Concepts

Concepts related to keys, key rings, and other Cloud KMS objects

• Object hierarchy

  Learn about different resource types in Cloud Key Management Service, including key rings, keys, and key versions.

• Differences between managing keys and secrets

  Learn the differences between Cloud KMS and Secret Manager, how they work together, and the best use cases for each.

• Key purposes and algorithms

  Learn about the purposes and supported algorithms for keys in Cloud KMS.

• Key states

  Learn about the different states that can apply to keys stored in Cloud KMS.

• Separation of duties

  Learn how to implement best-practice separation of duties for Cloud KMS.

• Additional authenticated data

  Learn about additional authenticated data (AAD) and how to use it when encrypting/decrypting.

• Resource consistency

  Learn about the impact of consistency when creating or modifying Cloud KMS resources.

• Locations

  Learn about the locations available for storing your Cloud KMS resources.

Concepts related to managing and using keys

• Envelope encryption

  Learn about multi-level encryption using Cloud KMS.

• Asymmetric encryption

  Learn about asymmetric encryption using Cloud KMS.

• Digital signatures

  Learn about digital signatures using Cloud KMS.

• Symmetric key rotation

  Learn how symmetric key rotation works in Cloud KMS.

• Asymmetric key rotation

  Learn how asymmetric key rotation works in Cloud KMS.

• Cloud EKM

  Learn about protecting data in Google Cloud with externally-managed keys.

Concepts related to importing keys

• Key import

  Learn how importing keys works in Cloud KMS.

• Key wrapping

  Learn about wrapping keys before importing them into Cloud KMS.