Skip to content

Commit 4713c10

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add SHA-2 import methods
PiperOrigin-RevId: 490250391
1 parent fea1947 commit 4713c10

4 files changed

Lines changed: 110 additions & 42 deletions

File tree

‎google/cloud/kms/v1/cloudkms_v1.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ http:
5757
additional_bindings:
5858
- get: '/v1/{resource=projects/*/locations/*/keyRings/*/cryptoKeys/*}:getIamPolicy'
5959
- get: '/v1/{resource=projects/*/locations/*/keyRings/*/importJobs/*}:getIamPolicy'
60+
- get: '/v1/{resource=projects/*/locations/*/ekmConfig}:getIamPolicy'
6061
- get: '/v1/{resource=projects/*/locations/*/ekmConnections/*}:getIamPolicy'
6162
- selector: google.iam.v1.IAMPolicy.SetIamPolicy
6263
post: '/v1/{resource=projects/*/locations/*/keyRings/*}:setIamPolicy'
@@ -66,6 +67,8 @@ http:
6667
body: '*'
6768
- post: '/v1/{resource=projects/*/locations/*/keyRings/*/importJobs/*}:setIamPolicy'
6869
body: '*'
70+
- post: '/v1/{resource=projects/*/locations/*/ekmConfig}:setIamPolicy'
71+
body: '*'
6972
- post: '/v1/{resource=projects/*/locations/*/ekmConnections/*}:setIamPolicy'
7073
body: '*'
7174
- selector: google.iam.v1.IAMPolicy.TestIamPermissions
@@ -76,6 +79,8 @@ http:
7679
body: '*'
7780
- post: '/v1/{resource=projects/*/locations/*/keyRings/*/importJobs/*}:testIamPermissions'
7881
body: '*'
82+
- post: '/v1/{resource=projects/*/locations/*/ekmConfig}:testIamPermissions'
83+
body: '*'
7984
- post: '/v1/{resource=projects/*/locations/*/ekmConnections/*}:testIamPermissions'
8085
body: '*'
8186

‎google/cloud/kms/v1/ekm_service.proto‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2021 Google LLC
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -85,7 +85,8 @@ service EkmService {
8585
}
8686
}
8787

88-
// Request message for [KeyManagementService.ListEkmConnections][].
88+
// Request message for
89+
// [EkmService.ListEkmConnections][google.cloud.kms.v1.EkmService.ListEkmConnections].
8990
message ListEkmConnectionsRequest {
9091
// Required. The resource name of the location associated with the
9192
// [EkmConnections][google.cloud.kms.v1.EkmConnection] to list, in the format
@@ -123,7 +124,8 @@ message ListEkmConnectionsRequest {
123124
string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
124125
}
125126

126-
// Response message for [KeyManagementService.ListEkmConnections][].
127+
// Response message for
128+
// [EkmService.ListEkmConnections][google.cloud.kms.v1.EkmService.ListEkmConnections].
127129
message ListEkmConnectionsResponse {
128130
// The list of [EkmConnections][google.cloud.kms.v1.EkmConnection].
129131
repeated EkmConnection ekm_connections = 1;
@@ -138,7 +140,8 @@ message ListEkmConnectionsResponse {
138140
int32 total_size = 3;
139141
}
140142

141-
// Request message for [KeyManagementService.GetEkmConnection][].
143+
// Request message for
144+
// [EkmService.GetEkmConnection][google.cloud.kms.v1.EkmService.GetEkmConnection].
142145
message GetEkmConnectionRequest {
143146
// Required. The [name][google.cloud.kms.v1.EkmConnection.name] of the
144147
// [EkmConnection][google.cloud.kms.v1.EkmConnection] to get.
@@ -150,7 +153,8 @@ message GetEkmConnectionRequest {
150153
];
151154
}
152155

153-
// Request message for [KeyManagementService.CreateEkmConnection][].
156+
// Request message for
157+
// [EkmService.CreateEkmConnection][google.cloud.kms.v1.EkmService.CreateEkmConnection].
154158
message CreateEkmConnectionRequest {
155159
// Required. The resource name of the location associated with the
156160
// [EkmConnection][google.cloud.kms.v1.EkmConnection], in the format
@@ -171,7 +175,8 @@ message CreateEkmConnectionRequest {
171175
EkmConnection ekm_connection = 3 [(google.api.field_behavior) = REQUIRED];
172176
}
173177

