KFDPro
Buy

Key containers and console XML

Move keys between KFDPro and other keyloaders or a PC with encrypted .ekc containers, and export keys for a console or KMF.

A key container is an encrypted file holding keys, their names and their groups. KFDPro reads and writes .ekc files, the KFDtool Key Container Standard defined by the open-source KFDtool project, so containers move freely between KFDPro and KFDtool desktop in both directions.

Containers are also your backup. Nothing on the unit keeps a copy of its keys, so export a container to a USB drive and keep it as your policy requires.

Export keys to a container

  1. Plug a USB drive into the unit's USB-A port.

  2. Choose what to export:

    • Every key and group: in Manage keys, tap Export the store to a container.
    • Some keys: in Load keys, tick them, then tap Export to container.

  3. Type a passphrase for the container. You will need it to open the container again.

  4. In Choose where to save…, pick the USB drive and save. The file is named like KFDPro-keys-20260925-143000.ekc.

Wait before unplugging

Leave the drive in until the unit reports the export. The unit writes the file all the way to the drive before it says so; a drive pulled during the write comes away with an empty file. This applies to every export to a USB drive: containers, console XML, audit reports and radio authentication reports.

Import keys from a container

  1. Plug in the USB drive holding the .ekc file.

  2. In Manage keys, tap Import keys from a container and pick the file.

  3. Type its passphrase and tap Import these keys.

Imported keys are added to the ones already stored. If any imported key has the same CKR, algorithm and type as a key already on the unit, for example when you import a container you exported from this unit and edited on a PC, the unit asks what to do: Replace stored values updates those keys in place (they keep their place in groups) and adds the rest, or Add alongside stored keys keeps both. Otherwise nothing already on the unit is overwritten. If the import fails with could not decrypt the container — check the password, the passphrase is wrong; this is not an encrypted key container means the file isn't an .ekc container.

Caution

A container is only as safe as its passphrase. Use a strong one, don't store it with the drive, and never send a container or its passphrase to support.

Export keys as console XML

For a console or key management facility that loads keys from a key-dissemination file. The keys in the file are wrapped with a key-encryption key (KEK) you choose, so they never leave the unit in the clear.

  1. In Load keys, tick the keys to export, then tap Export to console. The Export to console XML screen opens.

  2. For each algorithm among them, choose the Key-encryption key that wraps it. The KEK must already be stored on the unit and be known to the system that will read the file.

  3. Tap Save to a location… and choose the USB drive, or Save to this device to keep it in the unit's KFDPro folder. The file is named like K20260925-143000.xml.

If no KEK is stored for an algorithm, the export stops with Key-encryption key needed. Add one in Manage keys with Key type set to KEK.