Verwenden Sie den öffentlichen Schlüsselabschnitt eines asymmetrischen Schlüssels, um den Klartext zu verschlüsseln.
Dokumentationsseiten mit diesem Codebeispiel
Die folgenden Dokumente enthalten das Codebeispiel im Kontext:
Codebeispiel
C#
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
using Google.Cloud.Kms.V1;
using System;
using System.Security.Cryptography;
using System.Text;
public class EncryptAsymmetricSample
{
public byte[] EncryptAsymmetric(
string projectId = "my-project", string locationId = "us-east1", string keyRingId = "my-key-ring", string keyId = "my-key", string keyVersionId = "123",
string message = "Sample message")
{
// Create the client.
KeyManagementServiceClient client = KeyManagementServiceClient.Create();
// Build the key version name.
CryptoKeyVersionName keyVersionName = new CryptoKeyVersionName(projectId, locationId, keyRingId, keyId, keyVersionId);
// Get the public key.
PublicKey publicKey = client.GetPublicKey(keyVersionName);
// Split the key into blocks and base64-decode the PEM parts.
string[] blocks = publicKey.Pem.Split("-", StringSplitOptions.RemoveEmptyEntries);
byte[] pem = Convert.FromBase64String(blocks[1]);
// Create a new RSA key.
RSA rsa = RSA.Create();
rsa.ImportSubjectPublicKeyInfo(pem, out _);
// Convert the message into bytes. Cryptographic plaintexts and
// ciphertexts are always byte arrays.
byte[] plaintext = Encoding.UTF8.GetBytes(message);
// Encrypt the data.
byte[] ciphertext = rsa.Encrypt(plaintext, RSAEncryptionPadding.OaepSHA256);
return ciphertext;
}
}Go
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
import (
"context"
"crypto/rand"
"crypto/rsa"
"crypto/sha256"
"crypto/x509"
"encoding/pem"
"fmt"
"io"
kms "cloud.google.com/go/kms/apiv1"
kmspb "google.golang.org/genproto/googleapis/cloud/kms/v1"
)
// encryptAsymmetric encrypts data on your local machine using an
// 'RSA_DECRYPT_OAEP_2048_SHA256' public key retrieved from Cloud KMS.
func encryptAsymmetric(w io.Writer, name string, message string) error {
// name := "projects/my-project/locations/us-east1/keyRings/my-key-ring/cryptoKeys/my-key/cryptoKeyVersions/123"
// message := "Sample message"
// Create the client.
ctx := context.Background()
client, err := kms.NewKeyManagementClient(ctx)
if err != nil {
return fmt.Errorf("failed to create kms client: %v", err)
}
// Retrieve the public key from Cloud KMS. This is the only operation that
// involves Cloud KMS. The remaining operations take place on your local
// machine.
response, err := client.GetPublicKey(ctx, &kmspb.GetPublicKeyRequest{
Name: name,
})
if err != nil {
return fmt.Errorf("failed to get public key: %v", err)
}
// Parse the public key. Note, this example assumes the public key is in the
// RSA format.
block, _ := pem.Decode([]byte(response.Pem))
publicKey, err := x509.ParsePKIXPublicKey(block.Bytes)
if err != nil {
return fmt.Errorf("failed to parse public key: %v", err)
}
rsaKey, ok := publicKey.(*rsa.PublicKey)
if !ok {
return fmt.Errorf("public key is not rsa")
}
// Convert the message into bytes. Cryptographic plaintexts and
// ciphertexts are always byte arrays.
plaintext := []byte(message)
// Encrypt data using the RSA public key.
ciphertext, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, rsaKey, plaintext, nil)
if err != nil {
return fmt.Errorf("rsa.EncryptOAEP: %v", err)
}
fmt.Fprintf(w, "Encrypted ciphertext: %s", ciphertext)
return nil
}
Java
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
import com.google.cloud.kms.v1.CryptoKeyVersionName;
import com.google.cloud.kms.v1.KeyManagementServiceClient;
import com.google.cloud.kms.v1.PublicKey;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.StringReader;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.KeyFactory;
import java.security.spec.MGF1ParameterSpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
import java.util.stream.Collectors;
import javax.crypto.Cipher;
import javax.crypto.spec.OAEPParameterSpec;
import javax.crypto.spec.PSource;
public class EncryptAsymmetric {
public void encryptAsymmetric() throws IOException, GeneralSecurityException {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String locationId = "us-east1";
String keyRingId = "my-key-ring";
String keyId = "my-key";
String keyVersionId = "123";
String plaintext = "Plaintext to encrypt";
encryptAsymmetric(projectId, locationId, keyRingId, keyId, keyVersionId, plaintext);
}
// Encrypt data that was encrypted using the public key component of the given
// key version.
public void encryptAsymmetric(
String projectId,
String locationId,
String keyRingId,
String keyId,
String keyVersionId,
String plaintext)
throws IOException, GeneralSecurityException {
// Initialize client that will be used to send requests. This client only
// needs to be created once, and can be reused for multiple requests. After
// completing all of your requests, call the "close" method on the client to
// safely clean up any remaining background resources.
try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
// Build the key version name from the project, location, key ring, key,
// and key version.
CryptoKeyVersionName keyVersionName =
CryptoKeyVersionName.of(projectId, locationId, keyRingId, keyId, keyVersionId);
// Get the public key.
PublicKey publicKey = client.getPublicKey(keyVersionName);
// Convert the public PEM key to a DER key (see helper below).
byte[] derKey = convertPemToDer(publicKey.getPem());
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(derKey);
java.security.PublicKey rsaKey = KeyFactory.getInstance("RSA").generatePublic(keySpec);
// Encrypt plaintext for the 'RSA_DECRYPT_OAEP_2048_SHA256' key.