174-
// Request message for [KeyManagementService.UpdateEkmConnection][].
178+
// Request message for
179+
// [EkmService.UpdateEkmConnection][google.cloud.kms.v1.EkmService.UpdateEkmConnection].
175180
message UpdateEkmConnectionRequest {
176181
// Required. [EkmConnection][google.cloud.kms.v1.EkmConnection] with updated
177182
// values.
@@ -263,7 +268,8 @@ message EkmConnection {
263268
string hostname = 3 [(google.api.field_behavior) = REQUIRED];
264269

265270
// Required. A list of leaf server certificates used to authenticate HTTPS
266-
// connections to the EKM replica.
271+
// connections to the EKM replica. Currently, a maximum of 10
272+
// [Certificate][google.cloud.kms.v1.Certificate] is supported.
267273
repeated Certificate server_certificates = 4
268274
[(google.api.field_behavior) = REQUIRED];
269275
}
@@ -286,8 +292,7 @@ message EkmConnection {
286292
// supported.
287293
repeated ServiceResolver service_resolvers = 3;
288294

289-
// This checksum is computed by the server based on the value of other fields,
290-
// and may be sent on update requests to ensure the client has an up-to-date
291-
// value before proceeding.
292-
string etag = 5;
295+
// Optional. Etag of the currently stored
296+
// [EkmConnection][google.cloud.kms.v1.EkmConnection].
297+
string etag = 5 [(google.api.field_behavior) = OPTIONAL];
293298
}

‎google/cloud/kms/v1/resources.proto‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2021 Google LLC
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -235,6 +235,9 @@ message KeyOperationAttestation {
235235

236236
// Cavium HSM attestation compressed with gzip. Note that this format is
237237
// defined by Cavium and subject to change at any time.
238+
//
239+
// See
240+
// https://www.marvell.com/products/security-solutions/nitrox-hs-adapters/software-key-attestation.html.
238241
CAVIUM_V1_COMPRESSED = 3;
239242

240243
// Cavium HSM attestation V2 compressed with gzip. This is a new format
@@ -688,6 +691,34 @@ message ImportJob {
688691
// [RSA AES key wrap
689692
// mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
690693
RSA_OAEP_4096_SHA1_AES_256 = 2;
694+
695+
// This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
696+
// scheme defined in the PKCS #11 standard. In summary, this involves
697+
// wrapping the raw key with an ephemeral AES key, and wrapping the
698+
// ephemeral AES key with a 3072 bit RSA key. For more details, see
699+
// [RSA AES key wrap
700+
// mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
701+
RSA_OAEP_3072_SHA256_AES_256 = 3;
702+
703+
// This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
704+
// scheme defined in the PKCS #11 standard. In summary, this involves
705+
// wrapping the raw key with an ephemeral AES key, and wrapping the
706+
// ephemeral AES key with a 4096 bit RSA key. For more details, see
707+
// [RSA AES key wrap
708+
// mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
709+
RSA_OAEP_4096_SHA256_AES_256 = 4;
710+
711+
// This ImportMethod represents RSAES-OAEP with a 3072 bit RSA key. The
712+
// key material to be imported is wrapped directly with the RSA key. Due
713+
// to technical limitations of RSA wrapping, this method cannot be used to
714+
// wrap RSA keys for import.
715+
RSA_OAEP_3072_SHA256 = 5;
716+
717+
// This ImportMethod represents RSAES-OAEP with a 4096 bit RSA key. The
718+
// key material to be imported is wrapped directly with the RSA key. Due
719+
// to technical limitations of RSA wrapping, this method cannot be used to
720+
// wrap RSA keys for import.
721+
RSA_OAEP_4096_SHA256 = 6;
691722
}
692723

693724
// The state of the [ImportJob][google.cloud.kms.v1.ImportJob], indicating if

‎google/cloud/kms/v1/service.proto‎

Lines changed: 57 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2021 Google LLC
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -797,33 +797,56 @@ message ImportCryptoKeyVersionRequest {
797797
// material.
798798
string import_job = 4 [(google.api.field_behavior) = REQUIRED];
799799

