Skip to content

Commit be7f090

Browse files
sethvargosethvargo
authored
feat(kms): Add samples for new KMS RNG APIs (GoogleCloudPlatform#1467)
1 parent 5d08768 commit be7f090

File tree

9 files changed

+345
-1
lines changed

9 files changed

+345
-1
lines changed

‎kms/composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"require": {
3-
"google/cloud-kms": "^1.10.0"
3+
"google/cloud-kms": "^1.12.0"
44
}
55
}

‎kms/src/create_key_asymmetric_decrypt.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
use Google\Cloud\Kms\V1\CryptoKeyVersion\CryptoKeyVersionAlgorithm;
2424
use Google\Cloud\Kms\V1\CryptoKeyVersionTemplate;
2525
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
26+
use Google\Protobuf\Duration;
2627

2728
function create_key_asymmetric_decrypt_sample(
2829
string $projectId = 'my-project',
@@ -41,6 +42,11 @@ function create_key_asymmetric_decrypt_sample(
4142
->setPurpose(CryptoKeyPurpose::ASYMMETRIC_DECRYPT)
4243
->setVersionTemplate((new CryptoKeyVersionTemplate())
4344
->setAlgorithm(CryptoKeyVersionAlgorithm::RSA_DECRYPT_OAEP_2048_SHA256)
45+
)
46+
47+
// Optional: customize how long key versions should be kept before destroying.
48+
->setDestroyScheduledDuration((new Duration())
49+
->setSeconds(24*60*60)
4450
);
4551

4652
// Call the API.

‎kms/src/create_key_asymmetric_sign.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
use Google\Cloud\Kms\V1\CryptoKeyVersion\CryptoKeyVersionAlgorithm;
2424
use Google\Cloud\Kms\V1\CryptoKeyVersionTemplate;
2525
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
26+
use Google\Protobuf\Duration;
2627

2728
function create_key_asymmetric_sign_sample(
2829
string $projectId = 'my-project',
@@ -41,6 +42,11 @@ function create_key_asymmetric_sign_sample(
4142
->setPurpose(CryptoKeyPurpose::ASYMMETRIC_SIGN)
4243
->setVersionTemplate((new CryptoKeyVersionTemplate())
4344
->setAlgorithm(CryptoKeyVersionAlgorithm::RSA_SIGN_PKCS1_2048_SHA256)
45+
)
46+
47+
// Optional: customize how long key versions should be kept before destroying.
48+
->setDestroyScheduledDuration((new Duration())
49+
->setSeconds(24*60*60)
4450
);
4551

4652
// Call the API.

‎kms/src/create_key_hsm.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
use Google\Cloud\Kms\V1\CryptoKeyVersionTemplate;
2525
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
2626
use Google\Cloud\Kms\V1\ProtectionLevel;
27+
use Google\Protobuf\Duration;
2728

2829
function create_key_hsm_sample(
2930
string $projectId = 'my-project',
@@ -43,6 +44,11 @@ function create_key_hsm_sample(
4344
->setVersionTemplate((new CryptoKeyVersionTemplate())
4445
->setAlgorithm(CryptoKeyVersionAlgorithm::GOOGLE_SYMMETRIC_ENCRYPTION)
4546
->setProtectionLevel(ProtectionLevel::HSM)
47+
)
48+
49+
// Optional: customize how long key versions should be kept before destroying.
50+
->setDestroyScheduledDuration((new Duration())
51+
->setSeconds(24*60*60)
4652
);
4753

4854
// Call the API.

‎kms/src/create_key_mac.php‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?php
2+
/*
3+
* Copyright 2021 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
// [START kms_create_key_mac]
21+
use Google\Cloud\Kms\V1\CryptoKey;
22+
use Google\Cloud\Kms\V1\CryptoKey\CryptoKeyPurpose;
23+
use Google\Cloud\Kms\V1\CryptoKeyVersion\CryptoKeyVersionAlgorithm;
24+
use Google\Cloud\Kms\V1\CryptoKeyVersionTemplate;
25+
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
26+
use Google\Protobuf\Duration;
27+
28+
function create_key_mac_sample(
29+
string $projectId = 'my-project',
30+
string $locationId = 'us-east1',
31+
string $keyRingId = 'my-key-ring',
32+
string $id = 'my-mac-key'
33+
) {
34+
// Create the Cloud KMS client.
35+
$client = new KeyManagementServiceClient();
36+
37+
// Build the parent key ring name.
38+
$keyRingName = $client->keyRingName($projectId, $locationId, $keyRingId);
39+
40+
// Build the key.
41+
$key = (new CryptoKey())
42+
->setPurpose(CryptoKeyPurpose::MAC)
43+
->setVersionTemplate((new CryptoKeyVersionTemplate())
44+
->setAlgorithm(CryptoKeyVersionAlgorithm::HMAC_SHA256)
45+
)
46+
47+
// Optional: customize how long key versions should be kept before destroying.
48+
->setDestroyScheduledDuration((new Duration())
49+
->setSeconds(24*60*60)
50+
);
51+
52+
// Call the API.
53+
$createdKey = $client->createCryptoKey($keyRingName, $id, $key);
54+
printf('Created mac key: %s' . PHP_EOL, $createdKey->getName());
55+
return $createdKey;
56+
}
57+
// [END kms_create_key_mac]
58+
59+
if (isset($argv)) {
60+
if (count($argv) === 0) {
61+
return printf("Usage: php %s PROJECT_ID LOCATION_ID KEY_RING_ID ID\n", basename(__FILE__));
62+
}
63+
64+
require_once __DIR__ . '/../vendor/autoload.php';
65+
list($_, $projectId, $locationId, $keyRingId, $id) = $argv;
66+
create_key_mac_sample($projectId, $locationId, $keyRingId, $id);
67+
}

