---
title: "Entrust nShield: Creating a secure auditing key"
slug: "oas-ag-entrust-nshield-creating-a-secure-auditing-key-3-28"
updated: 2025-07-04T10:04:17Z
published: 2025-07-07T13:30:12Z
canonical: "docs.onespan.com/oas-ag-entrust-nshield-creating-a-secure-auditing-key-3-28"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Entrust nShield: Creating a secure auditing key

You need to use the generatekey command-line utility to create a cryptographic key for Secure Auditing when using Entrust nShield HSM devices. It is provided by the nCSS package. For more information about installing the nCSS package, see [Installing Entrust nShield packages](/sec/docs/oas-ag-installing-entrust-nshield-packages-3-28).

To create a Secure Auditing key, run the following command:

```actionscript
generatekey -g custom protect=module type=ECDSA plainname="MasterAuditKey" curve="NISTP256" blobsavefile="master_audit.blob" seeintegname="" nvram="no"
```

The public key generated by this command will be used to verify Secure Auditing entries. Before doing so, you need to export the public key into the PEM format. For more information, see [Secure auditing with Entrust nShield](/sec/docs/oas-ag-secure-auditing-with-entrust-nshield-3-28)..

After you exported the key to the PEM format, you can then use it with the Secure Auditing Verification Tool (see [Using the Secure Auditing Verification Tool](/sec/docs/oas-ag-using-the-secure-auditing-verification-tool-3-28)).

> The generatekey command creates the BLOB file in the current directory. It will also generate the following file:
> 
> master_audit_inf.txt
> 
> This file contains important information about the key, including the key hash, which will be used when you configure the HSM to use the key for Secure Auditing.