[KeyVault] Add KeySize support for Key Vault key outputs by MaddyMicrosoft · Pull Request #29780 · Azure/azure-powershell

MaddyMicrosoft · 2026-06-30T00:13:14Z

Description

Related to https://github.com/Azure/CLIPS/issues/303
Previously Get-AzKeyVaultKey only returned a KeySize for software-backed
RSA keys — RSA-HSM, oct, and oct-HSM keys always came back with KeySize
blank. This PR wires the new KeyProperties.KeySize field (added in
Azure.Security.KeyVault.Keys 4.10.0) through the PS models so all key
types the service reports a size for surface it consistently.

What changed

Upgraded Azure.Security.KeyVault.Keys from 4.6.0-beta.1 to 4.10.0
to pick up KeyProperties.KeySize.
Track 2 paths (PSKeyVaultKey, PSDeletedKeyVaultKey,
PSKeyVaultKeyIdentityItem) now read key.Properties.KeySize directly
from the service — no client-side computation.
Track 1 paths kept their original behaviour: JwkHelper.ConvertToRSAKey
continues to compute size for RSA keys only. No new Track 1 behaviour.
PSKeyVaultKeyIdentityItem gained a KeySize property so
Get-AzKeyVaultKey (list view) includes the size when the service reports
it. Format file (KeyVault.format.ps1xml) updated to display it.

What deliberately did not change

EC and EC-HSM keys continue to have a null KeySize. The Key Vault
service intentionally does not return key_size for EC keys, and
fabricating one from the curve bit-length would be misleading —
P-256 (secp256r1) and P-256K (secp256k1) are both 256-bit curves
but are mathematically distinct cryptosystems (y² = x³ − 3x + b vs
y² = x³ + 7). Consumers should use CurveName to identify EC keys.
Reviewed and confirmed with the KeyVault team.
oct-HSM key material is never returned to the client, so client-side
computation from K would always yield null anyway — we rely on
Properties.KeySize from the service, which handles this correctly.

Behaviour summary

Key type	Before	After
RSA (software)	populated	populated
RSA-HSM	blank	populated
oct (software)	blank	populated
oct-HSM	blank	populated
EC / EC-HSM	blank	blank (intentional — use `CurveName`)
`Get-AzKeyVaultKey` list view	no `KeySize` field	`KeySize` field where the service reports it

Testing

15 new unit tests in JwkHelperKeySizeTests.cs covering Track 1 RSA
computation, Track 1 non-RSA null behaviour, Track 2 direct
Properties.KeySize reads, Track 2 null-service fallback (must stay
null), and identity-item population.
Full existing KeyVault unit + model suite still green (129 / 129).
Live-validated against a Premium AKV vault: RSA (2048/3072/4096),
EC (P-256/P-384/P-521/P-256K), RSA-HSM, EC-HSM, oct-HSM 256, and the
deleted-key path (Get-AzKeyVaultKey -InRemovedState) all behave as
described in the table above.

Mandatory Checklist

Please choose the target release of Azure PowerShell.
- General release
- Public preview
- Private preview
- Engineering build
- No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

Track2 paths read KeyProperties.KeySize directly (added in SDK 4.10.0). - Track1 and fallback paths derive the size locally via JwkHelper: RSA from modulus length, oct from symmetric-key length, EC from the named curve. - KeySize is also surfaced on PSKeyVaultKeyIdentityItem so it appears in the Get-AzKeyVaultKey list view (note: the service omits key_size from list responses for EC keys, so list output for those remains blank). Upgrades Azure.Security.KeyVault.Keys 4.6.0-beta.1 -> 4.10.0. Adds 49 unit tests covering every Kty, curve and null-material edge case. Live- validated end-to-end against a Premium AKV vault.

azure-client-tools-bot-prd · 2026-06-30T00:13:17Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

Copilot

Pull request overview

This pull request updates the Key Vault key PowerShell models and formatting to surface KeySize consistently across Track1 and Track2 SDK paths, aligning with newer Azure.Security.KeyVault.Keys behavior and adding unit coverage for key-size derivation.

Changes:

