Skip to content

Commit 048f3db

Browse files
gcf-owl-bot[bot]pearigee
gcf-owl-bot[bot]
and
pearigee
authored
feat: [kms] support external-μ in the Digest (#8014)
* feat: add a variable to SingleTenantHsmInstanceCreate to control whether future key portability features will be usable on the instance PiperOrigin-RevId: 897676455 Source-Link: googleapis/googleapis@bc600b8 Source-Link: googleapis/googleapis-gen@85de368 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiODVkZTM2ODIxNjUyMDQ1YjM5ZTUyNzlhNDJiYmIzMmZhMjdkYWI4MSJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * feat: support external-μ in the Digest PiperOrigin-RevId: 897686352 Source-Link: googleapis/googleapis@7fbf256 Source-Link: googleapis/googleapis-gen@333010d Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiMzMzMDEwZGI2ZjQwMDE5MTRiMDEzYWU1NjliMzQxOWViNzdmZDFlMSJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: Gabe Pearhill <86282859+pearigee@users.noreply.github.com>
1 parent 5665979 commit 048f3db

6 files changed

Lines changed: 111 additions & 9 deletions

File tree

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/hsm_management.proto‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,15 @@ message SingleTenantHsmInstance {
307307
// become disabled.
308308
google.protobuf.Timestamp disable_time = 7
309309
[(google.api.field_behavior) = OUTPUT_ONLY];
310+
311+
// Optional. Immutable. Indicates whether key portability is enabled for the
312+
// [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
313+
// This can only be set at creation time. Key portability features are
314+
// disabled by default and not yet available in GA.
315+
bool key_portability_enabled = 8 [
316+
(google.api.field_behavior) = OPTIONAL,
317+
(google.api.field_behavior) = IMMUTABLE
318+
];
310319
}
311320

312321
// A

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/resources.proto‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,10 @@ message CryptoKey {
223223
// justification codes.
224224
// https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
225225
// By default, this field is absent, and all justification codes are allowed.
226+
// If the
227+
// `key_access_justifications_policy.allowed_access_reasons`
228+
// is empty (zero allowed justification code), all encrypt, decrypt, and sign
229+
// operations will fail.
226230
KeyAccessJustificationsPolicy key_access_justifications_policy = 17
227231
[(google.api.field_behavior) = OPTIONAL];
228232
}
@@ -1056,13 +1060,17 @@ message ExternalProtectionLevelOptions {
10561060
// [KeyAccessJustificationsPolicy][google.cloud.kms.v1.KeyAccessJustificationsPolicy]
10571061
// specifies zero or more allowed
10581062
// [AccessReason][google.cloud.kms.v1.AccessReason] values for encrypt, decrypt,
1059-
// and sign operations on a [CryptoKey][google.cloud.kms.v1.CryptoKey].
1063+
// and sign operations on a [CryptoKey][google.cloud.kms.v1.CryptoKey] or
1064+
// [KeyAccessJustificationsPolicyConfig][google.cloud.kms.v1.KeyAccessJustificationsPolicyConfig]
1065+
// (the default Key Access Justifications policy).
10601066
message KeyAccessJustificationsPolicy {
10611067
// The list of allowed reasons for access to a
1062-
// [CryptoKey][google.cloud.kms.v1.CryptoKey]. Zero allowed access reasons
1063-
// means all encrypt, decrypt, and sign operations for the
1064-
// [CryptoKey][google.cloud.kms.v1.CryptoKey] associated with this policy will
1065-
// fail.
1068+
// [CryptoKey][google.cloud.kms.v1.CryptoKey]. Note that empty
1069+
// allowed_access_reasons has a different meaning depending on where this
1070+
// message appears. If this is under
1071+
// [KeyAccessJustificationsPolicyConfig][google.cloud.kms.v1.KeyAccessJustificationsPolicyConfig],
1072+
// it means allow-all. If this is under
1073+
// [CryptoKey][google.cloud.kms.v1.CryptoKey], it means deny-all.
10661074
repeated AccessReason allowed_access_reasons = 1;
10671075
}
10681076

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/service.proto‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2335,6 +2335,12 @@ message Digest {
23352335

