aws_key_gen

README

Script to Create Tink Hybrid Keys using Envelope Encryption with AWS

This script creates a Tink Hybrid (ECIES with AEAD) key and outputs the public key in plaintext to an output file, as well as the encrypted private key to another output file. The private key is encrypted using a key hosted on Amazon Web Services (AWS). This method is commonly referred to as Envelope Encryption.

This script was inspired by the Medium post Google Cloud KMS & Tink. Please read that post for more information.

Installation:

# Go get the script
go get -u github.com/subscriptions-project/encryption/golang/cmd/aws_key_gen

Example Usage:

For AWS credentials make sure you have awscli installed and you have configured it by running aws configure NOT aws configure --profile my-profile

go run github.com/subscriptions-project/encryption/golang/cmd/aws_key_gen \
    --region=$AWS_KMS_REGION \
    --account=$AWS_ACCOUNT_ID \
    --key=$AWS_KMS_KEY_ID \
    --outfilePrivate=$PRIVATE_KEY_FILE \
    --outfilePublic=$PUBLIC_KEY_FILE