800-
// Required. The incoming wrapped key material that is to be imported.
800+
// Optional. The wrapped key material to import.
801+
//
802+
// Before wrapping, key material must be formatted. If importing symmetric key
803+
// material, the expected key material format is plain bytes. If importing
804+
// asymmetric key material, the expected key material format is PKCS#8-encoded
805+
// DER (the PrivateKeyInfo structure from RFC 5208).
806+
//
807+
// When wrapping with import methods
808+
// ([RSA_OAEP_3072_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256]
809+
// or
810+
// [RSA_OAEP_4096_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA1_AES_256]
811+
// or
812+
// [RSA_OAEP_3072_SHA256_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256_AES_256]
813+
// or
814+
// [RSA_OAEP_4096_SHA256_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256_AES_256]),
815+
//
816+
// this field must contain the concatenation of:
817+
// <ol>
818+
// <li>An ephemeral AES-256 wrapping key wrapped with the
819+
// [public_key][google.cloud.kms.v1.ImportJob.public_key] using
820+
// RSAES-OAEP with SHA-1/SHA-256, MGF1 with SHA-1/SHA-256, and an empty
821+
// label.
822+
// </li>
823+
// <li>The formatted key to be imported, wrapped with the ephemeral AES-256
824+
// key using AES-KWP (RFC 5649).
825+
// </li>
826+
// </ol>
827+
//
828+
// This format is the same as the format produced by PKCS#11 mechanism
829+
// CKM_RSA_AES_KEY_WRAP.
830+
//
831+
// When wrapping with import methods
832+
// ([RSA_OAEP_3072_SHA256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256]
833+
// or
834+
// [RSA_OAEP_4096_SHA256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256]),
835+
//
836+
// this field must contain the formatted key to be imported, wrapped with the
837+
// [public_key][google.cloud.kms.v1.ImportJob.public_key] using RSAES-OAEP
838+
// with SHA-256, MGF1 with SHA-256, and an empty label.
839+
bytes wrapped_key = 8 [(google.api.field_behavior) = OPTIONAL];
840+
841+
// This field is legacy. Use the field
842+
// [wrapped_key][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key]
843+
// instead.
801844
oneof wrapped_key_material {
802-
// Wrapped key material produced with
803-
// [RSA_OAEP_3072_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256]
804-
// or
805-
// [RSA_OAEP_4096_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA1_AES_256].
806-
//
807-
// This field contains the concatenation of two wrapped keys:
808-
// <ol>
809-
// <li>An ephemeral AES-256 wrapping key wrapped with the
810-
// [public_key][google.cloud.kms.v1.ImportJob.public_key] using
811-
// RSAES-OAEP with SHA-1/SHA-256, MGF1 with SHA-1/SHA-256, and an
812-
// empty label.
813-
// </li>
814-
// <li>The key to be imported, wrapped with the ephemeral AES-256 key
815-
// using AES-KWP (RFC 5649).
816-
// </li>
817-
// </ol>
818-
//
819-
// If importing symmetric key material, it is expected that the unwrapped
820-
// key contains plain bytes. If importing asymmetric key material, it is
821-
// expected that the unwrapped key is in PKCS#8-encoded DER format (the
822-
// PrivateKeyInfo structure from RFC 5208).
823-
//
824-
// This format is the same as the format produced by PKCS#11 mechanism
825-
// CKM_RSA_AES_KEY_WRAP.
826-
bytes rsa_aes_wrapped_key = 5;
845+
// Optional. This field has the same meaning as
846+
// [wrapped_key][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key].
847+
// Prefer to use that field in new work. Either that field or this field
848+
// (but not both) must be specified.
849+
bytes rsa_aes_wrapped_key = 5 [(google.api.field_behavior) = OPTIONAL];
827850
}
828851
}
829852

@@ -935,7 +958,9 @@ message EncryptRequest {
935958
//
936959
// The maximum size depends on the key version's
937960
// [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level].
938-
// For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE] keys, the
961+
// For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE],
962+
// [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL], and
963+
// [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC] keys, the
939964
// plaintext must be no larger than 64KiB. For
940965
// [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of
941966
// the plaintext and additional_authenticated_data fields must be no larger
@@ -948,8 +973,10 @@ message EncryptRequest {
948973
//
949974
// The maximum size depends on the key version's
950975
// [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level].
951-
// For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE] keys, the AAD
952-
// must be no larger than 64KiB. For
976+
// For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE],
977+
// [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL], and
978+
// [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC] keys the
979+
// AAD must be no larger than 64KiB. For
953980
// [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of
954981
// the plaintext and additional_authenticated_data fields must be no larger
955982
// than 8KiB.

0 commit comments

Comments
 (0)