23362336
// A message digest produced with the SHA-512 algorithm.
23372337
bytes sha512 = 3;
2338+
2339+
// A message digest produced with SHAKE-256, to be used with ML-DSA
2340+
// external-μ algorithms only. See "message representative" note in
2341+
// section 6.2, algorithm 7 of the FIPS-204 standard:
2342+
// https://doi.org/10.6028/nist.fips.204
2343+
bytes external_mu = 4;
23382344
}
23392345
}
23402346

‎packages/google-cloud-kms/protos/protos.d.ts‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3193,6 +3193,9 @@ export namespace google {
31933193

31943194
/** SingleTenantHsmInstance disableTime */
31953195
disableTime?: (google.protobuf.ITimestamp|null);
3196+
3197+
/** SingleTenantHsmInstance keyPortabilityEnabled */
3198+
keyPortabilityEnabled?: (boolean|null);
31963199
}
31973200

31983201
/** Represents a SingleTenantHsmInstance. */
@@ -3225,6 +3228,9 @@ export namespace google {
32253228
/** SingleTenantHsmInstance disableTime. */
32263229
public disableTime?: (google.protobuf.ITimestamp|null);
32273230

3231+
/** SingleTenantHsmInstance keyPortabilityEnabled. */
3232+
public keyPortabilityEnabled: boolean;
3233+
32283234
/**
32293235
* Creates a new SingleTenantHsmInstance instance using the specified properties.
32303236
* @param [properties] Properties to set
@@ -14480,6 +14486,9 @@ export namespace google {
1448014486

1448114487
/** Digest sha512 */
1448214488
sha512?: (Uint8Array|Buffer|string|null);
14489+
14490+
/** Digest externalMu */
14491+
externalMu?: (Uint8Array|Buffer|string|null);
1448314492
}
1448414493

1448514494
/** Represents a Digest. */
@@ -14500,8 +14509,11 @@ export namespace google {
1450014509
/** Digest sha512. */
1450114510
public sha512?: (Uint8Array|Buffer|string|null);
1450214511

14512+
/** Digest externalMu. */
14513+
public externalMu?: (Uint8Array|Buffer|string|null);
14514+
1450314515
/** Digest digest. */
14504-
public digest?: ("sha256"|"sha384"|"sha512");
14516+
public digest?: ("sha256"|"sha384"|"sha512"|"externalMu");
1450514517

1450614518
/**
1450714519
* Creates a new Digest instance using the specified properties.

‎packages/google-cloud-kms/protos/protos.js‎

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7053,6 +7053,7 @@
70537053
* @property {google.protobuf.ITimestamp|null} [deleteTime] SingleTenantHsmInstance deleteTime
70547054
* @property {google.protobuf.IDuration|null} [unrefreshedDurationUntilDisable] SingleTenantHsmInstance unrefreshedDurationUntilDisable
70557055
* @property {google.protobuf.ITimestamp|null} [disableTime] SingleTenantHsmInstance disableTime
7056+
* @property {boolean|null} [keyPortabilityEnabled] SingleTenantHsmInstance keyPortabilityEnabled
70567057
*/
70577058

70587059
/**
@@ -7126,6 +7127,14 @@
71267127
*/
71277128
SingleTenantHsmInstance.prototype.disableTime = null;
71287129

7130+
/**
7131+
* SingleTenantHsmInstance keyPortabilityEnabled.
7132+
* @member {boolean} keyPortabilityEnabled
7133+
* @memberof google.cloud.kms.v1.SingleTenantHsmInstance
7134+
* @instance
7135+
*/
7136+
SingleTenantHsmInstance.prototype.keyPortabilityEnabled = false;
7137+
71297138
/**
71307139
* Creates a new SingleTenantHsmInstance instance using the specified properties.
71317140
* @function create
@@ -7164,6 +7173,8 @@
71647173
$root.google.protobuf.Duration.encode(message.unrefreshedDurationUntilDisable, writer.uint32(/* id 6, wireType 2 =*/50).fork()).ldelim();
71657174
if (message.disableTime != null && Object.hasOwnProperty.call(message, "disableTime"))
71667175
$root.google.protobuf.Timestamp.encode(message.disableTime, writer.uint32(/* id 7, wireType 2 =*/58).fork()).ldelim();
7176+
if (message.keyPortabilityEnabled != null && Object.hasOwnProperty.call(message, "keyPortabilityEnabled"))
7177+
writer.uint32(/* id 8, wireType 0 =*/64).bool(message.keyPortabilityEnabled);
71677178
return writer;
71687179
};
71697180

