REST Resource: projects.locations.keyRings.cryptoKeys.cryptoKeyVersions

Resource: CryptoKeyVersion

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

JSON representation
{
  "name": string,
  "state": enum (CryptoKeyVersionState),
  "protectionLevel": enum (ProtectionLevel),
  "algorithm": enum (CryptoKeyVersionAlgorithm),
  "attestation": {
    object (KeyOperationAttestation)
  },
  "createTime": string,
  "generateTime": string,
  "destroyTime": string,
  "destroyEventTime": string
}
Fields
name

string

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

state

enum (CryptoKeyVersionState)

The current state of the CryptoKeyVersion.

protectionLevel

enum (ProtectionLevel)

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

algorithm

enum (CryptoKeyVersionAlgorithm)

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

attestation

object (KeyOperationAttestation)

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protectionLevel HSM.

createTime

string (Timestamp format)

Output only. The time at which this CryptoKeyVersion was created.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

generateTime

string (Timestamp format)

Output only. The time this CryptoKeyVersion's key material was generated.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

destroyTime

string (Timestamp format)

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

destroyEventTime

string (Timestamp format)

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

CryptoKeyVersionState

The state of a CryptoKeyVersion, indicating if it can be used.

Enums
CRYPTO_KEY_VERSION_STATE_UNSPECIFIED Not specified.
PENDING_GENERATION This version is still being generated. It may not be used, enabled, disabled, or destroyed yet. Cloud KMS will automatically mark this version ENABLED as soon as the version is ready.
ENABLED This version may be used for cryptographic operations.
DISABLED This version may not be used, but the key material is still available, and the version can be placed back into the ENABLED state.
DESTROYED This version is destroyed, and the key material is no longer stored. A version may not leave this state once entered.
DESTROY_SCHEDULED This version is scheduled for destruction, and will be destroyed soon. Call cryptoKeyVersions.restore to put it back into the DISABLED state.

KeyOperationAttestation

Contains an HSM-generated attestation about a key operation. For more information, see Verifying attestations.

JSON representation
{
  "format": enum (AttestationFormat),
  "content": string
}
Fields
format

enum (AttestationFormat)

Output only. The format of the attestation data.

content

string (bytes format)

Output only. The attestation data provided by the HSM when the key operation was performed.

A base64-encoded string.

AttestationFormat

Attestation formats provided by the HSM.

Enums
ATTESTATION_FORMAT_UNSPECIFIED Not specified.
CAVIUM_V1_COMPRESSED Cavium HSM attestation compressed with gzip. Note that this format is defined by Cavium and subject to change at any time.
CAVIUM_V2_COMPRESSED Cavium HSM attestation V2 compressed with gzip. This is a new format introduced in Cavium's version 3.2-08.

Methods

asymmetricDecrypt

Decrypts data that was encrypted with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.

asymmetricSign

Signs data using a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_SIGN, producing a signature that can be verified with the public key retrieved from GetPublicKey.

create

Create a new CryptoKeyVersion in a CryptoKey.

destroy

Schedule a CryptoKeyVersion for destruction.

get

Returns metadata for a given CryptoKeyVersion.

getPublicKey

Returns the public key for the given CryptoKeyVersion.

list

Lists CryptoKeyVersions.

patch

Update a CryptoKeyVersion's metadata.

restore

Restore a CryptoKeyVersion in the DESTROY_SCHEDULED state.
¿Te ha resultado útil esta página? Enviar comentarios:

Enviar comentarios sobre...