1# Copyright 2021 Google LLC 2# 3# Licensed under the Apache License, Version 2.0 (the "License"); 4# you may not use this file except in compliance with the License. 5# You may obtain a copy of the License at 6# 7# http://www.apache.org/licenses/LICENSE-2.0 8# 9# Unless required by applicable law or agreed to in writing, software 10# distributed under the License is distributed on an "AS-IS" BASIS, 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12# See the License for the specific language governing permissions and 13# limitations under the License. 14# [START envelope-example] 15"""A command-line utility for encrypting small files using envelope encryption with GCP.""" 16 17from absl import app 18from absl import flags 19from absl import logging 20import tink 21from tink import aead 22from tink.integration import gcpkms 23 24 25FLAGS = flags.FLAGS 26 27flags.DEFINE_enum( 28 'mode', None, ['encrypt', 'decrypt'], 'The operation to perform.' 29) 30flags.DEFINE_string( 31 'kek_uri', None, 'The Cloud KMS URI of the key encryption key.' 32) 33flags.DEFINE_string( 34 'gcp_credential_path', None, 'Path to the GCP credentials JSON file.' 35) 36flags.DEFINE_string('input_path', None, 'Path to the input file.') 37flags.DEFINE_string('output_path', None, 'Path to the output file.') 38flags.DEFINE_string( 39 'associated_data', None, 'Optional associated data used for the encryption.' 40) 41 42 43def main(argv): 44 del argv # Unused. 45 46 associated_data = ( 47 b'' 48 if not FLAGS.associated_data 49 else bytes(FLAGS.associated_data, 'utf-8') 50 ) 51 52 # Initialise Tink 53 aead.register() 54 55 try: 56 # Read the GCP credentials and setup client 57 client = gcpkms.GcpKmsClient(FLAGS.kek_uri, FLAGS.gcp_credential_path) 58 except tink.TinkError as e: 59 logging.exception('Error creating GCP KMS client: %s', e) 60 return 1 61 62 # Create envelope AEAD primitive using AES256 GCM for encrypting the data 63 try: 64 remote_aead = client.get_aead(FLAGS.kek_uri) 65 env_aead = aead.KmsEnvelopeAead( 66 aead.aead_key_templates.AES256_GCM, remote_aead 67 ) 68 except tink.TinkError as e: 69 logging.exception('Error creating primitive: %s', e) 70 return 1 71 72 with open(FLAGS.input_path, 'rb') as input_file: 73 input_data = input_file.read() 74 if FLAGS.mode == 'decrypt': 75 output_data = env_aead.decrypt(input_data, associated_data) 76 elif FLAGS.mode == 'encrypt': 77 output_data = env_aead.encrypt(input_data, associated_data) 78 else: 79 logging.error( 80 'Unsupported mode %s. Please choose "encrypt" or "decrypt".', 81 FLAGS.mode, 82 ) 83 return 1 84 85 with open(FLAGS.output_path, 'wb') as output_file: 86 output_file.write(output_data) 87 88 89if __name__ == '__main__': 90 flags.mark_flags_as_required( 91 ['mode', 'kek_uri', 'gcp_credential_path', 'input_path', 'output_path'] 92 ) 93 app.run(main) 94# [END envelope-example] 95