncoded	The certificate (PEM/base64 encoded).
SSLCertStore	The name of the certificate store for the client certificate.
SSLCertStorePassword	If the certificate store is of a type that requires a password, this property is used to specify that password in order to open the certificate store.
SSLCertStoreType	The type of certificate store for this certificate.
SSLCertSubject	The subject of the certificate used for client authentication.
SSLServerCertEncoded	The certificate (PEM/base64 encoded).
TagCount	The number of records in the Tag arrays.
TagName	The name of the tag.
TagValue	The value of the tag.
Timeout	A timeout for the class.
Vault	Selects a vault for the class to interact with.
VersionMarker	A marker indicating what page of key versions to return next.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

AddQueryParam	Adds a query parameter to the QueryParams properties.
AddTag	Adds an item to the Tags properties.
BackupKey	Backs up a key.
Config	Sets or retrieves a configuration setting.
CreateKey	Creates a new key.
Decrypt	Decrypts data using a key.
DeleteKey	Deletes a key.
DoEvents	Processes events from the internal message queue.
Encrypt	Encrypts data using a key.
GetKeyInfo	Gets a key's information and public key.
ListKeys	Lists keys in the currently-selected vault.
ListVersions	Lists versions of a key.
PurgeKey	Permanently deletes a soft-deleted key.
RecoverKey	Recovers a soft-deleted key.
Reset	Resets the class to its initial state.
RestoreKey	Restores a previously backed-up key to the vault.
SendCustomRequest	Sends a custom request to the server.
SetKeyEnabled	Enables or disables a key.
Sign	Signs a message using a key.
UnwrapKey	Unwraps a symmetric key.
UpdateKey	Updates a key's information.
Verify	Verifies a digital signature using a key.
WrapKey	Wraps a symmetric key.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

EndTransfer	Fired when a document finishes transferring.
Error	Information about errors during data delivery.
Header	Fired every time a header line comes in.
KeyList	Fires once for each key when listing keys.
Log	Fires once for each log message.
SSLServerAuthentication	Fired after the server presents its certificate to the client.
SSLStatus	Shows the progress of the secure connection.
StartTransfer	Fired when a document starts transferring (after the headers).
TagList	Fires once for each tag returned when a key's information is retrieved.
Transfer	Fired while a document transfers (delivers document).

Configuration Settings

---

The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.

