cloud_kms

func (*Client) AsymmetricDecrypt ¶ added in v1.106.0

func (c *Client) AsymmetricDecrypt(
	ctx context.Context,
	keyVersion string,
	ciphertext []byte,
	options ...fetch_config.Option,
) ([]byte, error)

AsymmetricDecrypt decrypts a ciphertext made with the public half of an asymmetric decryption key version, RSA-OAEP with the digest the version's algorithm names and no label, and returns the plaintext.

The ciphertext goes with its CRC32C and the plaintext comes back with one, and a response that does not confirm the first or match the second is refused: the API carries both so that a corrupted request or response is never taken for a decryption. The key never leaves KMS, so the caller needs roles/cloudkms.cryptoKeyDecrypter on the key and nothing more.

func (*Client) AsymmetricSign ¶

func (c *Client) AsymmetricSign(
	ctx context.Context,
	keyVersion string,
	digest []byte,
	options ...fetch_config.Option,
) ([]byte, error)

AsymmetricSign signs a SHA-256 digest with an asymmetric key version and returns the signature as KMS produced it: ASN.1 DER for an elliptic curve key, PKCS #1 for an RSA one.

The digest is sent rather than the data it was taken of. That is what lets the data be of any size, and it is what KMS signs either way: a key version signs the digest of what it is given. The key never leaves KMS, so the caller needs roles/cloudkms.signerVerifier on the key and nothing that could read, export or destroy it.

func (*Client) GetPublicKey ¶

func (c *Client) GetPublicKey(
	ctx context.Context,
	keyVersion string,
	options ...fetch_config.Option,
) (*public_key.PublicKey, error)

GetPublicKey returns the public half of an asymmetric key version as KMS states it: the PEM-encoded key and the algorithm the version signs with.

The algorithm is returned beside the key rather than folded into a parsed key, because the key alone does not say it: a P-256 key could sign over any digest, and a verifier that means to accept one combination checks for it. altshiftCrypto.PublicKeyFromPem parses the PEM into the key type expected.

Reading it takes cloudkms.cryptoKeyVersions.viewPublicKey, which roles/cloudkms.publicKeyViewer grants without the right to sign.