// Copyright 2018 Google LLC. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // syntax = "proto3"; package google.cloud.kms.v1; import "google/api/annotations.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/timestamp.proto"; option cc_enable_arenas = true; option csharp_namespace = "Google.Cloud.Kms.V1"; option go_package = "google.golang.org/genproto/googleapis/cloud/kms/v1;kms"; option java_multiple_files = true; option java_outer_classname = "KmsResourcesProto"; option java_package = "com.google.cloud.kms.v1"; option php_namespace = "Google\\Cloud\\Kms\\V1"; // A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of // [CryptoKeys][google.cloud.kms.v1.CryptoKey]. message KeyRing { // Output only. The resource name for the // [KeyRing][google.cloud.kms.v1.KeyRing] in the format // `projects/*/locations/*/keyRings/*`. string name = 1; // Output only. The time at which this [KeyRing][google.cloud.kms.v1.KeyRing] // was created. google.protobuf.Timestamp create_time = 2; } // A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that // can be used for cryptographic operations. // // A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of one or more // [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual // key material used in cryptographic operations. message CryptoKey { // [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] // describes the cryptographic capabilities of a // [CryptoKey][google.cloud.kms.v1.CryptoKey]. A given key can only be used // for the operations allowed by its purpose. enum CryptoKeyPurpose { // Not specified. CRYPTO_KEY_PURPOSE_UNSPECIFIED = 0; // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used // with [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and // [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. ENCRYPT_DECRYPT = 1; // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used // with // [AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign] // and // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. ASYMMETRIC_SIGN = 5; // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used // with // [AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt] // and // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. ASYMMETRIC_DECRYPT = 6; } // Output only. The resource name for this // [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format // `projects/*/locations/*/keyRings/*/cryptoKeys/*`. string name = 1; // Output only. A copy of the "primary" // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used // by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this // [CryptoKey][google.cloud.kms.v1.CryptoKey] is given in // [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name]. // // The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be // updated via // [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]. // // All keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] // have a primary. For other keys, this field will be omitted. CryptoKeyVersion primary = 2; // The immutable purpose of this [CryptoKey][google.cloud.kms.v1.CryptoKey]. CryptoKeyPurpose purpose = 3; // Output only. The time at which this // [CryptoKey][google.cloud.kms.v1.CryptoKey] was created. google.protobuf.Timestamp create_time = 5; // At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time], // the Key Management Service will automatically: // // 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey]. // 2. Mark the new version as primary. // // Key rotations performed manually via // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] // and // [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion] // do not affect // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]. // // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] // support automatic rotation. For other keys, this field must be omitted. google.protobuf.Timestamp next_rotation_time = 7; // Controls the rate of automatic rotation. oneof rotation_schedule { // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] // will be advanced by this period when the service automatically rotates a // key. Must be at least one day. // // If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is // set, // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] // must also be set. // // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] // support automatic rotation. For other keys, this field must be omitted. google.protobuf.Duration rotation_period = 8; } // A template describing settings for new // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. The // properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] // instances created by either // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] // or auto-rotation are controlled by this template. CryptoKeyVersionTemplate version_template = 11; // Labels with user-defined metadata. For more information, see // [Labeling Keys](/kms/docs/labeling-keys). map labels = 10; } // A [CryptoKeyVersionTemplate][google.cloud.kms.v1.CryptoKeyVersionTemplate] // specifies the properties to use when creating a new // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], either manually // with // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] // or automatically as a result of auto-rotation. message CryptoKeyVersionTemplate { // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when creating // a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this // template. Immutable. Defaults to // [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE]. ProtectionLevel protection_level = 1; // Required. // [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] // to use when creating a // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this // template. // // For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both // this field is omitted and // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] is // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 3; } // Contains an HSM-generated attestation about a key operation. message KeyOperationAttestation { // Attestion formats provided by the HSM. enum AttestationFormat { ATTESTATION_FORMAT_UNSPECIFIED = 0; // Cavium HSM attestation compressed with gzip. Note that this format is // defined by Cavium and subject to change at any time. CAVIUM_V1_COMPRESSED = 3; // Cavium HSM attestation V2 compressed with gzip. This is a new format // Introduced in Cavium's version 3.2-08 CAVIUM_V2_COMPRESSED = 4; } // Output only. The format of the attestation data. AttestationFormat format = 4; // Output only. The attestation data provided by the HSM when the key // operation was performed. bytes content = 5; } // A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an // individual cryptographic key, and the associated key material. // // An // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] // version can be used for cryptographic operations. // // For security reasons, the raw cryptographic key material represented by a // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed // or exported. It can only be used to encrypt, decrypt, or sign data when an // authorized user or application invokes Cloud KMS. message