Skip to content

Commit 891365e

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: [google-cloud-kms] Support PQC asymmetric signing algorithms ML_DSA_65 and SLH_DSA_SHA2_128s (#13538)
- [ ] Regenerate this pull request now. feat: Add a PublicKeyFormat enum to allow specifying the format the public is going to be exported in PiperOrigin-RevId: 728208243 Source-Link: googleapis/googleapis@0c860e0 Source-Link: googleapis/googleapis-gen@904854f Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiOTA0ODU0ZmQ0YWYzNWVjY2EwM2M4NjQwNDgyMDAzMWE5ZWM4ZjdhZCJ9 --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 4cac20d commit 891365e

File tree

11 files changed

+140
-8
lines changed

11 files changed

+140
-8
lines changed

‎packages/google-cloud-kms/google/cloud/kms/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363
)
6464
from google.cloud.kms_v1.types.resources import (
6565
AccessReason,
66+
ChecksummedData,
6667
CryptoKey,
6768
CryptoKeyVersion,
6869
CryptoKeyVersionTemplate,
@@ -152,6 +153,7 @@
152153
"UpdateEkmConnectionRequest",
153154
"VerifyConnectivityRequest",
154155
"VerifyConnectivityResponse",
156+
"ChecksummedData",
155157
"CryptoKey",
156158
"CryptoKeyVersion",
157159
"CryptoKeyVersionTemplate",

‎packages/google-cloud-kms/google/cloud/kms_v1/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@
5656
)
5757
from .types.resources import (
5858
AccessReason,
59+
ChecksummedData,
5960
CryptoKey,
6061
CryptoKeyVersion,
6162
CryptoKeyVersionTemplate,
@@ -127,6 +128,7 @@
127128
"AutokeyClient",
128129
"AutokeyConfig",
129130
"Certificate",
131+
"ChecksummedData",
130132
"CreateCryptoKeyRequest",
131133
"CreateCryptoKeyVersionRequest",
132134
"CreateEkmConnectionRequest",

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/async_client.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1898,7 +1898,7 @@ async def sample_import_crypto_key_version():
18981898
request = kms_v1.ImportCryptoKeyVersionRequest(
18991899
rsa_aes_wrapped_key=b'rsa_aes_wrapped_key_blob',
19001900
parent="parent_value",
1901-
algorithm="EXTERNAL_SYMMETRIC_ENCRYPTION",
1901+
algorithm="PQ_SIGN_SLH_DSA_SHA2_128S",
19021902
import_job="import_job_value",
19031903
)
19041904

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/client.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2370,7 +2370,7 @@ def sample_import_crypto_key_version():
23702370
request = kms_v1.ImportCryptoKeyVersionRequest(
23712371
rsa_aes_wrapped_key=b'rsa_aes_wrapped_key_blob',
23722372
parent="parent_value",
2373-
algorithm="EXTERNAL_SYMMETRIC_ENCRYPTION",
2373+
algorithm="PQ_SIGN_SLH_DSA_SHA2_128S",
23742374
import_job="import_job_value",
23752375
)
23762376

‎packages/google-cloud-kms/google/cloud/kms_v1/types/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
)
4545
from .resources import (
4646
AccessReason,
47+
ChecksummedData,
4748
CryptoKey,
4849
CryptoKeyVersion,
4950
CryptoKeyVersionTemplate,
@@ -125,6 +126,7 @@
125126
"UpdateEkmConnectionRequest",
126127
"VerifyConnectivityRequest",
127128
"VerifyConnectivityResponse",
129+
"ChecksummedData",
128130
"CryptoKey",
129131
"CryptoKeyVersion",
130132
"CryptoKeyVersionTemplate",

‎packages/google-cloud-kms/google/cloud/kms_v1/types/resources.py‎

Lines changed: 104 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"CryptoKeyVersionTemplate",
3333
"KeyOperationAttestation",
3434
"CryptoKeyVersion",
35+
"ChecksummedData",
3536
"PublicKey",
3637
"ImportJob",
3738
"ExternalProtectionLevelOptions",
@@ -785,6 +786,14 @@ class CryptoKeyVersionAlgorithm(proto.Enum):
785786
EXTERNAL_SYMMETRIC_ENCRYPTION (18):
786787
Algorithm representing symmetric encryption
787788
by an external key manager.
789+
PQ_SIGN_ML_DSA_65 (56):
790+
The post-quantum Module-Lattice-Based Digital
791+
Signature Algorithm, at security level 3.
792+
Randomized version.
793+
PQ_SIGN_SLH_DSA_SHA2_128S (57):
794+
The post-quantum stateless hash-based digital
795+
signature algorithm, at security level 1.
796+
Randomized version.
788797
"""
789798
CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0
790799
GOOGLE_SYMMETRIC_ENCRYPTION = 1
@@ -822,6 +831,8 @@ class CryptoKeyVersionAlgorithm(proto.Enum):
822831
HMAC_SHA512 = 35
823832
HMAC_SHA224 = 36
824833
EXTERNAL_SYMMETRIC_ENCRYPTION = 18
834+
PQ_SIGN_ML_DSA_65 = 56
835+
PQ_SIGN_SLH_DSA_SHA2_128S = 57
825836

