Class KmsClients
- java.lang.Object
-
- com.google.crypto.tink.KmsClients
-
public final class KmsClients extends java.lang.ObjectA container forKmsClient-objects that are needed byKeyManager-objects for primitives that use KMS-managed keys.This class consists exclusively of static methods that register and load
KmsClient-objects.- Since:
- 1.0.0
-
-
Method Summary
All Methods Static Methods Concrete Methods Deprecated Methods Modifier and Type Method Description static voidadd(KmsClient client)Adds a client to the list of knownKmsClient-objects.static KmsClientget(java.lang.String keyUri)Returns the firstKmsClientregistered withadd(com.google.crypto.tink.KmsClient)that supportskeyUri.static KmsClientgetAutoLoaded(java.lang.String keyUri)Deprecated.Don't use this.
-
-
-
Method Detail
-
add
public static void add(KmsClient client)
Adds a client to the list of knownKmsClient-objects.This function will always add the
clientto a global list. So this function should only be called on startup and not on every operation.It is often not necessary to use this function. For example, you can call
KmsClient.getAead(java.lang.String)to get a remoteAead. Use thisAeadto encrypt a keyset withTinkProtoKeysetFormat.serializeEncryptedKeyset(com.google.crypto.tink.KeysetHandle, com.google.crypto.tink.Aead, byte[]), or to create an envelopeAeadusingKmsEnvelopeAead.create(com.google.crypto.tink.aead.AeadParameters, com.google.crypto.tink.Aead).
-
get
public static KmsClient get(java.lang.String keyUri) throws java.security.GeneralSecurityException
Returns the firstKmsClientregistered withadd(com.google.crypto.tink.KmsClient)that supportskeyUri.- Throws:
java.security.GeneralSecurityException- if no KMS clients can be found that supportkeyUri
-
getAutoLoaded
@Deprecated public static KmsClient getAutoLoaded(java.lang.String keyUri) throws java.security.GeneralSecurityException
Deprecated.Don't use this.Returns the firstKmsClientautomatically loaded withServiceLoaderthat supportskeyUri.Warning This method searches over the classpath for all implementations of
KmsClient. An attacker that can insert a class in your classpath (e.g., someone controlling a library that you're using) could provide a fakeKmsClientthat steal your keys. For this reason Tink does not use this method.- Throws:
java.security.GeneralSecurityException- if cannot found any KMS clients that supportkeyUri
-
-