You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
424 lines
18 KiB
424 lines
18 KiB
// Copyright 2018 Google LLC.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//
|
|
|
|
syntax = "proto3";
|
|
|
|
package google.cloud.kms.v1;
|
|
|
|
import "google/api/annotations.proto";
|
|
import "google/protobuf/duration.proto";
|
|
import "google/protobuf/timestamp.proto";
|
|
|
|
option cc_enable_arenas = true;
|
|
option csharp_namespace = "Google.Cloud.Kms.V1";
|
|
option go_package = "google.golang.org/genproto/googleapis/cloud/kms/v1;kms";
|
|
option java_multiple_files = true;
|
|
option java_outer_classname = "KmsResourcesProto";
|
|
option java_package = "com.google.cloud.kms.v1";
|
|
option php_namespace = "Google\\Cloud\\Kms\\V1";
|
|
|
|
// A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of
|
|
// [CryptoKeys][google.cloud.kms.v1.CryptoKey].
|
|
message KeyRing {
|
|
// Output only. The resource name for the
|
|
// [KeyRing][google.cloud.kms.v1.KeyRing] in the format
|
|
// `projects/*/locations/*/keyRings/*`.
|
|
string name = 1;
|
|
|
|
// Output only. The time at which this [KeyRing][google.cloud.kms.v1.KeyRing]
|
|
// was created.
|
|
google.protobuf.Timestamp create_time = 2;
|
|
}
|
|
|
|
// A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that
|
|
// can be used for cryptographic operations.
|
|
//
|
|
// A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of one or more
|
|
// [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual
|
|
// key material used in cryptographic operations.
|
|
message CryptoKey {
|
|
// [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose]
|
|
// describes the cryptographic capabilities of a
|
|
// [CryptoKey][google.cloud.kms.v1.CryptoKey]. A given key can only be used
|
|
// for the operations allowed by its purpose.
|
|
enum CryptoKeyPurpose {
|
|
// Not specified.
|
|
CRYPTO_KEY_PURPOSE_UNSPECIFIED = 0;
|
|
|
|
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used
|
|
// with [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and
|
|
// [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
|
|
ENCRYPT_DECRYPT = 1;
|
|
|
|
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used
|
|
// with
|
|
// [AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign]
|
|
// and
|
|
// [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
|
|
ASYMMETRIC_SIGN = 5;
|
|
|
|
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used
|
|
// with
|
|
// [AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt]
|
|
// and
|
|
// [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
|
|
ASYMMETRIC_DECRYPT = 6;
|
|
}
|
|
|
|
// Output only. The resource name for this
|
|
// [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format
|
|
// `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
|
|
string name = 1;
|
|
|
|
// Output only. A copy of the "primary"
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used
|
|
// by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this
|
|
// [CryptoKey][google.cloud.kms.v1.CryptoKey] is given in
|
|
// [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name].
|
|
//
|
|
// The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be
|
|
// updated via
|
|
// [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].
|
|
//
|
|
// All keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
|
|
// have a primary. For other keys, this field will be omitted.
|
|
CryptoKeyVersion primary = 2;
|
|
|
|
// The immutable purpose of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
|
|
CryptoKeyPurpose purpose = 3;
|
|
|
|
// Output only. The time at which this
|
|
// [CryptoKey][google.cloud.kms.v1.CryptoKey] was created.
|
|
google.protobuf.Timestamp create_time = 5;
|
|
|
|
// At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time],
|
|
// the Key Management Service will automatically:
|
|
//
|
|
// 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
|
|
// 2. Mark the new version as primary.
|
|
//
|
|
// Key rotations performed manually via
|
|
// [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
|
|
// and
|
|
// [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]
|
|
// do not affect
|
|
// [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time].
|
|
//
|
|
// Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
|
|
// support automatic rotation. For other keys, this field must be omitted.
|
|
google.protobuf.Timestamp next_rotation_time = 7;
|
|
|
|
// Controls the rate of automatic rotation.
|
|
oneof rotation_schedule {
|
|
// [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
|
|
// will be advanced by this period when the service automatically rotates a
|
|
// key. Must be at least one day.
|
|
//
|
|
// If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is
|
|
// set,
|
|
// [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
|
|
// must also be set.
|
|
//
|
|
// Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
|
|
// support automatic rotation. For other keys, this field must be omitted.
|
|
google.protobuf.Duration rotation_period = 8;
|
|
}
|
|
|
|
// A template describing settings for new
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. The
|
|
// properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
|
|
// instances created by either
|
|
// [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
|
|
// or auto-rotation are controlled by this template.
|
|
CryptoKeyVersionTemplate version_template = 11;
|
|
|
|
// Labels with user-defined metadata. For more information, see
|
|
// [Labeling Keys](/kms/docs/labeling-keys).