// For other key algorithms:
// https://docs.oracle.com/javase/7/docs/api/javax/crypto/Cipher.html
Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
OAEPParameterSpec oaepParams =
new OAEPParameterSpec(
"SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT);
cipher.init(Cipher.ENCRYPT_MODE, rsaKey, oaepParams);
byte[] ciphertext = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));
System.out.printf("Ciphertext: %s%n", ciphertext);
}
}
// Converts a base64-encoded PEM certificate like the one returned from Cloud
// KMS into a DER formatted certificate for use with the Java APIs.
private byte[] convertPemToDer(String pem) {
BufferedReader bufferedReader = new BufferedReader(new StringReader(pem));
String encoded =
bufferedReader
.lines()
.filter(line -> !line.startsWith("-----BEGIN") && !line.startsWith("-----END"))
.collect(Collectors.joining());
return Base64.getDecoder().decode(encoded);
}
}Node.js
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
//
// TODO(developer): Uncomment these variables before running the sample.
//
// const projectId = 'my-project';
// const locationId = 'us-east1';
// const keyRingId = 'my-key-ring';
// const keyId = 'my-key';
// const versionId = '123';
// const plaintextBuffer = Buffer.from('...');
// Imports the Cloud KMS library
const {KeyManagementServiceClient} = require('@google-cloud/kms');
// Instantiates a client
const client = new KeyManagementServiceClient();
// Build the key version name
const versionName = client.cryptoKeyVersionPath(
projectId,
locationId,
keyRingId,
keyId,
versionId
);
async function encryptAsymmetric() {
// Get public key from Cloud KMS
const [publicKey] = await client.getPublicKey({
name: versionName,
});
// Optional, but recommended: perform integrity verification on publicKey.
// For more details on ensuring E2E in-transit integrity to and from Cloud KMS visit:
// https://cloud.google.com/kms/docs/data-integrity-guidelines
const crc32c = require('fast-crc32c');
if (publicKey.name !== versionName) {
throw new Error('GetPublicKey: request corrupted in-transit');
}
if (crc32c.calculate(publicKey.pem) !== Number(publicKey.pemCrc32c.value)) {
throw new Error('GetPublicKey: response corrupted in-transit');
}
// Import and setup crypto
const crypto = require('crypto');
// Encrypt plaintext locally using the public key. This example uses a key
// that was configured with sha256 hash with OAEP padding. Update these
// values to match the Cloud KMS key.
//
// NOTE: In Node < 12, this function does not properly consume the OAEP
// padding and thus produces invalid ciphertext. If you are using Node to do
// public key encryption, please use version 12+.
const ciphertextBuffer = crypto.publicEncrypt(
{
key: publicKey.pem,
oaepHash: 'sha256',
padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
},
plaintextBuffer
);
console.log(`Ciphertext: ${ciphertextBuffer.toString('base64')}`);
return ciphertextBuffer;
}
return encryptAsymmetric();PHP
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
function encrypt_asymmetric_sample(
string $projectId = 'my-project',
string $locationId = 'us-east1',
string $keyRingId = 'my-key-ring',
string $keyId = 'my-key',
string $versionId = '123',
string $plaintext = '...'
) {
// PHP has limited support for asymmetric encryption operations.
// Specifically, openssl_public_encrypt() does not allow customizing
// algorithms or padding. Thus, it is not currently possible to use PHP
// core for asymmetric operations on RSA keys.
//
// Third party libraries like phpseclib may provide the required
// functionality. Google does not endorse this external library.
}Python
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
def encrypt_asymmetric(project_id, location_id, key_ring_id, key_id, version_id, plaintext):
"""
Encrypt plaintext using the public key portion of an asymmetric key.
Args:
project_id (string): Google Cloud project ID (e.g. 'my-project').
location_id (string): Cloud KMS location (e.g. 'us-east1').
key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').
key_id (string): ID of the key to use (e.g. 'my-key').
version_id (string): ID of the key version to use (e.g. '1').
plaintext (string): message to encrypt
Returns:
bytes: Encrypted ciphertext.
"""
# Import the client library.
from google.cloud import kms
# Import base64 for printing the ciphertext.
import base64
# Import cryptographic helpers from the cryptography package.
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
# Convert the plaintext to bytes.
plaintext_bytes = plaintext.encode('utf-8')
# Create the client.
client = kms.KeyManagementServiceClient()
# Build the key version name.
key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, version_id)
# Get the public key.
public_key = client.get_public_key(request={'name': key_version_name})
# Extract and parse the public key as a PEM-encoded RSA key.
pem = public_key.pem.encode('utf-8')
rsa_key = serialization.load_pem_public_key(pem, default_backend())
# Construct the padding. Note that the padding differs based on key choice.
sha256 = hashes.SHA256()
mgf = padding.MGF1(algorithm=sha256)
pad = padding.OAEP(mgf=mgf, algorithm=sha256, label=None)
# Encrypt the data using the public key.
ciphertext = rsa_key.encrypt(plaintext_bytes, pad)
print('Ciphertext: {}'.format(base64.b64encode(ciphertext)))
return ciphertextRuby
Informationen zum Installieren und Verwenden der Clientbibliothek für Cloud KMS finden Sie in den Cloud KMS-Clientbibliotheken.
# Ruby has limited support for asymmetric encryption operations. Specifically,
# public_encrypt() does not allow customizing the MGF hash algorithm. Thus, it
# is not currently possible to use Ruby core for asymmetric encryption
# operations on RSA keys from Cloud KMS.
#
# Third party libraries may provide the required functionality. Google does
# not endorse these external libraries.Nächste Schritte
Codebeispiele für andere Google Cloud-Produkte finden Sie im Google Cloud-Beispielbrowser.