Google Cloud Key Management

Google Cloud Key Management | CodeSignal Learn

Understanding Google Cloud Key Management Service (KMS)

The Google Cloud Key Management Service (KMS) is a managed service that allows you to create, manage, and use cryptographic keys to protect sensitive data. Google Cloud KMS supports both symmetric and asymmetric keys, enabling a wide range of cryptographic operations such as encryption, decryption, signing, and verification. Key concepts in Google Cloud KMS include: Key Rings: Logical groupings of keys used to organize and manage access to related keys. CryptoKeys: The actual cryptographic keys stored within a key ring. Each CryptoKey can have multiple versions, allowing for key rotation and lifecycle management. CryptoKey Versions: Each version represents specific cryptographic key material. Only one version is typically enabled for use at a time. Symmetric Keys: Used for encrypting and decrypting data with the same key. Asymmetric Keys: Used for operations where different keys are used for encryption and decryption, or for signing and verifying data. Google Cloud KMS is designed to help you meet security and compliance requirements by providing centralized key management, audit logging, and integration with other Google Cloud services.

Google Cloud KMS Keys and Data Encryption: A Secure File Storage Example

To understand how Google Cloud KMS can be used in practice, consider a secure file storage application. This application allows users to upload and retrieve confidential files, ensuring that all data is encrypted both at rest and in transit. Use of KMS Keys: Centralized Key Management: KMS keys are used to centrally manage encryption keys, define access policies, and control which users or services can perform cryptographic operations. Audit and Compliance: All key usage is logged, providing a detailed audit trail for compliance and security monitoring. Data Encryption Process: Envelope Encryption: When a user uploads a file, the application generates a unique data encryption key (DEK) for that file. The file is encrypted locally using the DEK . Key Wrapping: The DEK itself is then encrypted (wrapped) using a KMS key. The encrypted DEK is stored alongside the encrypted file. Secure Access: When the file needs to be accessed, the encrypted DEK is sent to KMS to be decrypted (unwrapped). The plaintext DEK is then used to decrypt the file. This approach ensures that each file is encrypted with a unique key, and the master keys used to protect these data keys are securely managed and audited by Google Cloud KMS.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Creating a Key in Google Cloud KMS

To create a cryptographic key in Google Cloud KMS, you first create a key ring, then create a CryptoKey within that key ring. You can specify the purpose of the key (such as encryption/decryption or signing/verification) and the type of key material (symmetric or asymmetric). Below is an example of how to create a key ring and a symmetric encryption key: Pythonfrom google.cloud import kms # Initialize the KMS client client = kms.KeyManagementServiceClient() # Define project, location, and key ring details project_id = "your-project-id" location_id = "global" key_ring_id = "sample-key-ring" crypto_key_id = "sample-crypto-key" # Build the parent path for the key ring parent = f"projects/{project_id}/locations/{location_id}" # Create the key ring key_ring = client.create_key_ring( request={ "parent": parent, "key_ring_id": key_ring_id, "key_ring": {}, } ) # Create a symmetric encryption key within the key ring crypto_key = client.create_crypto_key( request={ "parent": key_ring.name, "crypto_key_id": crypto_key_id, "crypto_key": { "purpose": kms.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT, }, } )from google.cloud import kms # Initialize the KMS client client = kms.KeyManagementServiceClient() # Define project, location, and key ring details project_id = "your-project-id" location_id = "global" key_ring_id = "sample-key-ring" crypto_key_id = "sample-crypto-key" # Build the parent path for the key ring parent = f"projects/{project_id}/locations/{location_id}" # Create the key ring key_ring = client.create_key_ring( request={ "parent": parent, "key_ring_id": key_ring_id, "key_ring": {}, } ) # Create a symmetric encryption key within the key ring crypto_key = client.create_crypto_key( request={ "parent": key_ring.name, "crypto_key_id": crypto_key_id, "crypto_key": { "purpose": kms.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT, }, } ) Key Ring: Organizes related keys and controls access at a group level. CryptoKey: The cryptographic key used for encryption and decryption. Purpose: Specifies the intended use of the key, such as ENCRYPT_DECRYPT for symmetric encryption.

