Azure Key Vault Keys SDK for Java Acceptance Criteria

SDK: com.azure:azure-security-keyvault-keysRepository: https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/keyvault-v2/azure-security-keyvault-keysPurpose: Skill testing acceptance criteria for validating generated code correctness

---

1. Correct Import Patterns

1.1 Client Imports

✅ CORRECT: Key and Cryptography Clients

import com.azure.security.keyvault.keys.KeyClient;
import com.azure.security.keyvault.keys.KeyClientBuilder;
import com.azure.security.keyvault.keys.KeyAsyncClient;
import com.azure.security.keyvault.keys.cryptography.CryptographyClient;
import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;

✅ CORRECT: Authentication

import com.azure.identity.DefaultAzureCredentialBuilder;

1.2 Model Imports

✅ CORRECT: Key Models

import com.azure.security.keyvault.keys.models.KeyVaultKey;
import com.azure.security.keyvault.keys.models.KeyProperties;
import com.azure.security.keyvault.keys.models.CreateRsaKeyOptions;
import com.azure.security.keyvault.keys.models.CreateEcKeyOptions;
import com.azure.security.keyvault.keys.models.KeyOperation;
import com.azure.security.keyvault.keys.models.KeyCurveName;
import com.azure.security.keyvault.keys.models.DeletedKey;

✅ CORRECT: Cryptography Models

import com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm;
import com.azure.security.keyvault.keys.cryptography.models.EncryptResult;
import com.azure.security.keyvault.keys.cryptography.models.DecryptResult;
import com.azure.security.keyvault.keys.cryptography.models.SignatureAlgorithm;
import com.azure.security.keyvault.keys.cryptography.models.SignResult;
import com.azure.security.keyvault.keys.cryptography.models.VerifyResult;
import com.azure.security.keyvault.keys.cryptography.models.KeyWrapAlgorithm;

---

2. Client Creation Patterns

2.1 ✅ CORRECT: KeyClient with DefaultAzureCredential

String vaultUrl = System.getenv("AZURE_KEYVAULT_URL");

KeyClient keyClient = new KeyClientBuilder()
    .vaultUrl(vaultUrl)
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

2.2 ✅ CORRECT: CryptographyClient

CryptographyClient cryptoClient = new CryptographyClientBuilder()
    .keyIdentifier(vaultUrl + "/keys/my-key")
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

---

3. Key Operations

3.1 ✅ CORRECT: Create RSA Key

KeyVaultKey rsaKey = keyClient.createRsaKey(new CreateRsaKeyOptions("my-rsa-key")
    .setKeySize(2048)
    .setKeyOperations(KeyOperation.ENCRYPT, KeyOperation.DECRYPT));

3.2 ✅ CORRECT: Create EC Key

KeyVaultKey ecKey = keyClient.createEcKey(new CreateEcKeyOptions("my-ec-key")
    .setCurveName(KeyCurveName.P_256));

3.3 ✅ CORRECT: Get and List Keys

KeyVaultKey key = keyClient.getKey("my-key");

for (KeyProperties keyProps : keyClient.listPropertiesOfKeys()) {
    System.out.println("Key: " + keyProps.getName());
}

3.4 ✅ CORRECT: Delete Key

SyncPoller<DeletedKey, Void> deletePoller = keyClient.beginDeleteKey("my-key");
deletePoller.waitForCompletion();

---

4. Cryptographic Operations

4.1 ✅ CORRECT: Encrypt/Decrypt

byte[] plaintext = "Hello, World!".getBytes(StandardCharsets.UTF_8);

EncryptResult encryptResult = cryptoClient.encrypt(EncryptionAlgorithm.RSA_OAEP, plaintext);
byte[] ciphertext = encryptResult.getCipherText();

DecryptResult decryptResult = cryptoClient.decrypt(EncryptionAlgorithm.RSA_OAEP, ciphertext);
String decrypted = new String(decryptResult.getPlainText(), StandardCharsets.UTF_8);

4.2 ✅ CORRECT: Sign/Verify

byte[] digest = MessageDigest.getInstance("SHA-256").digest(data);

SignResult signResult = cryptoClient.sign(SignatureAlgorithm.RS256, digest);
byte[] signature = signResult.getSignature();

VerifyResult verifyResult = cryptoClient.verify(SignatureAlgorithm.RS256, digest, signature);
System.out.println("Valid: " + verifyResult.isValid());

---

5. Error Handling

5.1 ✅ CORRECT: Exception Handling

import com.azure.core.exception.HttpResponseException;
import com.azure.core.exception.ResourceNotFoundException;

try {
    keyClient.getKey("non-existent-key");
} catch (ResourceNotFoundException e) {
    System.out.println("Key not found");
} catch (HttpResponseException e) {
    System.out.println("HTTP error: " + e.getResponse().getStatusCode());
}

---

6. Best Practices Checklist

• [ ] Use DefaultAzureCredential for authentication
• [ ] Use environment variables for vault URL
• [ ] Use HSM keys for production (setHardwareProtected(true))
• [ ] Enable soft delete on vault
• [ ] Set up key rotation policies
• [ ] Use separate keys for different operations