cloud_kms

func (*Client) AsymmetricSign ¶

func (c *Client) AsymmetricSign(
	ctx context.Context,
	keyVersion string,
	digest []byte,
	options ...fetch_config.Option,
) ([]byte, error)

AsymmetricSign signs a SHA-256 digest with an asymmetric key version and returns the signature as KMS produced it: ASN.1 DER for an elliptic curve key, PKCS #1 for an RSA one.

The digest is sent rather than the data it was taken of. That is what lets the data be of any size, and it is what KMS signs either way: a key version signs the digest of what it is given. The key never leaves KMS, so the caller needs roles/cloudkms.signerVerifier on the key and nothing that could read, export or destroy it.

func (*Client) GetPublicKey ¶

func (c *Client) GetPublicKey(
	ctx context.Context,
	keyVersion string,
	options ...fetch_config.Option,
) (*public_key.PublicKey, error)

GetPublicKey returns the public half of an asymmetric key version as KMS states it: the PEM-encoded key and the algorithm the version signs with.

The algorithm is returned beside the key rather than folded into a parsed key, because the key alone does not say it: a P-256 key could sign over any digest, and a verifier that means to accept one combination checks for it. altshiftCrypto.PublicKeyFromPem parses the PEM into the key type expected.

Reading it takes cloudkms.cryptoKeyVersions.viewPublicKey, which roles/cloudkms.publicKeyViewer grants without the right to sign.