|
|
map<string, string> labels = 10;
|
|
}
|
|
|
|
// A [CryptoKeyVersionTemplate][google.cloud.kms.v1.CryptoKeyVersionTemplate]
|
|
// specifies the properties to use when creating a new
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], either manually
|
|
// with
|
|
// [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
|
|
// or automatically as a result of auto-rotation.
|
|
message CryptoKeyVersionTemplate {
|
|
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when creating
|
|
// a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this
|
|
// template. Immutable. Defaults to
|
|
// [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
|
|
ProtectionLevel protection_level = 1;
|
|
|
|
// Required.
|
|
// [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
|
|
// to use when creating a
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this
|
|
// template.
|
|
//
|
|
// For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both
|
|
// this field is omitted and
|
|
// [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] is
|
|
// [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
|
|
CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 3;
|
|
}
|
|
|
|
// Contains an HSM-generated attestation about a key operation.
|
|
message KeyOperationAttestation {
|
|
// Attestion formats provided by the HSM.
|
|
enum AttestationFormat {
|
|
ATTESTATION_FORMAT_UNSPECIFIED = 0;
|
|
|
|
// Cavium HSM attestation compressed with gzip. Note that this format is
|
|
// defined by Cavium and subject to change at any time.
|
|
CAVIUM_V1_COMPRESSED = 3;
|
|
|
|
// Cavium HSM attestation V2 compressed with gzip. This is a new format
|
|
// Introduced in Cavium's version 3.2-08
|
|
CAVIUM_V2_COMPRESSED = 4;
|
|
}
|
|
|
|
// Output only. The format of the attestation data.
|
|
AttestationFormat format = 4;
|
|
|
|
// Output only. The attestation data provided by the HSM when the key
|
|
// operation was performed.
|
|
bytes content = 5;
|
|
}
|
|
|
|
// A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an
|
|
// individual cryptographic key, and the associated key material.
|
|
//
|
|
// An
|
|
// [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED]
|
|
// version can be used for cryptographic operations.
|
|
//
|
|
// For security reasons, the raw cryptographic key material represented by a
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed
|
|
// or exported. It can only be used to encrypt, decrypt, or sign data when an
|
|
// authorized user or application invokes Cloud KMS.
|
|
message CryptoKeyVersion {
|
|
// The algorithm of the
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating what
|
|
// parameters must be used for each cryptographic operation.
|
|
//
|
|
// The
|
|
// [GOOGLE_SYMMETRIC_ENCRYPTION][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION]
|
|
// algorithm is usable with
|
|
// [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
|
|
//
|
|
// Algorithms beginning with "RSA_SIGN_" are usable with
|
|
// [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN].
|
|
//
|
|
// The fields in the name after "RSA_SIGN_" correspond to the following
|
|
// parameters: padding algorithm, modulus bit length, and digest algorithm.
|
|
//
|
|
// For PSS, the salt length used is equal to the length of digest
|
|
// algorithm. For example,
|
|
// [RSA_SIGN_PSS_2048_SHA256][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256]
|
|
// will use PSS with a salt length of 256 bits or 32 bytes.
|
|
//
|
|
// Algorithms beginning with "RSA_DECRYPT_" are usable with
|
|
// [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT].
|
|
//
|
|
// The fields in the name after "RSA_DECRYPT_" correspond to the following
|
|
// parameters: padding algorithm, modulus bit length, and digest algorithm.
|
|
//
|
|
// Algorithms beginning with "EC_SIGN_" are usable with
|
|
// [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
|
|
// [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN].
|
|
//
|
|
// The fields in the name after "EC_SIGN_" correspond to the following
|
|
// parameters: elliptic curve, digest algorithm.
|
|
enum CryptoKeyVersionAlgorithm {
|
|
// Not specified.
|
|
CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0;
|
|
|
|
// Creates symmetric encryption keys.
|
|
GOOGLE_SYMMETRIC_ENCRYPTION = 1;
|
|
|
|
// RSASSA-PSS 2048 bit key with a SHA256 digest.
|
|
RSA_SIGN_PSS_2048_SHA256 = 2;
|
|
|
|
// RSASSA-PSS 3072 bit key with a SHA256 digest.
|
|
RSA_SIGN_PSS_3072_SHA256 = 3;
|
|
|
|
// RSASSA-PSS 4096 bit key with a SHA256 digest.
|
|
RSA_SIGN_PSS_4096_SHA256 = 4;
|
|
|
|
// RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
|
|
RSA_SIGN_PKCS1_2048_SHA256 = 5;
|
|
|
|
// RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
|
|
RSA_SIGN_PKCS1_3072_SHA256 = 6;
|
|
|
|
// RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
|
|
RSA_SIGN_PKCS1_4096_SHA256 = 7;
|
|
|
|
// RSAES-OAEP 2048 bit key with a SHA256 digest.
|
|
RSA_DECRYPT_OAEP_2048_SHA256 = 8;
|
|
|
|
// RSAES-OAEP 3072 bit key with a SHA256 digest.
