Key wrapping

Key wrapping is the process of encrypting one key using another key, in order to securely store it or transmit it over an untrusted channel. Key wrapping may rely on either symmetric or asymmetric cryptography, depending on the context.

In Cloud Key Management Service, key wrapping is used to securely import user-provided cryptographic keys. Importing keys requires an import job, and each import job has an import method that specifies the key wrapping protocol to use.

Cloud KMS expects specific formats for imported key material. Before your key material is wrapped for import, you may need to convert it to the format expected by Cloud KMS. Formatting keys for import contains details of the required formats, and provides instructions on how you can convert your keys to the required format if necessary.

Once your key material is formatted properly, the Google Cloud CLI can automatically wrap your key material before securely transmitting it to Cloud KMS. For details, see Importing a key. Alternatively, you may manually wrap your keys using the appropriate cryptographic protocols. Wrapping a key using OpenSSL on Linux provides one example of how you can do this.

Import methods

Cloud KMS provides the following import methods:

Import method Import job key type Key wrapping algorithm
RSA_OAEP_3072_SHA1_AES_256 3072-bit RSA RSAES-OAEP with SHA-1 + AES-KWP
RSA_OAEP_4096_SHA1_AES_256 4096-bit RSA RSAES-OAEP with SHA-1 + AES-KWP
RSA_OAEP_3072_SHA256_AES_256 (recommended) 3072-bit RSA RSAES-OAEP with SHA-256 + AES-KWP
RSA_OAEP_4096_SHA256_AES_256 4096-bit RSA RSAES-OAEP with SHA-256 + AES-KWP
RSA_OAEP_3072_SHA256 3072-bit RSA RSAES-OAEP with SHA-256
RSA_OAEP_4096_SHA256 4096-bit RSA RSAES-OAEP with SHA-256

Key wrapping algorithms

The import methods provided by Cloud KMS correspond to the following key wrapping algorithms:

RSAES-OAEP with SHA-1/SHA-256 + AES-KWP

This key wrapping algorithm is a hybrid encryption scheme that consists of both an asymmetric key wrapping operation and a symmetric key wrapping operation:

  1. The public key from the import job is used to encrypt a one-time-use AES-256 key. Encryption is performed using RSAES-OAEP and MGF-1, along with the digest algorithm specified by the import method. The one-time-use AES-256 key is generated at the time the wrapping is performed.
  2. The one-time-use AES-256 key from step 1 is used to encrypt the target key material using AES Key Wrap with Padding.

The wrapped key material for import is a single byte array consisting of the results of step 1, followed by the results of step 2. In other words, the results of steps 1 and 2 are concatenated together to form the wrapped key material.

This algorithm is the same as the PKCS #11 key wrapping algorithm CKM_RSA_AES_KEY_WRAP. If you are importing a key from an HSM, and your HSM supports this algorithm, you may use it directly. Alternatively, steps 1 and 2 above can be performed with the PKCS #11 mechanisms CKM_RSA_PKCS_OAEP and CKM_AES_KEY_WRAP_PAD respectively.

If your source HSM (or other key provider if not using HSM) does not support the RSA AES key wrap mechanism, you need to manually wrap your key material using your import job's public key. For one example of how to do this using OpenSSL, see Wrapping a key using OpenSSL on Linux.

RSAES-OAEP with SHA-256

This is an asymmetric key wrapping operation that uses the public key from the import job with RSAES-OAEP, using MGF-1 and the SHA-256 digest algorithm, to directly encrypt the target key material. It is based on the PKCS #11 RSA OAEP mechanism CKM_RSA_PKCS_OAEP. The size limitations associated with this import method make it unsuitable for importing RSA private keys.