‎kms/src/generate_random_bytes.php‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php
2+
/*
3+
* Copyright 2021 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
// [START kms_generate_random_bytes]
21+
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
22+
use Google\Cloud\Kms\V1\ProtectionLevel;
23+
24+
function generate_random_bytes_sample(
25+
string $projectId = 'my-project',
26+
string $locationId = 'us-east1',
27+
int $numBytes = 256
28+
) {
29+
// Create the Cloud KMS client.
30+
$client = new KeyManagementServiceClient();
31+
32+
// Build the parent name.
33+
$locationName = $client->locationName($projectId, $locationId);
34+
35+
// Call the API.
36+
$randomBytesResponse = $client->generateRandomBytes(array(
37+
'location' => $locationName,
38+
'lengthBytes' => $numBytes,
39+
'protectionLevel' => ProtectionLevel::HSM
40+
));
41+
42+
// The data comes back as raw bytes, which may include non-printable
43+
// characters. This base64-encodes the result so it can be printed below.
44+
$encodedData = base64_encode($randomBytesResponse->getData());
45+
printf('Random bytes: %s' . PHP_EOL, $encodedData);
46+
47+
return $randomBytesResponse;
48+
}
49+
// [END kms_generate_random_bytes]
50+
51+
if (isset($argv)) {
52+
if (count($argv) === 0) {
53+
return printf("Usage: php %s PROJECT_ID LOCATION_ID NUM_BYTES\n", basename(__FILE__));
54+
}
55+
56+
require_once __DIR__ . '/../vendor/autoload.php';
57+
list($_, $projectId, $locationId, $numBytes) = $argv;
58+
generate_random_bytes_sample($projectId, $locationId, $numBytes);
59+
}

‎kms/src/sign_mac.php‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<?php
2+
/*
3+
* Copyright 2021 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
// [START kms_sign_mac]
21+
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
22+
23+
function sign_mac_sample(
24+
string $projectId = 'my-project',
25+
string $locationId = 'us-east1',
26+
string $keyRingId = 'my-key-ring',
27+
string $keyId = 'my-key',
28+
string $versionId = '123',
29+
string $data = '...'
30+
) {
31+
// Create the Cloud KMS client.
32+
$client = new KeyManagementServiceClient();
33+
34+
// Build the key version name.
35+
$keyVersionName = $client->cryptoKeyVersionName($projectId, $locationId, $keyRingId, $keyId, $versionId);
36+
37+
// Call the API.
38+
$signMacResponse = $client->macSign($keyVersionName, $data);
39+
40+
// The data comes back as raw bytes, which may include non-printable
41+
// characters. This base64-encodes the result so it can be printed below.
42+
$signature = base64_encode($signMacResponse->getMac());
43+
printf('Signature: %s' . PHP_EOL, $signature);
44+
45+
return $signMacResponse;
46+
}
47+
// [END kms_sign_mac]
48+
49+
if (isset($argv)) {
50+
if (count($argv) === 0) {
51+
return printf("Usage: php %s PROJECT_ID LOCATION_ID KEY_RING_ID KEY_ID VERSION_ID DATA\n", basename(__FILE__));
52+
}
53+
54+
require_once __DIR__ . '/../vendor/autoload.php';
55+
list($_, $projectId, $locationId, $keyRingId, $keyId, $versionId, $data) = $argv;
56+
sign_mac_sample($projectId, $locationId, $keyRingId, $keyId, $versionId, $data);
57+
}

‎kms/src/verify_mac.php‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?php
2+
/*
3+
* Copyright 2021 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
// [START kms_verify_mac]
21+
use Google\Cloud\Kms\V1\KeyManagementServiceClient;
22+
23+
function verify_mac_sample(
24+
string $projectId = 'my-project',
25+
string $locationId = 'us-east1',
26+
string $keyRingId = 'my-key-ring',
27+
string $keyId = 'my-key',
28+
string $versionId = '123',
29+
string $data = '...',
30+
string $signature = '...'
31+
) {
32+
// Create the Cloud KMS client.
33+
$client = new KeyManagementServiceClient();
34+
35+
// Build the key version name.
36+
$keyVersionName = $client->cryptoKeyVersionName($projectId, $locationId, $keyRingId, $keyId, $versionId);
37+
38+
// Call the API.
39+
$verifyMacResponse = $client->macVerify($keyVersionName, $data, $signature);
40+
41+
printf('Signature verified: %s' . PHP_EOL, $verifyMacResponse->getSuccess());
42+
return $verifyMacResponse;
43+
}
44+
// [END kms_verify_mac]
45+
46+
if (isset($argv)) {
47+
if (count($argv) === 0) {
48+
return printf("Usage: php %s PROJECT_ID LOCATION_ID KEY_RING_ID KEY_ID VERSION_ID DATA\n", basename(__FILE__));
49+
}
50+
51+
require_once __DIR__ . '/../vendor/autoload.php';
52+
list($_, $projectId, $locationId, $keyRingId, $keyId, $versionId, $data) = $argv;
53+
verify_mac_sample($projectId, $locationId, $keyRingId, $keyId, $versionId, $data);
54+
}

0 commit comments

Comments
 (0)