gcp_key_gen

README

Script to Create Tink Hybrid Keys using Envelope Encryption with GCP

This script creates a Tink Hybrid (ECIES with AEAD) key and outputs the public key in plaintext to an output file, as well as the encrypted private key to another output file. The private key is encrypted using a key hosted on Google Cloud (GCP). This method is commonly referred to as Envelope Encryption.

This script was inspired by the Medium post Google Cloud KMS & Tink. Please read that post for more information about setting up GCP keys.

Installation:

# Go get the script
go get -u github.com/subscriptions-project/encryption/golang/cmd/gcp_key_gen

Example Usage:

go run github.com/subscriptions-project/encryption/golang/cmd/gcp_key_gen \
    --project=$GCP_PROJECT_ID \
    --location=$GCP_PROJECT_REGION \
    --keyring=$GCP_KEYRING_NAME \
    --key=$GCP_KEY_NAME \
    --outfilePrivate=$PRIVATE_KEY_FILE \
    --outfilePublic=$PUBLIC_KEY_FILE

Documentation

Overview

Copyright 2019 The Subscribe with Google Authors. All Rights Reserved. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS-IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License.