# KeySpec

The key spec, represents the cryptographic configuration of keys.

- Source: [`aws-kms/lib/key.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-kms/lib/key.ts#L288)
- Type last changed: v2.236.0 · 23 Jan 2026

## Example

```ts
const key = new kms.Key(this, 'MyKey', {
  keySpec: kms.KeySpec.ECC_SECG_P256K1, // Default to SYMMETRIC_DEFAULT
  keyUsage: kms.KeyUsage.SIGN_VERIFY,    // and ENCRYPT_DECRYPT
});
```

## Members

| Member | Description |
| --- | --- |
| `SYMMETRIC_DEFAULT` | The default key spec. |
| `RSA_2048` | RSA with 2048 bits of key. |
| `RSA_3072` | RSA with 3072 bits of key. |
| `RSA_4096` | RSA with 4096 bits of key. |
| `ECC_NIST_P256` | NIST FIPS 186-4, Section 6.4, ECDSA signature using the curve specified by the key and SHA-256 for the message digest. |
| `ECC_NIST_P384` | NIST FIPS 186-4, Section 6.4, ECDSA signature using the curve specified by the key and SHA-384 for the message digest. |
| `ECC_NIST_P521` | NIST FIPS 186-4, Section 6.4, ECDSA signature using the curve specified by the key and SHA-512 for the message digest. |
| `ECC_SECG_P256K1` | Standards for Efficient Cryptography 2, Section 2.4.1, ECDSA signature on the Koblitz curve. |
| `HMAC_224` | Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA224. |
| `HMAC_256` | Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA256. |
| `HMAC_384` | Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA384. |
| `HMAC_512` | Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA512. |
| `SM2` | Elliptic curve key spec available only in China Regions. |
| `ML_DSA_44` | ML-DSA-44 lattice-based digital signature algorithm. |
| `ML_DSA_65` | ML-DSA-65 lattice-based digital signature algorithm. |
| `ML_DSA_87` | ML-DSA-87 lattice-based digital signature algorithm. |
| `ECC_NIST_EDWARDS25519` | NIST-standard Edwards25519 (ed25519) elliptic curve key pair. |

## Referenced by

- [`KeyProps`](/v2/docs/aws-cdk-lib.aws_kms.KeyProps).keySpec