Function: createHsmKeyWrap()
createHsmKeyWrap(
custodian,activeHandle):Promise<KeyWrap>
Defined in: packages/key-wrap/src/hsm.ts:112
Builds the hardware adapter over a custodian that is already started.
It proves the handle before it returns, by wrapping and unwrapping a throwaway key: a handle for another token, for a key that is not there, or for a signing key fails the start and says so, where the alternative is the first person created after a deployment finding out. The check costs two calls to the token, once.
The adapter wraps and unwraps under any wrapping key the custodian's token holds, not
activeHandle alone, so values wrapped under a previous handle stay readable after the
active one changes; activeKekId only says which key new wraps should use.
Parameters
custodian
The started custodian whose token holds the wrapping key. The caller keeps ownership and closes it.
activeHandle
string
The handle generateWrappingKey returned, from configuration
(keyWrap.hsm.handle). It becomes KeyWrap.activeKekId.
Returns
Promise<KeyWrap>
The port.
Throws
invalid_key_id when activeHandle is not an hsm: handle;
unknown_kek, custody_refused or custody_unavailable when the token would not
wrap under it; unwrap_failed when the token did not return the key it was given,
which means the module is broken.