<p>This is what is reported in the thales documentation:</p>
<pre><code>Private Key Import/Export Private keys can be imported and exported with existing PKCS#11 functions. 
They can be imported and exported only if the HSM uses the key wrap model instead of cloning.
Import a key by calling C_Encrypt*() on the serialized key followed by C_UnwrapKey(). Exporting keys by calling C_WrapKey() followed by C_Decrypt*().
Use C_WrapKey() and C_UnwrapKey() to store keys off the HSM, or to move them between HSMs.
</code></pre>
<p>I don't know the use of PKCS11;</p>
<blockquote>
<p>which key is used for the wrap?</p>
</blockquote>

CC BY-SA 4.0
2020-10-25T14:33:56.417Z
2020-10-25T14:33:56.417Z
MaXbeMan
<p>I need some clarification on how keys are imported into a HSM Luna SA. I should import BIP 32 private keys of multisign wallets. There are currently two keys: one for the user and one held by the company that would like to start using HSMs.</p>
<blockquote>
<p>I start with a general question: is it better to keep all the
individual private keys in the hsm or a single master key that is used
to encrypt the private keys of the wallets?</p>
<p>How are BIP32 keys imported into an HSM? Is the serialized format
used?
Are there any other keys that are needed for the import (wrap for
example)?</p>
</blockquote>
<p>I accept other advice on implementing the BIP32 with the Luna.</p>

CC BY-SA 4.0
2020-10-25T12:51:26.087Z
Have you asked [Thales customer support](https://cpl.thalesgroup.com/customer-support)?
RedGrittyBrick
<private-key><bip32-hd-wallets><wallet-security><private-key-import>
Import private key in HSM Luna SA
MaXbeMan
# Import private key in HSM Luna SA

(Asked by: username_0 on 2020-10-24)

I need some clarification on how keys are imported into a HSM Luna SA. I should import BIP 32 private keys of multisign wallets. There are currently two keys: one for the user and one held by the company that would like to start using HSMs.

> I start with a general question: is it better to keep all the
> individual private keys in the hsm or a single master key that is used
> to encrypt the private keys of the wallets?
>
> How are BIP32 keys imported into an HSM? Is the serialized format
> used?
> Are there any other keys that are needed for the import (wrap for
> example)?

I accept other advice on implementing the BIP32 with the Luna.

**Tags:** private-key, bip32-hd-wallets, wallet-security, private-key-import

> **Comments:**
> **username_1**: Have you asked [Thales customer support](https://cpl.thalesgroup.com/customer-support)?  

---

## 1 answers

### Answer by username_0 on 2020-10-25. Score: 0

This is what is reported in the thales documentation:
Private Key Import/Export Private keys can be imported and exported with existing PKCS#11 functions. 
They can be imported and exported only if the HSM uses the key wrap model instead of cloning.
Import a key by calling C_Encrypt*() on the serialized key followed by C_UnwrapKey(). Exporting keys by calling C_WrapKey() followed by C_Decrypt*().
Use C_WrapKey() and C_UnwrapKey() to store keys off the HSM, or to move them between HSMs.

I don't know the use of PKCS11;

which key is used for the wrap?


---

