Overview
The Key Management Service (KMS) is used for creating, storing, and managing cryptographic keys. It is used by various other services, including:
- The Decentralized Identifier (DID) service, which creates DIDs.
- The Issuer Service, which signs and issues credentials.
- The Verifier Service, which verifies credentials.
- The Credential Status Service, which signs status credentials.
When setting up the KMS, you have the option to choose where to store your keys. You can either use a local key store, which uses the database of the Enterprise Stack, or you can opt for an external KMS solution, such as AWS KMS, Azure Key Vault, HashiCorp Vault Transit Secrets Engine, or Oracle KMS. For production use-cases we recommend the usage of an external KMS.
External KMS Key Type Support
The Enterprise Stack accepts walt.id key type names in keyType and maps them to each provider's native key type names
when creating or resolving external KMS keys.
| Backend | Supported keyType values | Notes |
|---|---|---|
tse | Ed25519, secp256r1, secp384r1, secp521r1, RSA, RSA3072, RSA4096 | Uses HashiCorp Vault Transit Secrets Engine. secp256k1 is not supported by the TSE integration. |
aws / aws-rest-api | secp256r1, secp384r1, secp521r1, secp256k1, RSA, RSA3072, RSA4096 | Ed25519 is not supported by AWS KMS signing keys. |
azure / azure-rest-api | secp256r1, secp384r1, secp521r1, secp256k1, RSA, RSA3072, RSA4096 | secp256k1 maps to Azure's P-256K curve. Ed25519 is not supported. |
jwk | Ed25519, secp256k1, secp256r1, secp384r1, secp521r1, RSA, RSA3072, RSA4096 | Keys are generated and stored by the walt.id KMS service. |
Provider support only covers key generation and signing operations that the backing KMS exposes. If a provider rejects a key type, the API returns an explicit unsupported key type error instead of making a failing provider request.
Get Started
- Local: Manage and store keys in the Enterprise database.
- AWS KMS: Connect the service to AWS Key Management Service.
- HashiCorp Vault: Manage and store keys in HashiCorp Vault.
- Azure Key Vault: Manage and store keys in Azure Key Vault.