Class KmsEnvelopeAeadKeyManager
- java.lang.Object
-
- com.google.crypto.tink.aead.KmsEnvelopeAeadKeyManager
-
public class KmsEnvelopeAeadKeyManager extends java.lang.ObjectThis key manager generates newKmsEnvelopeAeadKeykeys and produces new instances ofKmsEnvelopeAead.
-
-
Method Summary
All Methods Static Methods Concrete Methods Modifier and Type Method Description static KeyTemplatecreateKeyTemplate(java.lang.String kekUri, KeyTemplate dekTemplate)Returns a newKeyTemplatethat can generate aLegacyKmsEnvelopeAeadKeywhose key encrypting key (KEK) is pointing tokekUriand DEK template isdekTemplate(or a derived version of it).static voidregister(boolean newKeyAllowed)
-
-
-
Method Detail
-
createKeyTemplate
public static KeyTemplate createKeyTemplate(java.lang.String kekUri, KeyTemplate dekTemplate)
Returns a newKeyTemplatethat can generate aLegacyKmsEnvelopeAeadKeywhose key encrypting key (KEK) is pointing tokekUriand DEK template isdekTemplate(or a derived version of it).It requires that a
KmsClientthat can handlekekUriis registered. Avoid registering it more than once.Note: Unlike other templates, when you call
KeysetHandle#generateNewwith this template Tink does not generate new key material, but instead creates a reference to the remote KEK.The second argument of the passed in template is ignoring the Variant, and assuming NO_PREFIX instead.
It is often not necessary to use this function. Instead of registering a
KmsClient, and creating anAeadusingKeysetHandle.generateNew(KmsEnvelopeAeadKeyManager.createKeyTemplate(keyUri, KeyTemplates.get("AES128_GCM"))).getPrimitive(RegistryConfiguration.get(), Aead.class), create theAeaddirectly usingKmsEnvelopeAead.create(PredefinedAeadParameters.AES256_GCM, kmsClient.getAead(keyUri)), without registering anyKmsClient.
-
register
public static void register(boolean newKeyAllowed) throws java.security.GeneralSecurityException- Throws:
java.security.GeneralSecurityException
-
-