826837
class CryptoKeyVersionState(proto.Enum):
827838
r"""The state of a
@@ -1002,6 +1013,42 @@ class CryptoKeyVersionView(proto.Enum):
10021013
)
10031014

10041015

1016+
class ChecksummedData(proto.Message):
1017+
r"""Data with integrity verification field.
1018+
1019+
Attributes:
1020+
data (bytes):
1021+
Raw Data.
1022+
crc32c_checksum (google.protobuf.wrappers_pb2.Int64Value):
1023+
Integrity verification field. A CRC32C checksum of the
1024+
returned
1025+
[ChecksummedData.data][google.cloud.kms.v1.ChecksummedData.data].
1026+
An integrity check of
1027+
[ChecksummedData.data][google.cloud.kms.v1.ChecksummedData.data]
1028+
can be performed by computing the CRC32C checksum of
1029+
[ChecksummedData.data][google.cloud.kms.v1.ChecksummedData.data]
1030+
and comparing your results to this field. Discard the
1031+
response in case of non-matching checksum values, and
1032+
perform a limited number of retries. A persistent mismatch
1033+
may indicate an issue in your computation of the CRC32C
1034+
checksum. Note: This field is defined as int64 for reasons
1035+
of compatibility across different languages. However, it is
1036+
a non-negative integer, which will never exceed ``2^32-1``,
1037+
and can be safely downconverted to uint32 in languages that
1038+
support this type.
1039+
"""
1040+
1041+
data: bytes = proto.Field(
1042+
proto.BYTES,
1043+
number=3,
1044+
)
1045+
crc32c_checksum: wrappers_pb2.Int64Value = proto.Field(
1046+
proto.MESSAGE,
1047+
number=2,
1048+
message=wrappers_pb2.Int64Value,
1049+
)
1050+
1051+
10051052
class PublicKey(proto.Message):
10061053
r"""The public keys for a given
10071054
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained
@@ -1033,8 +1080,8 @@ class PublicKey(proto.Message):
10331080
indicate an issue in your computation of the CRC32C
10341081
checksum. Note: This field is defined as int64 for reasons
10351082
of compatibility across different languages. However, it is
1036-
a non-negative integer, which will never exceed 2^32-1, and
1037-
can be safely downconverted to uint32 in languages that
1083+
a non-negative integer, which will never exceed ``2^32-1``,
1084+
and can be safely downconverted to uint32 in languages that
10381085
support this type.
10391086
10401087
NOTE: This field is in Beta.
@@ -1049,8 +1096,53 @@ class PublicKey(proto.Message):
10491096
of the
10501097
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
10511098
public key.
1099+
public_key_format (google.cloud.kms_v1.types.PublicKey.PublicKeyFormat):
1100+
The [PublicKey][google.cloud.kms.v1.PublicKey] format
1101+
specified by the customer through the
1102+
[public_key_format][google.cloud.kms.v1.GetPublicKeyRequest.public_key_format]
1103+
field.
1104+
public_key (google.cloud.kms_v1.types.ChecksummedData):
1105+
This field contains the public key (with integrity
1106+
verification), formatted according to the
1107+
[public_key_format][google.cloud.kms.v1.PublicKey.public_key_format]
1108+
field.
10521109
"""
10531110

