> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Deploying Key Lifecycle Management Services
> Step-by-step deployment of Key Lifecycle Management services for specific use cases.
You can deploy multiple services to support individual use cases, including the following Key Lifecycle Management Services:
* **Initial KTK for Key Exchange**: Using existing plaintext components, a new KTK is created under the CryptoHub master key, which you can then use to import and export working keys.
* **Generate Key**: This service generates keys by using pre-defined Key Types and enables you to export them under a KTK.
* **Import Key**: This service enables you to import a new key (either Global or New key type) under an existing KTK.
The following deployments form an initial **KTK, TEST KTK,** from three plaintext components, generate a **PEK, TEST PEK 1,** with the option to export under the KTK, and then import a **PEK, TEST PEK 2,** under the KTK.
## Initial KTK (KEK/ZMK) for key exchange
Perform the following tasks to complete this process:
1. Deploy the Key Lifecycle Management service.
2. Enter and combine KTK components.
### Deploy the Key Lifecycle Management service
Perform the following steps to deploy the Key Lifecycle Management service.
Log in to the CryptoHub web dashboard under dual control with your Administrator users.
On the **Service Management** page, search for **Key Lifecycle Management** or select the **Key Management** service category and then select the **Key Lifecycle Management** service.
Select **\[ Deploy ]**.
Configure **Service Setup** as follows:
* **Service Name**: Select **3DES KTK XOR 3 Components**
* **Service Category**: Select **Key Management**
Configure **Access Control** as follows:
* Add the following roles:
* **Key Manager**
* **Key Holder**
Configure **Key Approval Setup** as follows:
* Add the following roles:
* **Key Holder**
Configure **Key Configuration** as follows:
* **Algorithm Type**: Select **Symmetric**
* **Source**: Select **XOR components import**
* **Component Source**: Select **Trusted key custodians**
* **Components**: Select **3**
* **Key Types**:
* Select **\[ Add Key Type ]**
* Select **\[ Autofill From Existing ]**
* Select the **3DES KTK** checkbox.
* Select **\[ Save ]**
* **Permissions for Created Key**: Select **All users of service**
Configure **Print Key** as follows:
* **Destination**: Select **Do not print**
Configure **Webhook** as follows:
* **Destination**: Select **No webhook**
Configure **Lifecycle Management** as follows:
* **State: Active**
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic)
* Select **\[ Next ]**
* **State: Archived**
* Select **Enable** or **Disable**
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic)
* Select **\[ Next ]**
* **State: Deactivated**
* Select **Enable** or **Disable**.
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic).
* Select **\[ Next ]**
* **State: Destroyed**
* This state is always enabled for the service.
* Manual Transition is required for this state.
Select **\[ Deploy ]**.
### Enter and combine KTK components
Perform the following steps to enter and combine KTK components:
Log out of CryptoHub if you are still logged in with the Administrator users.
Log in to the CryptoHub web dashboard with the **KeyHolderA** user.
On the **Service Management** page, go to the **Key Wizard** tab and configure **New Key** as follows:
* **Service**: Select **3DES KTK XOR 3 Components**.
* **Key Type**: Select **3DES KTK**.
* **Key Name**: Enter `Test KTK`.
On the **Service Management** page, go to the **Deployed Services** tab and select the Key Lifecycle Management service you deployed (such as **3DES KTK XOR 3 Components**).
Go to **Key Orders/Approvals**.
Select the checkmark under **Actions** to approve the **Test KTK** key order.
Perform the following steps:
1. Enter the first plaintext component
* 9EE6 5104 E82A 9ED4
* 88B8 7516 014A 1426
* 9F35 BCEA 104F 0D29
Component KCV 5FA3
2. Select **\[ Load Component ]** and note the **KCV (Key Check Value)** in the pop-up dialog.
**Note** Hover the cursor over the dialog window to avoid closing.
Log out of CryptoHub.
Log in to the CryptoHub web dashboard with the **KeyHolderB** user.