@@ -7228,6 +7239,10 @@
72287239
message.disableTime = $root.google.protobuf.Timestamp.decode(reader, reader.uint32());
72297240
break;
72307241
}
7242+
case 8: {
7243+
message.keyPortabilityEnabled = reader.bool();
7244+
break;
7245+
}
72317246
default:
72327247
reader.skipType(tag & 7);
72337248
break;
@@ -7306,6 +7321,9 @@
73067321
if (error)
73077322
return "disableTime." + error;
73087323
}
7324+
if (message.keyPortabilityEnabled != null && message.hasOwnProperty("keyPortabilityEnabled"))
7325+
if (typeof message.keyPortabilityEnabled !== "boolean")
7326+
return "keyPortabilityEnabled: boolean expected";
73097327
return null;
73107328
};
73117329

@@ -7392,6 +7410,8 @@
73927410
throw TypeError(".google.cloud.kms.v1.SingleTenantHsmInstance.disableTime: object expected");
73937411
message.disableTime = $root.google.protobuf.Timestamp.fromObject(object.disableTime);
73947412
}
7413+
if (object.keyPortabilityEnabled != null)
7414+
message.keyPortabilityEnabled = Boolean(object.keyPortabilityEnabled);
73957415
return message;
73967416
};
73977417

@@ -7416,6 +7436,7 @@
74167436
object.deleteTime = null;
74177437
object.unrefreshedDurationUntilDisable = null;
74187438
object.disableTime = null;
7439+
object.keyPortabilityEnabled = false;
74197440
}
74207441
if (message.name != null && message.hasOwnProperty("name"))
74217442
object.name = message.name;
@@ -7431,6 +7452,8 @@
74317452
object.unrefreshedDurationUntilDisable = $root.google.protobuf.Duration.toObject(message.unrefreshedDurationUntilDisable, options);
74327453
if (message.disableTime != null && message.hasOwnProperty("disableTime"))
74337454
object.disableTime = $root.google.protobuf.Timestamp.toObject(message.disableTime, options);
7455+
if (message.keyPortabilityEnabled != null && message.hasOwnProperty("keyPortabilityEnabled"))
7456+
object.keyPortabilityEnabled = message.keyPortabilityEnabled;
74347457
return object;
74357458
};
74367459

@@ -36169,6 +36192,7 @@
3616936192
* @property {Uint8Array|null} [sha256] Digest sha256
3617036193
* @property {Uint8Array|null} [sha384] Digest sha384
3617136194
* @property {Uint8Array|null} [sha512] Digest sha512
36195+
* @property {Uint8Array|null} [externalMu] Digest externalMu
3617236196
*/
3617336197

3617436198
/**
@@ -36210,17 +36234,25 @@
3621036234
*/
3621136235
Digest.prototype.sha512 = null;
3621236236

36237+
/**
36238+
* Digest externalMu.
36239+
* @member {Uint8Array|null|undefined} externalMu
36240+
* @memberof google.cloud.kms.v1.Digest
36241+
* @instance
36242+
*/
36243+
Digest.prototype.externalMu = null;
36244+
3621336245
// OneOf field names bound to virtual getters and setters
3621436246
var $oneOfFields;
3621536247

3621636248
/**
3621736249
* Digest digest.
36218-
* @member {"sha256"|"sha384"|"sha512"|undefined} digest
36250+
* @member {"sha256"|"sha384"|"sha512"|"externalMu"|undefined} digest
3621936251
* @memberof google.cloud.kms.v1.Digest
3622036252
* @instance
3622136253
*/
3622236254
Object.defineProperty(Digest.prototype, "digest", {
36223-
get: $util.oneOfGetter($oneOfFields = ["sha256", "sha384", "sha512"]),
36255+
get: $util.oneOfGetter($oneOfFields = ["sha256", "sha384", "sha512", "externalMu"]),
3622436256
set: $util.oneOfSetter($oneOfFields)
3622536257
});
3622636258