Retrieving Key Metadata in Google Cloud KMS

To view details about a specific key, you can retrieve its metadata. This includes information such as the key's purpose, creation time, primary version, and current state. Here is how you can retrieve and display metadata for a CryptoKey: Python# Build the resource name for the CryptoKey crypto_key_name = f"projects/{project_id}/locations/{location_id}/keyRings/{key_ring_id}/cryptoKeys/{crypto_key_id}" # Get the CryptoKey metadata crypto_key = client.get_crypto_key(request={"name": crypto_key_name}) print("Key Name:", crypto_key.name) print("Purpose:", crypto_key.purpose) print("Primary Version:", crypto_key.primary.name) print("Creation Time:", crypto_key.create_time) print("Labels:", crypto_key.labels) print("Rotation Period:", crypto_key.rotation_period)# Build the resource name for the CryptoKey crypto_key_name = f"projects/{project_id}/locations/{location_id}/keyRings/{key_ring_id}/cryptoKeys/{crypto_key_id}" # Get the CryptoKey metadata crypto_key = client.get_crypto_key(request={"name": crypto_key_name}) print("Key Name:", crypto_key.name) print("Purpose:", crypto_key.purpose) print("Primary Version:", crypto_key.primary.name) print("Creation Time:", crypto_key.create_time) print("Labels:", crypto_key.labels) print("Rotation Period:", crypto_key.rotation_period) Output: textKey Name: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key Purpose: CryptoKeyPurpose.ENCRYPT_DECRYPT Primary Version: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key/cryptoKeyVersions/1 Creation Time: 2024-01-15 10:30:45.123456+00:00 Labels: {} Rotation Period: NoneKey Name: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key Purpose: CryptoKeyPurpose.ENCRYPT_DECRYPT Primary Version: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key/cryptoKeyVersions/1 Creation Time: 2024-01-15 10:30:45.123456+00:00 Labels: {} Rotation Period: None This metadata helps you manage your keys, monitor their usage, and ensure compliance with security policies.

Encrypting and Decrypting Data using Google Cloud KMS

Google Cloud KMS allows you to encrypt and decrypt small amounts of data (up to 64 KiB) directly using a symmetric key. For larger data, envelope encryption is recommended. Here is an example of encrypting and decrypting a plaintext message: Python# The plaintext to encrypt plaintext = b"Hello, Google Cloud!" # Encrypt the plaintext encrypt_response = client.encrypt( request={ "name": crypto_key_name, "plaintext": plaintext, } ) ciphertext = encrypt_response.ciphertext # Decrypt the ciphertext decrypt_response = client.decrypt( request={ "name": crypto_key_name, "ciphertext": ciphertext, } ) decrypted_plaintext = decrypt_response.plaintext.decode("utf-8") print("Decrypted text:", decrypted_plaintext)# The plaintext to encrypt plaintext = b"Hello, Google Cloud!" # Encrypt the plaintext encrypt_response = client.encrypt( request={ "name": crypto_key_name, "plaintext": plaintext, } ) ciphertext = encrypt_response.ciphertext # Decrypt the ciphertext decrypt_response = client.decrypt( request={ "name": crypto_key_name, "ciphertext": ciphertext, } ) decrypted_plaintext = decrypt_response.plaintext.decode("utf-8") print("Decrypted text:", decrypted_plaintext) Output: textDecrypted text: Hello, Google Cloud!Decrypted text: Hello, Google Cloud! Encrypt: Protects the plaintext using the specified CryptoKey. Decrypt: Recovers the original plaintext from the ciphertext.

Working with Data Keys and Envelope Encryption

For encrypting large files or data, envelope encryption is used. In this approach, you generate a data encryption key (DEK), use it to encrypt your data, and then use KMS to encrypt (wrap) the DEK. Here is how you can generate a random data encryption key and wrap it using KMS: Pythonimport os # Generate a random 256-bit (32-byte) data encryption key dek = os.urandom(32) # Encrypt (wrap) the DEK using KMS wrap_response = client.encrypt( request={ "name": crypto_key_name, "plaintext": dek, } ) encrypted_dek = wrap_response.ciphertext # To unwrap (decrypt) the DEK when needed unwrap_response = client.decrypt( request={ "name": crypto_key_name, "ciphertext": encrypted_dek, } ) unwrapped_dek = unwrap_response.plaintextimport os # Generate a random 256-bit (32-byte) data encryption key dek = os.urandom(32) # Encrypt (wrap) the DEK using KMS wrap_response = client.encrypt( request={ "name": crypto_key_name, "plaintext": dek, } ) encrypted_dek = wrap_response.ciphertext # To unwrap (decrypt) the DEK when needed unwrap_response = client.decrypt( request={ "name": crypto_key_name, "ciphertext": encrypted_dek, } ) unwrapped_dek = unwrap_response.plaintext Generate DEK: Create a random key for encrypting your data. Wrap DEK: Encrypt the DEK using KMS for secure storage. Unwrap DEK: Decrypt the DEK when you need to access the encrypted data. This method allows you to efficiently encrypt large data while keeping the master keys secure and centrally managed.