From the **Service Management** page, go to the **Deployed Services** tab and select the Key Lifecycle Management service you deployed (such as **3DES KTK XOR 3 Components**).
Go to **Key Orders/Approvals**.
Select the checkmark under **Actions** to approve the **Test KTK** key order.
1. Enter the second plaintext component:
1. A8A7 26D6 5152 6438
2. 0E07 8C13 1F25 759B
3. 9E58 E551 2957 5116
Component KCV 2AF8
2. Select **\[ Load Component ]** and note the **KCV** in the pop-up dialog.
**Note** Hover the cursor over the dialog window to avoid closing.
Log out of CryptoHub.
Log in to the CryptoHub web dashboard with the **KeyHolderC** user.
On the **Service Management** page, go to the **Deployed Services** tab and select the Key Lifecycle Management service you deployed (such as **3DES KTK XOR 3 Components**).
Go to **Key Orders/Approvals**.
Select the checkmark under **Actions** to approve the **Test KTK** key order.
1. Enter the third (final) plaintext component:
* DC76 E50B BCDC C767
* EF29 3EF7 7A83 4946
* B35E D56E 15E0 9415
Component KCV E18B
2. Select **\[ Load Component ]** and note the **Final Checksum CAF9**.
**Note** Hover the cursor over the dialog window to avoid closing.
## Generate Key with the option to Export under KTK
Perform the following tasks to complete this process:
1. Deploy Key Lifecycle Management service.
2. Generate key.
3. Export key.
### Deploy Key Lifecycle Management service
Perform the following steps to deploy the Key Lifecycle Management service:
Log in to the CryptoHub web dashboard under dual control with the **KeyManager1** and **KeyManager2** users.
From the **Service Management** page, search for **Key Lifecycle Management** or select the **Key Management** service category and then select the **Key Lifecycle Management** service.
Select **\[ Deploy ]**.
Configure the **Service** as follows:
* **Service Name**: Select **Generate Key**.
* **Service Category**: Select **Key Management**.
Configure **Access Control** as follows:
* Add the following roles:
* **Key Manager**
Configure **Key Approval Setup** as follows:
* Do not add any roles.
Configure **Key Configuration** as follows:
* **Algorithm Type**: Select **Symmetric**.
* **Source**: Select **Randomly generated key**.
* **Approvals**: Select **0**.
* **Key Types**:
* Add the following Key Types: **3DES CVK**, **3DES MAK**, and **3DES PEK**.
* **Permissions for Created Key**: Select **All users of service**.
Configure **Print Key** as follows:
* **Destination**: Select **Do not print**.
Configure **Webhook** as follows:
* **Destination**: Select **No webhook**.
Configure **Lifecycle Management** as follows:
* **State: Active**
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic).
* Select **\[ Next ]**.
* **State: Archived**
* Choose to Enable or Disable.
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic).
* Select **\[ Next ]**
* **State: Deactivated**
* Choose to Enable or Disable.
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic).
* Select **\[ Next ]**.
* **State: Destroyed**
* This state is always enabled for the service.
* Manual Transition is required for this state.
Select **\[ Deploy ]**.
### Generate key
Perform the following steps to generate a key:
Go to the main **Service Management** page of the CryptoHub.
Go to the **Key Wizard** tab.
Configure **New Key** as follows:
* **Service**: Select **Generate Key**.
* **Key Type**: Select **3DES PEK**.
* **Key Name**: Enter `TEST PEK 1`.
Select **\[ Finish Setup ]**.
Select **\[ Manage Keys ]**.
In the **Actions** field for the key you created, select the **Information** icon and note the UUID of the key in the **Export** section.
### Export key
Perform the following steps to export the key:
Go to the main **Service Management** page of the CryptoHub.
Go to the **Deployed Services** tab.
Select the **Generate Key** service.
Select the **Key Orders** action.
In the **Actions** field for the key you created, select the **Information** icon.
In the **Export** section of the **Key Information** dialog **Keyblock** field, select either **\[ Copy ]** or **\[ Download ]**.
