1// Copyright 2017 Google Inc. 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// http://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14// 15//////////////////////////////////////////////////////////////////////////////// 16 17package gcpkms_test 18 19import ( 20 "context" 21 "log" 22 23 "google.golang.org/api/option" 24 "github.com/google/tink/go/aead" 25 "github.com/google/tink/go/integration/gcpkms" 26) 27 28func Example() { 29 const keyURI = "gcp-kms://......" 30 ctx := context.Background() 31 gcpclient, err := gcpkms.NewClientWithOptions(ctx, keyURI, option.WithCredentialsFile("/mysecurestorage/credentials.json")) 32 if err != nil { 33 log.Fatal(err) 34 } 35 kekAEAD, err := gcpclient.GetAEAD(keyURI) 36 if err != nil { 37 log.Fatal(err) 38 } 39 40 // Get the KMS envelope AEAD primitive. 41 dekTemplate := aead.AES128CTRHMACSHA256KeyTemplate() 42 primitive := aead.NewKMSEnvelopeAEAD2(dekTemplate, kekAEAD) 43 if err != nil { 44 log.Fatal(err) 45 } 46 47 // Use the primitive. 48 plaintext := []byte("message") 49 associatedData := []byte("example KMS envelope AEAD encryption") 50 51 ciphertext, err := primitive.Encrypt(plaintext, associatedData) 52 if err != nil { 53 log.Fatal(err) 54 } 55 56 _, err = primitive.Decrypt(ciphertext, associatedData) 57 if err != nil { 58 log.Fatal(err) 59 } 60} 61