@@ -36254,6 +36286,8 @@
3625436286
writer.uint32(/* id 2, wireType 2 =*/18).bytes(message.sha384);
3625536287
if (message.sha512 != null && Object.hasOwnProperty.call(message, "sha512"))
3625636288
writer.uint32(/* id 3, wireType 2 =*/26).bytes(message.sha512);
36289+
if (message.externalMu != null && Object.hasOwnProperty.call(message, "externalMu"))
36290+
writer.uint32(/* id 4, wireType 2 =*/34).bytes(message.externalMu);
3625736291
return writer;
3625836292
};
3625936293

@@ -36302,6 +36336,10 @@
3630236336
message.sha512 = reader.bytes();
3630336337
break;
3630436338
}
36339+
case 4: {
36340+
message.externalMu = reader.bytes();
36341+
break;
36342+
}
3630536343
default:
3630636344
reader.skipType(tag & 7);
3630736345
break;
@@ -36357,6 +36395,13 @@
3635736395
if (!(message.sha512 && typeof message.sha512.length === "number" || $util.isString(message.sha512)))
3635836396
return "sha512: buffer expected";
3635936397
}
36398+
if (message.externalMu != null && message.hasOwnProperty("externalMu")) {
36399+
if (properties.digest === 1)
36400+
return "digest: multiple values";
36401+
properties.digest = 1;
36402+
if (!(message.externalMu && typeof message.externalMu.length === "number" || $util.isString(message.externalMu)))
36403+
return "externalMu: buffer expected";
36404+
}
3636036405
return null;
3636136406
};
3636236407

@@ -36387,6 +36432,11 @@
3638736432
$util.base64.decode(object.sha512, message.sha512 = $util.newBuffer($util.base64.length(object.sha512)), 0);
3638836433
else if (object.sha512.length >= 0)
3638936434
message.sha512 = object.sha512;
36435+
if (object.externalMu != null)
36436+
if (typeof object.externalMu === "string")
36437+
$util.base64.decode(object.externalMu, message.externalMu = $util.newBuffer($util.base64.length(object.externalMu)), 0);
36438+
else if (object.externalMu.length >= 0)
36439+
message.externalMu = object.externalMu;
3639036440
return message;
3639136441
};
3639236442

@@ -36418,6 +36468,11 @@
3641836468
if (options.oneofs)
3641936469
object.digest = "sha512";
3642036470
}
36471+
if (message.externalMu != null && message.hasOwnProperty("externalMu")) {
36472+
object.externalMu = options.bytes === String ? $util.base64.encode(message.externalMu, 0, message.externalMu.length) : options.bytes === Array ? Array.prototype.slice.call(message.externalMu) : message.externalMu;
36473+
if (options.oneofs)
36474+
object.digest = "externalMu";
36475+
}
3642136476
return object;
3642236477
};
3642336478

‎packages/google-cloud-kms/protos/protos.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1138,6 +1138,13 @@
11381138
"options": {
11391139
"(google.api.field_behavior)": "OUTPUT_ONLY"
11401140
}
1141+
},
1142+
"keyPortabilityEnabled": {
1143+
"type": "bool",
1144+
"id": 8,
1145+
"options": {
1146+
"(google.api.field_behavior)": "IMMUTABLE"
1147+
}
11411148
}
11421149
},
11431150
"nested": {
@@ -4330,7 +4337,8 @@
43304337
"oneof": [
43314338
"sha256",
43324339
"sha384",
4333-
"sha512"
4340+
"sha512",
4341+
"externalMu"
43344342
]
43354343
}
43364344
},
@@ -4346,6 +4354,10 @@
43464354
"sha512": {
43474355
"type": "bytes",
43484356
"id": 3
4357+
},
4358+
"externalMu": {
4359+
"type": "bytes",
4360+
"id": 4
43494361
}
43504362
}
43514363
},

0 commit comments

Comments
 (0)