1111+
class PublicKeyFormat(proto.Enum):
1112+
r"""The supported [PublicKey][google.cloud.kms.v1.PublicKey] formats.
1113+
1114+
Values:
1115+
PUBLIC_KEY_FORMAT_UNSPECIFIED (0):
1116+
If the
1117+
[public_key_format][google.cloud.kms.v1.GetPublicKeyRequest.public_key_format]
1118+
field is not specified:
1119+
1120+
- For PQC algorithms, an error will be returned.
1121+
- For non-PQC algorithms, the default format is PEM, and
1122+
the field [pem][google.cloud.kms.v1.PublicKey.pem] will
1123+
be populated.
1124+
1125+
Otherwise, the public key will be exported through the
1126+
[public_key][google.cloud.kms.v1.PublicKey.public_key] field
1127+
in the requested format.
1128+
PEM (1):
1129+
The returned public key will be encoded in PEM format. See
1130+
the `RFC7468 <https://tools.ietf.org/html/rfc7468>`__
1131+
sections for `General
1132+
Considerations <https://tools.ietf.org/html/rfc7468#section-2>`__
1133+
and [Textual Encoding of Subject Public Key Info]
1134+
(https://tools.ietf.org/html/rfc7468#section-13) for more
1135+
information.
1136+
NIST_PQC (3):
1137+
This is supported only for PQC algorithms.
1138+
The key material is returned in the format
1139+
defined by NIST PQC standards (FIPS 203, FIPS
1140+
204, and FIPS 205).
1141+
"""
1142+
PUBLIC_KEY_FORMAT_UNSPECIFIED = 0
1143+
PEM = 1
1144+
NIST_PQC = 3
1145+
10541146
pem: str = proto.Field(
10551147
proto.STRING,
10561148
number=1,
@@ -1074,6 +1166,16 @@ class PublicKey(proto.Message):
10741166
number=5,
10751167
enum="ProtectionLevel",
10761168
)
1169+
public_key_format: PublicKeyFormat = proto.Field(
1170+
proto.ENUM,
1171+
number=7,
1172+
enum=PublicKeyFormat,
1173+
)
1174+
public_key: "ChecksummedData" = proto.Field(
1175+
proto.MESSAGE,
1176+
number=8,
1177+
message="ChecksummedData",
1178+
)
10771179

10781180

10791181
class ImportJob(proto.Message):

‎packages/google-cloud-kms/google/cloud/kms_v1/types/service.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -513,12 +513,27 @@ class GetPublicKeyRequest(proto.Message):
513513
[name][google.cloud.kms.v1.CryptoKeyVersion.name] of the
514514
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
515515
public key to get.
516+
public_key_format (google.cloud.kms_v1.types.PublicKey.PublicKeyFormat):
517+
Optional. The [PublicKey][google.cloud.kms.v1.PublicKey]
518+
format specified by the user. This field is required for PQC
519+
algorithms. If specified, the public key will be exported
520+
through the
521+
[public_key][google.cloud.kms.v1.PublicKey.public_key] field
522+
in the requested format. Otherwise, the
523+
[pem][google.cloud.kms.v1.PublicKey.pem] field will be
524+
populated for non-PQC algorithms, and an error will be
525+
returned for PQC algorithms.
516526
"""
517527

518528
name: str = proto.Field(
519529
proto.STRING,
520530
number=1,
521531
)
532+
public_key_format: resources.PublicKey.PublicKeyFormat = proto.Field(
533+
proto.ENUM,
534+
number=2,
535+
enum=resources.PublicKey.PublicKeyFormat,
536+
)
522537

523538

524539
class GetImportJobRequest(proto.Message):

‎packages/google-cloud-kms/samples/generated_samples/cloudkms_v1_generated_key_management_service_import_crypto_key_version_async.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ async def sample_import_crypto_key_version():
4242
request = kms_v1.ImportCryptoKeyVersionRequest(
4343
rsa_aes_wrapped_key=b'rsa_aes_wrapped_key_blob',
4444
parent="parent_value",
45-
algorithm="EXTERNAL_SYMMETRIC_ENCRYPTION",
45+
algorithm="PQ_SIGN_SLH_DSA_SHA2_128S",
4646
import_job="import_job_value",
4747
)
4848

‎packages/google-cloud-kms/samples/generated_samples/cloudkms_v1_generated_key_management_service_import_crypto_key_version_sync.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ def sample_import_crypto_key_version():
4242
request = kms_v1.ImportCryptoKeyVersionRequest(
4343
rsa_aes_wrapped_key=b'rsa_aes_wrapped_key_blob',
4444
parent="parent_value",
45-
algorithm="EXTERNAL_SYMMETRIC_ENCRYPTION",
45+
algorithm="PQ_SIGN_SLH_DSA_SHA2_128S",
4646
import_job="import_job_value",
4747
)
4848

‎packages/google-cloud-kms/scripts/fixup_kms_v1_keywords.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ class kmsCallTransformer(cst.CSTTransformer):
5959
'get_import_job': ('name', ),
6060
'get_key_handle': ('name', ),
6161
'get_key_ring': ('name', ),
62-
'get_public_key': ('name', ),
62+
'get_public_key': ('name', 'public_key_format', ),
6363
'import_crypto_key_version': ('parent', 'algorithm', 'import_job', 'crypto_key_version', 'wrapped_key', 'rsa_aes_wrapped_key', ),
6464
'list_crypto_keys': ('parent', 'page_size', 'page_token', 'version_view', 'filter', 'order_by', ),
6565
'list_crypto_key_versions': ('parent', 'page_size', 'page_token', 'view', 'filter', 'order_by', ),

0 commit comments

Comments
 (0)