1 // Copyright 2019 Google LLC 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 // 15 /////////////////////////////////////////////////////////////////////////////// 16 17 #ifndef TINK_INTEGRATION_GCPKMS_GCP_KMS_AEAD_H_ 18 #define TINK_INTEGRATION_GCPKMS_GCP_KMS_AEAD_H_ 19 20 #include <memory> 21 #include <string> 22 23 #include "google/cloud/kms/v1/service.grpc.pb.h" 24 #include "absl/strings/string_view.h" 25 #include "tink/aead.h" 26 #include "tink/util/statusor.h" 27 28 namespace crypto { 29 namespace tink { 30 namespace integration { 31 namespace gcpkms { 32 33 // GcpKmsAead is an implementation of AEAD that forwards encryption/decryption 34 // requests to a key managed by the Google Cloud KMS 35 // (https://cloud.google.com/kms/). 36 class GcpKmsAead : public Aead { 37 public: 38 // Move only. 39 GcpKmsAead(GcpKmsAead&& other) = default; 40 GcpKmsAead& operator=(GcpKmsAead&& other) = default; 41 GcpKmsAead(const GcpKmsAead&) = delete; 42 GcpKmsAead& operator=(const GcpKmsAead&) = delete; 43 44 // Creates a new GcpKmsAead that is bound to the key specified in `key_name`, 45 // and that uses the channel when communicating with the KMS. 46 // 47 // Valid values for `key_name` have the following format: 48 // projects/*/locations/*/keyRings/*/cryptoKeys/*. 49 // See https://cloud.google.com/kms/docs/object-hierarchy for more info. 50 static crypto::tink::util::StatusOr<std::unique_ptr<Aead>> New( 51 absl::string_view key_name, 52 std::shared_ptr<google::cloud::kms::v1::KeyManagementService::Stub> 53 kms_stub); 54 55 crypto::tink::util::StatusOr<std::string> Encrypt( 56 absl::string_view plaintext, 57 absl::string_view associated_data) const override; 58 59 crypto::tink::util::StatusOr<std::string> Decrypt( 60 absl::string_view ciphertext, 61 absl::string_view associated_data) const override; 62 63 private: GcpKmsAead(absl::string_view key_name,std::shared_ptr<google::cloud::kms::v1::KeyManagementService::Stub> kms_stub)64 explicit GcpKmsAead( 65 absl::string_view key_name, 66 std::shared_ptr<google::cloud::kms::v1::KeyManagementService::Stub> 67 kms_stub) 68 : key_name_(key_name), kms_stub_(kms_stub) {} 69 70 // The location of a crypto key in GCP KMS. 71 std::string key_name_; 72 std::shared_ptr<google::cloud::kms::v1::KeyManagementService::Stub> kms_stub_; 73 }; 74 75 } // namespace gcpkms 76 } // namespace integration 77 } // namespace tink 78 } // namespace crypto 79 80 #endif // TINK_INTEGRATION_GCPKMS_GCP_KMS_AEAD_H_ 81