Merge pull request #265886 from Ije-oyibo/patch-1

Updating Keys with Cactus

Author: prmerger-automator[bot]

articles/key-vault/keys/about-keys-details.md

@@ -123,7 +123,14 @@ In addition to the key material, the following attributes may be specified. In a
 There are more read-only attributes that are included in any response that includes key attributes:  
 
 - *created*: IntDate, optional. The *created* attribute indicates when this version of the key was created. The value is null for keys created prior to the addition of this attribute. Its value MUST be a number containing an IntDate value.  
-- *updated*: IntDate, optional. The *updated* attribute indicates when this version of the key was updated. The value is null for keys that were last updated prior to the addition of this attribute. Its value MUST be a number containing an IntDate value.  
+- *updated*: IntDate, optional. The *updated* attribute indicates when this version of the key was updated. The value is null for keys that were last updated prior to the addition of this attribute. Its value MUST be a number containing an IntDate value.
+- *hsmPlatform*: string, optional. The underlying HSM Platform that is protecting a key.
+    - A hsmPlatform value of 2 means the key is protected by our latest FIPS 140 Level 3 validated HSM platform.
+    - A hsmPlatform value of 1 means the key is protected by our previous FIPS 140 Level 2 HSM platform using nCipher HSMs.
+    - A hsmPlatform value of 0 means the key is protected by a FIPS 140 Level 1 HSM software cryptographic module.
+    - if this is not set by a Managed HSM pool, it is protected by our latest FIPS 140 Level 3 validated HSM platform.
+ 
+It’s important to note that keys are bound to the HSM in which they were created. New keys are seamlessly created and stored in the new HSMs. While there is no way to migrate or transfer keys, new key versions are automatically in the new HSMs. For more information on how to migrate to a new key, see [How to migrate key workloads](../general/migrate-key-workloads.md).
 
 For more information on IntDate and other data types, see [About keys, secrets, and certificates: [Data types](../general/about-keys-secrets-certificates.md#data-types).
 

articles/key-vault/keys/about-keys.md

@@ -9,7 +9,7 @@ tags: azure-resource-manager
 ms.service: key-vault
 ms.subservice: keys
 ms.topic: overview
-ms.date: 01/24/2023
+ms.date: 02/09/2024
 ms.author: mbaldwin
 ---
 
@@ -38,9 +38,9 @@ Cryptographic keys in Key Vault are represented as JSON Web Key [JWK] objects. T
 
 The base JWK/JWA specifications are also extended to enable key types unique to the Azure Key Vault and Managed HSM implementations. 
 
-HSM-protected keys (also referred to as HSM-keys) are processed in an HSM (Hardware Security Module) and always remain HSM protection boundary. 
+HSM Keys in vaults are protected". The Software keys are not protected by HSMs.
 
-- Vaults use **FIPS 140-2 Level 2** validated HSMs to protect HSM-keys in shared HSM backend infrastructure. 
+- Keys stored in vaults benefit from robust protection using **FIPS 140-2 HSMs**. There are two distinct HSM platforms available: 1, which protects key versions with **FIPS 140-2 Level 2**  and 2, which protects keys with **FIPS 140-2 Level 3** HSMs depending on when the key was created. All new keys and key versions are now created using platform 2 (except UK geo). To determine which HSM Platform is protecting a key version, get it's [hsmPlatform](about-keys-details.md#key-attributes). 
 - Managed HSM  uses **FIPS 140-2 Level 3** validated HSM modules to protect your keys. Each HSM pool is an isolated single-tenant instance with its own [security domain](../managed-hsm/security-domain.md) providing complete cryptographic isolation from all other HSMs sharing the same hardware infrastructure.
 
 These keys are protected in single-tenant HSM-pools. You can import an RSA, EC, and symmetric key, in soft form or by exporting from a supported HSM device. You can also generate keys in HSM pools. When you import HSM keys using the method described in the [BYOK (bring your own key) specification](../keys/byok-specification.md), it enables secure transportation key material into Managed HSM pools. 
@@ -72,9 +72,10 @@ Key Vault supports RSA and EC keys. Managed HSM supports RSA, EC, and symmetric
 
 |Key type and destination|Compliance|
 |---|---|
-|Software-protected keys in vaults (Premium & Standard SKUs) | FIPS 140-2 Level 1|
-|HSM-protected keys in vaults (Premium SKU)| FIPS 140-2 Level 2|
-|HSM-protected keys in Managed HSM|FIPS 140-2 Level 3|
+|Software-protected (hsmPlatform 0) keys in vaults | FIPS 140-2 Level 1|
+|hsmPlatform 1 protected keys in vaults (Premium SKU)| FIPS 140-2 Level 2|
+|hsmPlatform 2 protected keys in vaults (Premium SKU)| FIPS 140-2 Level 3|
+|Keys in Managed HSM are always HSM protected|FIPS 140-2 Level 3|
 |||
 
 See [Key types, algorithms, and operations](about-keys-details.md) for details about each key type, algorithms, operations, attributes, and tags.