In the **Select a KTK** field, type **3DES KTK - Test KEK** and select the key.
Select **TR-31**, **AKB**, or **ECB no padding** for ANSI X9.17 cryptograms.
* **TR-31**
* B0096P0TN00E00008378AD73BB7B6408CCA6CA7C14D8BDDDAFE9E75957746E9FB23F31798B69C1F5C0A838DCB0B1408C
* **AKB**
* 1PUNE000,B1EAA2E7C35D27AD0ADA8F22441A01CF09473EC8246E50C3,288B4AB3AD55D308
* **Cryptogram**
* 9AE93957C36C22D7BA1A9657C85C4026
## Import Key under KTK
Perform the following tasks to complete this process:
1. Deploy Key Lifecycle Management service.
2. Import key.
### Deploy Key Lifecycle Management service
Perform the following steps to deploy the Key Lifecycle Management service:
Log in to the CryptoHub web dashboard under dual control with the **KeyManager1** and **KeyManager2** users.
From the **Service Management** page, search for **Key Lifecycle Management** or select the **Key Management** service category and then select the **Key Lifecycle Management** service.
Select **\[ Deploy ]**.
Configure **Service Setup** as follows:
* **Service Name**: Select **Import Key**.
* **Service Category**: Select **Key Management**.
Configure **Access Control** as follows:
* Add the following roles:
* **Key Manager**
Configure **Key Approval Setup** as follows:
* Do not add any roles
Configure **Key Configuration** as follows:
* **Algorithm Type**: Select **Symmetric**.
* **Source**: Select **KTK impor** t.
* **Select KTKs**: Select **3DES KTK - Test KEK**.
* **Approvals**: Select **0**.
* **Key Types**:
1. Select **\[ Add Key Type ]**
2. Select **\[ Autofill From Existing ]**
3. Select the checkmark next to **3DES CVK**
4. Select **\[ Save ]**
5. Select **\[ Add Key Type ]**
6. Select **\[ Autofill From Existing ]**
7. Select the checkmark next to **3DES MAK**
8. Select **\[ Save ]**
9. Select **\[ Add Key Type ]**
10. Select **\[ Autofill From Existing ]**
11. Select the checkmark next to **3DES PEK**
12. Select **\[ Save ]**
* **Permissions for Created Key**: Select **All users of service**.
Configure **Print Key** as follows:
* **Destination**: Select **Do not print**.
Configure **Webhook** as follows:
* **Destination**: Select **No webhook**.
Configure **Lifecycle Management** as follows:
* **State: Active**
1. Select either **Manual** or **Automatic Transition** (specify the transition period if you selected Automatic)
2. Select **\[ Next ]**
* **State: Archived**
1. Choose to Enable or Disable
2. Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic).
3. Select **\[ Next ]**.
* **State: Deactivated**
* Choose to Enable or Disable.
* Select **Manual** or **Automatic Transition** (specify the transition period if you selected automatic).
* Select **\[ Next ]**.
* **State: Destroyed**
* This state is always enabled for the service.
* Manual Transition is required for this state.
Select **\[ Deploy ]**.
### Import key
Perform the following steps to import the key:
Go to the main **Service Management** page of the CryptoHub.
Go to the **Key Wizard** tab.
Configure **New Key** as follows:
* **Service**: Select **Generate Key**.
* **Key Type**: Select **3DES PEK**.
* **Key Name**: Enter `TEST PEK 2`.
Configure **Transfer Key Selection** as follows:
* **Transfer Key**: Select **Test KEK**.
* **Key Block**: Select **B0096P0TN00E00008378AD73BB7B6408CCA6CA7C14D8BDDDAFE9E75957746E9FB23F31798B69C1F5C0A838DCB0B1408C**.
* **Format**: TR-31
Select **\[ Finish Setup ]**.
Select **\[ Manage Keys ]**.
In the **Actions** field for the key you created, select the **Information** icon and note the UUID of the key in the **Export** section.