|
|
RSA_DECRYPT_OAEP_3072_SHA256 = 9;
|
|
|
|
// RSAES-OAEP 4096 bit key with a SHA256 digest.
|
|
RSA_DECRYPT_OAEP_4096_SHA256 = 10;
|
|
|
|
// ECDSA on the NIST P-256 curve with a SHA256 digest.
|
|
EC_SIGN_P256_SHA256 = 12;
|
|
|
|
// ECDSA on the NIST P-384 curve with a SHA384 digest.
|
|
EC_SIGN_P384_SHA384 = 13;
|
|
}
|
|
|
|
// The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion],
|
|
// indicating if it can be used.
|
|
enum CryptoKeyVersionState {
|
|
// Not specified.
|
|
CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0;
|
|
|
|
// This version is still being generated. It may not be used, enabled,
|
|
// disabled, or destroyed yet. Cloud KMS will automatically mark this
|
|
// version
|
|
// [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED]
|
|
// as soon as the version is ready.
|
|
PENDING_GENERATION = 5;
|
|
|
|
// This version may be used for cryptographic operations.
|
|
ENABLED = 1;
|
|
|
|
// This version may not be used, but the key material is still available,
|
|
// and the version can be placed back into the
|
|
// [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED]
|
|
// state.
|
|
DISABLED = 2;
|
|
|
|
// This version is destroyed, and the key material is no longer stored.
|
|
// A version may not leave this state once entered.
|
|
DESTROYED = 3;
|
|
|
|
// This version is scheduled for destruction, and will be destroyed soon.
|
|
// Call
|
|
// [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion]
|
|
// to put it back into the
|
|
// [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED]
|
|
// state.
|
|
DESTROY_SCHEDULED = 4;
|
|
}
|
|
|
|
// A view for [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]s.
|
|
// Controls the level of detail returned for
|
|
// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] in
|
|
// [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions]
|
|
// and
|
|
// [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys].
|
|
enum CryptoKeyVersionView {
|
|
// Default view for each
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Does not
|
|
// include the
|
|
// [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation] field.
|
|
CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED = 0;
|
|
|
|
// Provides all fields in each
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], including the
|
|
// [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation].
|
|
FULL = 1;
|
|
}
|
|
|
|
// Output only. The resource name for this
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the format
|
|
// `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
|
|
string name = 1;
|
|
|
|
// The current state of the
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
|
|
CryptoKeyVersionState state = 3;
|
|
|
|
// Output only. The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel]
|
|
// describing how crypto operations are performed with this
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
|
|
ProtectionLevel protection_level = 7;
|
|
|
|
// Output only. The
|
|
// [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
|
|
// that this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
|
|
// supports.
|
|
CryptoKeyVersionAlgorithm algorithm = 10;
|
|
|
|
// Output only. Statement that was generated and signed by the HSM at key
|
|
// creation time. Use this statement to verify attributes of the key as stored
|
|
// on the HSM, independently of Google. Only provided for key versions with
|
|
// [protection_level][google.cloud.kms.v1.CryptoKeyVersion.protection_level]
|
|
// [HSM][google.cloud.kms.v1.ProtectionLevel.HSM].
|
|
KeyOperationAttestation attestation = 8;
|
|
|
|
// Output only. The time at which this
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] was created.
|
|
google.protobuf.Timestamp create_time = 4;
|
|
|
|
// Output only. The time this
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material was
|
|
// generated.
|
|
google.protobuf.Timestamp generate_time = 11;
|
|
|
|
// Output only. The time this
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material is
|
|
// scheduled for destruction. Only present if
|
|
// [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
|
|
// [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED].
|
|
google.protobuf.Timestamp destroy_time = 5;
|
|
|
|
// Output only. The time this CryptoKeyVersion's key material was
|
|
// destroyed. Only present if
|
|
// [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
|
|
// [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED].
|
|
google.protobuf.Timestamp destroy_event_time = 6;
|
|
}
|
|
|
|
// The public key for a given
|
|
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via
|
|
// [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
|
|
message PublicKey {
|
|
// The public key, encoded in PEM format. For more information, see the
|
|
// [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for
|
|
// [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
|
|
// [Textual Encoding of Subject Public Key Info]
|
|
// (https://tools.ietf.org/html/rfc7468#section-13).
|
|
string pem = 1;
|
|
|
|
// The
|
|
// [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
|
|
// associated with this key.
|
|
CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 2;
|
|
}
|
|
|
|
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how
|
|
// cryptographic operations are performed.
|
|
enum ProtectionLevel {
|
|
// Not specified.
|
|
PROTECTION_LEVEL_UNSPECIFIED = 0;
|
|
|
|
// Crypto operations are performed in software.
|
|
SOFTWARE = 1;
|
|
|
|
// Crypto operations are performed in a Hardware Security Module.
|
|
HSM = 2;
|
|
}
|
|
|