Documentation ¶
Overview ¶
Package kmsv2 transforms values for storage at rest using a Envelope v2 provider
Package kmsv2 transforms values for storage at rest using a Envelope provider
Index ¶
- Constants
- func NewEnvelopeTransformer(envelopeService kmsservice.Service, keyIDGetter KeyIDGetterFunc, cacheSize int, ...) value.Transformer
- func NewGRPCService(ctx context.Context, endpoint string, callTimeout time.Duration) (kmsservice.Service, error)
- func ValidateKeyID(keyID string) error
- type KeyIDGetterFunc
Constants ¶
const (
// KMSAPIVersion is the version of the KMS API.
KMSAPIVersion = "v2alpha1"
)
Variables ¶
This section is empty.
Functions ¶
func NewEnvelopeTransformer ¶
func NewEnvelopeTransformer(envelopeService kmsservice.Service, keyIDGetter KeyIDGetterFunc, cacheSize int, baseTransformerFunc func(cipher.Block) value.Transformer) value.Transformer
NewEnvelopeTransformer returns a transformer which implements a KEK-DEK based envelope encryption scheme. It uses envelopeService to encrypt and decrypt DEKs. Respective DEKs (in encrypted form) are prepended to the data items they encrypt. A cache (of size cacheSize) is maintained to store the most recently used decrypted DEKs in memory.
func NewGRPCService ¶
func NewGRPCService(ctx context.Context, endpoint string, callTimeout time.Duration) (kmsservice.Service, error)
NewGRPCService returns an envelope.Service which use gRPC to communicate the remote KMS provider.
func ValidateKeyID ¶ added in v0.27.0
ValidateKeyID tests the following: 1. The keyID is not empty. 2. The size of keyID is less than 1 kB.