AccumulatePages	Whether the class should accumulate subsequent pages of results when listing them.
APIVersion	The Azure Key Vault API version that the class conforms to.
CreateKeyEnabled	Whether new keys should be created in an enabled or disabled state.
ExpiryDate	The expiry date to send for the key.
GetDeleted	Whether the class should retrieve information about soft-deleted keys.
MaxKeys	The maximum number of results to return when listing keys.
MessageDigest	The message digest computed by the class during the last sign or verify operation, if any.
NotBeforeDate	The 'not before' date to send for the key.
RawRequest	Returns the data that was sent to the server.
RawResponse	Returns the data that was received from the server.
VersionId	The Id of the key version that the class should make requests against.
XChildCount	The number of child elements of the current element.
XChildName[i]	The name of the child element.
XChildXText[i]	The inner text of the child element.
XElement	The name of the current element.
XParent	The parent of the current element.
XPath	Provides a way to point to a specific element in the returned XML or JSON response.
XSubTree	A snapshot of the current element in the document.
XText	The text of the current element.
AcceptEncoding	Used to tell the server which types of content encodings the client supports.
AllowHTTPCompression	This property enables HTTP compression for receiving data.
AllowHTTPFallback	Whether HTTP/2 connections are permitted to fallback to HTTP/1.1.
Append	Whether to append data to LocalFile.
Authorization	The Authorization string to be sent to the server.
BytesTransferred	Contains the number of bytes transferred in the response data.
ChunkSize	Specifies the chunk size in bytes when using chunked encoding.
CompressHTTPRequest	Set to true to compress the body of a PUT or POST request.
EncodeURL	If set to true the URL will be encoded by the class.
FollowRedirects	Determines what happens when the server issues a redirect.
GetOn302Redirect	If set to true the class will perform a GET on the new location.
HTTP2HeadersWithoutIndexing	HTTP2 headers that should not update the dynamic header table with incremental indexing.
HTTPVersion	The version of HTTP used by the class.
IfModifiedSince	A date determining the maximum age of the desired document.
KeepAlive	Determines whether the HTTP connection is closed after completion of the request.
KerberosSPN	The Service Principal Name for the Kerberos Domain Controller.
LogLevel	The level of detail that is logged.
MaxRedirectAttempts	Limits the number of redirects that are followed in a request.
NegotiatedHTTPVersion	The negotiated HTTP version.
OtherHeaders	Other headers as determined by the user (optional).
ProxyAuthorization	The authorization string to be sent to the proxy server.
ProxyAuthScheme	The authorization scheme to be used for the proxy.
ProxyPassword	A password if authentication is to be used for the proxy.
ProxyPort	Port for the proxy server (default 80).
ProxyServer	Name or IP address of a proxy server (optional).
ProxyUser	A user name if authentication is to be used for the proxy.
SentHeaders	The full set of headers as sent by the client.
StatusLine	The first line of the last response from the server.
TransferredData	The contents of the last response from the server.
TransferredDataLimit	The maximum number of incoming bytes to be stored by the class.
TransferredHeaders	The full set of headers as received from the server.
TransferredRequest	The full request as sent by the client.
UseChunkedEncoding	Enables or Disables HTTP chunked encoding for transfers.
UseIDNs	Whether to encode hostnames to internationalized domain names.
UsePlatformHTTPClient	Whether or not to use the platform HTTP client.
UserAgent	Information about the user agent (browser).
ConnectionTimeout	Sets a separate timeout value for establishing a connection.
FirewallAutoDetect	Tells the class whether or not to automatically detect and use firewall system settings, if available.
FirewallHost	Name or IP address of firewall (optional).
FirewallPassword	Password to be used if authentication is to be used when connecting through the firewall.
FirewallPort	The TCP port for the FirewallHost;.
FirewallType	Determines the type of firewall to connect through.
FirewallUser	A user name if authentication is to be used connecting through a firewall.
KeepAliveInterval	The retry interval, in milliseconds, to be used when a TCP keep-alive packet is sent and no response is received.
KeepAliveTime	The inactivity time in milliseconds before a TCP keep-alive packet is sent.
Linger	When set to True, connections are terminated gracefully.
LingerTime	Time in seconds to have the connection linger.
LocalHost	The name of the local host through which connections are initiated or accepted.
LocalPort	The port in the local host where the class binds.
MaxLineLength	The maximum amount of data to accumulate when no EOL is found.
MaxTransferRate	The transfer rate limit in bytes per second.
ProxyExceptionsList	A semicolon separated list of hosts and IPs to bypass when using a proxy.
TCPKeepAlive	Determines whether or not the keep alive socket option is enabled.
TcpNoDelay	Whether or not to delay when sending packets.
UseIPv6	Whether to use IPv6.
LogSSLPackets	Controls whether SSL packets are logged when using the internal security API.
OpenSSLCADir	The path to a directory containing CA certificates.
OpenSSLCAFile	Name of the file containing the list of CA's trusted by your application.
OpenSSLCipherList	A string that controls the ciphers to be used by SSL.
OpenSSLPrngSeedData	The data to seed the pseudo random number generator (PRNG).
ReuseSSLSession	Determines if the SSL session is reused.
SSLCACertFilePaths	The paths to CA certificate files on Unix/Linux.
SSLCACerts	A newline separated list of CA certificate to use during SSL client authentication.
SSLCheckCRL	Whether to check the Certificate Revocation List for the server certificate.
SSLCipherStrength	The minimum cipher strength used for bulk encryption.
SSLEnabledCipherSuites	The cipher suite to be used in an SSL negotiation.
SSLEnabledProtocols	Used to enable/disable the supported security protocols.
SSLEnableRenegotiation	Whether the renegotiation_info SSL extension is supported.
SSLIncludeCertChain	Whether the entire certificate chain is included in the SSLServerAuthentication event.
SSLNegotiatedCipher	Returns the negotiated ciphersuite.
SSLNegotiatedCipherStrength	Returns the negotiated ciphersuite strength.
SSLNegotiatedCipherSuite	Returns the negotiated ciphersuite.
SSLNegotiatedKeyExchange	Returns the negotiated key exchange algorithm.
SSLNegotiatedKeyExchangeStrength	Returns the negotiated key exchange algorithm strength.
SSLNegotiatedProtocol	Returns the negotiated protocol version.
SSLProvider	The name of the security provider to use.
SSLSecurityFlags	Flags that control certificate verification.
SSLServerCACerts	A newline separated list of CA certificate to use during SSL server certificate validation.
TLS12SignatureAlgorithms	Defines the allowed TLS 1.2 signature algorithms when UseInternalSecurityAPI is True.
TLS12SupportedGroups	The supported groups for ECC.
TLS13KeyShareGroups	The groups for which to pregenerate key shares.
TLS13SignatureAlgorithms	The allowed certificate signature algorithms.
TLS13SupportedGroups	The supported groups for (EC)DHE key exchange.
AbsoluteTimeout	Determines whether timeouts are inactivity timeouts or absolute timeouts.
FirewallData	Used to send extra data to the firewall.
InBufferSize	The size in bytes of the incoming queue of the socket.
OutBufferSize	The size in bytes of the outgoing queue of the socket.
BuildInfo	Information about the product's build.
CodePage	The system code page used for Unicode to Multibyte translations.
LicenseInfo	Information about the current license.
ProcessIdleEvents	Whether the class uses its internal event loop to process events when the main thread is idle.
SelectWaitMillis	The length of time in milliseconds the class will wait when DoEvents is called if there are no events to process.
UseInternalSecurityAPI	Tells the class whether or not to use the system security libraries or an internal implementation.