Key Rotation in Google Cloud KMS

Key rotation is an important security practice that helps limit the amount of data encrypted with a single key version. In Google Cloud KMS, you can configure automatic rotation for symmetric keys by specifying a rotation period. When a key is rotated, a new key version is created and set as the primary version for encryption. To set up automatic key rotation: Pythonimport time from google.protobuf import duration_pb2 # Set the rotation period (e.g., 30 days) rotation_period = duration_pb2.Duration() rotation_period.seconds = 60 * 60 * 24 * 30 # 30 days # Update the CryptoKey to enable automatic rotation updated_crypto_key = client.update_crypto_key( request={ "crypto_key": { "name": crypto_key_name, "rotation_period": rotation_period, "next_rotation_time": {"seconds": int(time.time() + rotation_period.seconds)}, }, "update_mask": {"paths": ["rotation_period", "next_rotation_time"]}, } )import time from google.protobuf import duration_pb2 # Set the rotation period (e.g., 30 days) rotation_period = duration_pb2.Duration() rotation_period.seconds = 60 * 60 * 24 * 30 # 30 days # Update the CryptoKey to enable automatic rotation updated_crypto_key = client.update_crypto_key( request={ "crypto_key": { "name": crypto_key_name, "rotation_period": rotation_period, "next_rotation_time": {"seconds": int(time.time() + rotation_period.seconds)}, }, "update_mask": {"paths": ["rotation_period", "next_rotation_time"]}, } ) Rotation Period: Defines how often a new key version is created. Next Rotation Time: Specifies when the next rotation should occur. Important Note: Automatic rotation only creates new key versions for future encryption operations. It does not re-encrypt existing ciphertexts, which remain encrypted with their original key versions. All previous key versions remain available for decrypting existing data, ensuring that your encrypted data remains accessible even after rotation. Automatic rotation helps maintain strong security by regularly updating key material without manual intervention.

Scheduling Key Destruction in Google Cloud KMS

If you no longer need a key, you can schedule its destruction. In Google Cloud KMS, you destroy a specific key version rather than the entire CryptoKey. Destroying a key version is a permanent operation and cannot be undone. Here is how to schedule the destruction of a key version: Python# Get the name of the key version to destroy key_version_name = crypto_key.primary.name # Destroy the key version destroy_response = client.destroy_crypto_key_version( request={"name": key_version_name} ) print(f"Key version {key_version_name} scheduled for destruction.")# Get the name of the key version to destroy key_version_name = crypto_key.primary.name # Destroy the key version destroy_response = client.destroy_crypto_key_version( request={"name": key_version_name} ) print(f"Key version {key_version_name} scheduled for destruction.") Output: textKey version projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key/cryptoKeyVersions/1 scheduled for destruction.Key version projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key/cryptoKeyVersions/1 scheduled for destruction. Destroy Key Version: Marks the key version for destruction. After a short period, the key material is permanently deleted and cannot be recovered. This process helps you manage the lifecycle of your cryptographic keys and reduce the risk of unauthorized access to unused or obsolete keys.

Google Cloud Key Management

Understanding Google Cloud Key Management Service (KMS)

Google Cloud KMS Keys and Data Encryption: A Secure File Storage Example

Join the 1M+ learners on CodeSignal

Creating a Key in Google Cloud KMS

Retrieving Key Metadata in Google Cloud KMS

Encrypting and Decrypting Data using Google Cloud KMS

Working with Data Keys and Envelope Encryption

Key Rotation in Google Cloud KMS

Scheduling Key Destruction in Google Cloud KMS

Summary