Follow these steps outside the Anaplan platform. With the updated encryption standard, you must use an AES256-CBC_CS1 symmetric key.

To wrap your symmetric key with an asymmetric key:

Use your Hardware Security Module (HSM) to generate two AES256-CBC_CS1 symmetric keys.
Use your HSM to wrap each symmetric key separately with the asymmetric key you exported from Anaplan. You must also use the HSM to:
- Use OAEP padding (RSA-OAEP) to wrap each key.
- Set the Hash Padding Algorithm to SHA256.
- Set the Mask Generator to SHA256.
Concatenate the two keys in a binary format.
Take the combined single, wrapped key, and encode it as Base64.
Edit the encoded Base64 file, and add the term Secret: at the start of the encoded string.
- You must include the blank space after the colon (:) and before the string.
- Make sure that there are no carriage returns (line feeds) as these will cause script errors.
Save your changes. This is the file you will upload to Anaplan in the "Import the Wrapped Key" section below.
Note: Any other data in the wrapped payload is ignored in the import.

File example:
Secret: tlPE23P3jlxPHniXYYTr32NP0XY761NYhknIbY0H1s2yTxDFmIDBJbLJgJzC7PUAh6vgXMw+/FJ1TpZ0chl6SsEenj0WANc0qlf9XHI2205g96YZ2A2hBOTn0kGjdY9BLhbNPQZoLFq/LlVFZWXQmjSio02oGfQFyFcwNpnmKGlHtZg3zASpaEaOc0Qba2hQBoUS6aJb5/02fqhzOkAjpVU+NRmaRkS8KY5ObutDtmftwuTvguBNCBqVF1HVHGKkJz70/mQO4dHoL4T97URyDs2xtGesrJM2GVGv6CENU5CdukimdZznrq6aIYumvKPMdr/8DBKDVTbQBzVfjBL7Hg==
Note: Avoid all headers and footers. We wrapped the code text above for display purposes only):

Now you are ready to import the wrapped key. Also see BYOK scripts for bash and powershell scripts that you can use to concatenate and encode the wrapped keys (steps 3-6 above).

Also see Troubleshoot wrapped keys.

title