kmsv2

Documentation

Overview

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope provider

Index

• Constants
• Variables
• func GenerateTransformer(ctx context.Context, uid string, envelopeService kmsservice.Service) (value.Transformer, *kmsservice.EncryptResponse, []byte, error)
• func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc) value.Transformer
• func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)
• type ErrCodeKeyID
  • func ValidateKeyID(keyID string) (ErrCodeKeyID, error)
• type State
  • func (s *State) ValidateEncryptCapability() error
• type StateFunc

Constants

const (
	// KMSAPIVersion is the version of the KMS API.
	KMSAPIVersion = "v2beta1"

	// KeyIDMaxSize is the maximum size of the keyID.
	KeyIDMaxSize = 1 * 1024 // 1 kB

)

Variables

var NowFunc = time.Now

NowFunc is exported so tests can override it.

Functions

func GenerateTransformer

func GenerateTransformer(ctx context.Context, uid string, envelopeService kmsservice.Service) (value.Transformer, *kmsservice.EncryptResponse, []byte, error)

GenerateTransformer generates a new transformer and encrypts the DEK using the envelope service. It returns the transformer, the encrypted DEK, cache key and error.

func NewEnvelopeTransformer

func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc) value.Transformer

NewEnvelopeTransformer returns a transformer which implements a KEK-DEK based envelope encryption scheme. It uses envelopeService to encrypt and decrypt DEKs. Respective DEKs (in encrypted form) are prepended to the data items they encrypt.

func NewGRPCService

func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)

NewGRPCService returns an envelope.Service which use gRPC to communicate the remote KMS provider.

Types

type ErrCodeKeyID

type ErrCodeKeyID string

func ValidateKeyID

func ValidateKeyID(keyID string) (ErrCodeKeyID, error)

ValidateKeyID tests the following: 1. The keyID is not empty. 2. The size of keyID is less than 1 kB.

type State

type State struct {
	Transformer  value.Transformer
	EncryptedDEK []byte
	KeyID        string
	Annotations  map[string][]byte

	UID string

	ExpirationTimestamp time.Time

	// CacheKey is the key used to cache the DEK in transformer.cache.
	CacheKey []byte
}

func (*State) ValidateEncryptCapability

func (s *State) ValidateEncryptCapability() error

type StateFunc

type StateFunc func() (State, error)