CryptoKeyVersion { // The algorithm of the // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating what // parameters must be used for each cryptographic operation. // // The // [GOOGLE_SYMMETRIC_ENCRYPTION][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION] // algorithm is usable with // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. // // Algorithms beginning with "RSA_SIGN_" are usable with // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN]. // // The fields in the name after "RSA_SIGN_" correspond to the following // parameters: padding algorithm, modulus bit length, and digest algorithm. // // For PSS, the salt length used is equal to the length of digest // algorithm. For example, // [RSA_SIGN_PSS_2048_SHA256][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256] // will use PSS with a salt length of 256 bits or 32 bytes. // // Algorithms beginning with "RSA_DECRYPT_" are usable with // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT]. // // The fields in the name after "RSA_DECRYPT_" correspond to the following // parameters: padding algorithm, modulus bit length, and digest algorithm. // // Algorithms beginning with "EC_SIGN_" are usable with // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN]. // // The fields in the name after "EC_SIGN_" correspond to the following // parameters: elliptic curve, digest algorithm. enum CryptoKeyVersionAlgorithm { // Not specified. CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0; // Creates symmetric encryption keys. GOOGLE_SYMMETRIC_ENCRYPTION = 1; // RSASSA-PSS 2048 bit key with a SHA256 digest. RSA_SIGN_PSS_2048_SHA256 = 2; // RSASSA-PSS 3072 bit key with a SHA256 digest. RSA_SIGN_PSS_3072_SHA256 = 3; // RSASSA-PSS 4096 bit key with a SHA256 digest. RSA_SIGN_PSS_4096_SHA256 = 4; // RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest. RSA_SIGN_PKCS1_2048_SHA256 = 5; // RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest. RSA_SIGN_PKCS1_3072_SHA256 = 6; // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest. RSA_SIGN_PKCS1_4096_SHA256 = 7; // RSAES-OAEP 2048 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_2048_SHA256 = 8; // RSAES-OAEP 3072 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_3072_SHA256 = 9; // RSAES-OAEP 4096 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_4096_SHA256 = 10; // ECDSA on the NIST P-256 curve with a SHA256 digest. EC_SIGN_P256_SHA256 = 12; // ECDSA on the NIST P-384 curve with a SHA384 digest. EC_SIGN_P384_SHA384 = 13; } // The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], // indicating if it can be used. enum CryptoKeyVersionState { // Not specified. CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0; // This version is still being generated. It may not be used, enabled, // disabled, or destroyed yet. Cloud KMS will automatically mark this // version // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] // as soon as the version is ready. PENDING_GENERATION = 5; // This version may be used for cryptographic operations. ENABLED = 1; // This version may not be used, but the key material is still available, // and the version can be placed back into the // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] // state. DISABLED = 2; // This version is destroyed, and the key material is no longer stored. // A version may not leave this state once entered. DESTROYED = 3; // This version is scheduled for destruction, and will be destroyed soon. // Call // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] // to put it back into the // [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] // state. DESTROY_SCHEDULED = 4; } // A view for [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]s. // Controls the level of detail returned for // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] in // [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions] // and // [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys]. enum CryptoKeyVersionView { // Default view for each // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Does not // include the // [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation] field. CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED = 0; // Provides all fields in each // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], including the // [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation]. FULL = 1; } // Output only. The resource name for this // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the format // `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`. string name = 1; // The current state of the // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. CryptoKeyVersionState state = 3; // Output only. The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] // describing how crypto operations are performed with this // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. ProtectionLevel protection_level = 7; // Output only. The // [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] // that this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] // supports. CryptoKeyVersionAlgorithm algorithm = 10; // Output only. Statement that was generated and signed by the HSM at key // creation time. Use this statement to verify attributes of the key as stored // on the HSM, independently of Google. Only provided for key versions with // [protection_level][google.cloud.kms.v1.CryptoKeyVersion.protection_level] // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM]. KeyOperationAttestation attestation = 8; // Output only. The time at which this // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] was created. google.protobuf.Timestamp create_time = 4; // Output only. The time this // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material was // generated. google.protobuf.Timestamp generate_time = 11; // Output only. The time this // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material is // scheduled for destruction. Only present if // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]. google.protobuf.Timestamp destroy_time = 5; // Output only. The time this CryptoKeyVersion's key material was // destroyed. Only present if // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. google.protobuf.Timestamp destroy_event_time = 6; } // The public key for a given // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. message PublicKey { // The public key, encoded in PEM format. For more information, see the // [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for // [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and // [Textual Encoding of Subject Public Key Info] // (https://tools.ietf.org/html/rfc7468#section-13). string pem = 1; // The // [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] // associated with this key. CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 2; } // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how // cryptographic operations are performed. enum ProtectionLevel { // Not specified. PROTECTION_LEVEL_UNSPECIFIED = 0; // Crypto operations are performed in software. SOFTWARE = 1; // Crypto operations are performed in a Hardware Security Module. HSM = 2; }