Surfaced KeySize on PSKeyVaultKeyIdentityItem so Get-AzKeyVaultKey list output can display key sizes when available.
Added local key-size derivation for Track1 / fallback scenarios via JwkHelper.ComputeKeySize (RSA modulus bytes, oct key bytes, EC curve mapping).
Upgraded Azure.Security.KeyVault.Keys to 4.10.0 and introduced comprehensive unit tests for key-size behavior and wiring.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/KeyVault/KeyVault/Models/Key/PSKeyVaultKeyIdentityItem.cs	Adds `KeySize` to the shared identity model and wires Track2 `KeyProperties.KeySize` into list items.
src/KeyVault/KeyVault/Models/Key/PSKeyVaultKey.cs	Uses Track2 `KeyProperties.KeySize` when present; otherwise computes from JWK material.
src/KeyVault/KeyVault/Models/Key/PSDeletedKeyVaultKey.cs	Mirrors the `KeySize` preference/fallback behavior for deleted key models, including null-material cases.
src/KeyVault/KeyVault/KeyVault.format.ps1xml	Updates list formatting to display `KeySize`.
src/KeyVault/KeyVault/KeyVault.csproj	Updates `Azure.Security.KeyVault.Keys` dependency version to `4.10.0`.
src/KeyVault/KeyVault/Helpers/JwkHelper.cs	Introduces `ComputeKeySize` and key-type helpers for Track1/fallback derivation.
src/KeyVault/KeyVault/ChangeLog.md	Documents the behavior and dependency update in the KeyVault module changelog.
src/KeyVault/KeyVault.Test/UnitTests/JwkHelperKeySizeTests.cs	Adds unit tests covering key-size derivation and Track2 `KeyProperties.KeySize` wiring.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

+        private const string VaultDnsSuffix = "vault.azure.net";
+        private const string HsmDnsSuffix = "managedhsm.azure.net";
+        private const string OctHsm = "oct-HSM";
+


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

notyashhh · 2026-07-03T01:52:29Z

+            if (string.Equals(curveName, JsonWebKeyCurveName.P256, StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(curveName, JsonWebKeyCurveName.P256K, StringComparison.OrdinalIgnoreCase))
+            {
+                return 256;


Magic numbers here, but this is the only place we will need these constants so all good

notyashhh

Looks good

github-actions · 2026-07-03T01:53:55Z

‼️ DO NOT MERGE THIS PR ‼️
This PR was labeled "Do Not Merge" because it contains code change that cannot be merged. Please contact the reviewer for more information.

notyashhh · 2026-07-03T01:54:24Z

DO NOT MERGE until our current release PR has merged (7th July)

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

        public Hashtable Tags { get; set; }

+        public int? KeySize { get; set; }
+


Copilot AI review requested due to automatic review settings June 30, 2026 00:13

Copilot started reviewing on behalf of MaddyMicrosoft June 30, 2026 00:13 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread src/KeyVault/KeyVault/Models/Key/PSKeyVaultKeyIdentityItem.cs Outdated

Comment thread src/KeyVault/KeyVault/Helpers/JwkHelper.cs Outdated

Comment thread src/KeyVault/KeyVault/ChangeLog.md Outdated

MaddyMicrosoft added 2 commits June 30, 2026 13:55

Azure.Security.KeyVault.Keys upgraded

95f38ca

Handle for null and 0 length

302c4d6

Copilot AI review requested due to automatic review settings June 30, 2026 04:12

Copilot started reviewing on behalf of MaddyMicrosoft June 30, 2026 04:13 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread src/KeyVault/KeyVault/ChangeLog.md Outdated

Comment thread src/CosmosDB/CosmosDB/ChangeLog.md

Potential fix for pull request finding

b49bbfa

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 1, 2026 03:20

Copilot started reviewing on behalf of MaddyMicrosoft July 1, 2026 03:20 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

a0x1ab mentioned this pull request Jul 1, 2026

live-test-powershell: read public PR head with github.token Azure/issue-sentinel#44

Open

Changelog tense fix

f9317dd

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 3, 2026 01:49

Copilot started reviewing on behalf of notyashhh July 3, 2026 01:49 View session

notyashhh reviewed Jul 3, 2026

View reviewed changes

notyashhh previously approved these changes Jul 3, 2026

View reviewed changes

notyashhh added the Do Not Merge 🚫 label Jul 3, 2026

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread src/KeyVault/KeyVault/Models/Key/PSKeyVaultKeyIdentityItem.cs

Comment on lines 127 to +130

public Hashtable Tags { get; set; }

public int? KeySize { get; set; }

Revert calculated keysizes

c6d4840

MaddyMicrosoft dismissed notyashhh’s stale review via c6d4840 July 7, 2026 04:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[KeyVault] Add KeySize support for Key Vault key outputs#29780

[KeyVault] Add KeySize support for Key Vault key outputs#29780
MaddyMicrosoft wants to merge 6 commits into
Azure:mainfrom
MaddyMicrosoft:keyvault-add-keysize-support

MaddyMicrosoft commented Jun 30, 2026 •

edited

Loading

Uh oh!

azure-client-tools-bot-prd Bot commented Jun 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

notyashhh Jul 3, 2026

Uh oh!

notyashhh left a comment

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

notyashhh commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		public Hashtable Tags { get; set; }

		public int? KeySize { get; set; }

Uh oh!

Conversation

MaddyMicrosoft commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What changed

What deliberately did not change

Behaviour summary

Testing

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd Bot commented Jun 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

notyashhh Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

notyashhh left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

notyashhh commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MaddyMicrosoft commented Jun 30, 2026 •

edited

Loading