KMS: Updated for new client library

kms/api-client/README.rst

@@ -92,18 +92,5 @@ To run this sample:
 
     $ python snippets.py
 
-    usage: snippets.py [-h]
-                       {create_key_ring,create_crypto_key,encrypt,decrypt,disable_crypto_key_version,enable_crypto_key_version,destroy_crypto_key_version,restore_crypto_key_version,add_member_to_crypto_key_policy,get_key_ring_policy}
-                       ...
 
-    positional arguments:
-      {create_key_ring,create_crypto_key,encrypt,decrypt,disable_crypto_key_version,enable_crypto_key_version,destroy_crypto_key_version,restore_crypto_key_version,add_member_to_crypto_key_policy,get_key_ring_policy}
-
-    optional arguments:
-      -h, --help            show this help message and exit
-
-
-
-
-
-.. _Google Cloud SDK: https://cloud.google.com/sdk/
+.. _Google Cloud SDK: https://cloud.google.com/sdk/

kms/api-client/README.rst.in

@@ -18,5 +18,7 @@ samples:
 - name: Snippets
   file: snippets.py
   show_help: True
+- name: Asymmetric
+  file: asymmetric.py
 
-folder: kms/api-client
+folder: kms/api-client

kms/api-client/asymmetric.py

@@ -13,71 +13,103 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.rom googleapiclient import discovery
 
-import base64
 import hashlib
 
 from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import ec, padding, utils
 
+from google.cloud import kms_v1
+from google.cloud.kms_v1 import enums
+
+
+# [START kms_create_asymmetric_key]
+def create_asymmetric_key(project_id, location_id, key_ring_id, crypto_key_id):
+    """Creates an RSA encrypt/decrypt key pair within a specified KeyRing."""
+
+    # Creates an API client for the KMS API.
+    client = kms_v1.KeyManagementServiceClient()
+
+    # The resource name of the KeyRing associated with the CryptoKey.
+    parent = client.key_ring_path(project_id, location_id, key_ring_id)
+
+    # Create the CryptoKey object template
+    purpose = enums.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT
+    algorithm = enums.CryptoKeyVersion.CryptoKeyVersionAlgorithm.\
+        RSA_DECRYPT_OAEP_2048_SHA256
+    crypto_key = {'purpose': purpose,
+                  'version_template': {'algorithm': algorithm}}
+
+    # Create a CryptoKey for the given KeyRing.
+    response = client.create_crypto_key(parent, crypto_key_id, crypto_key)
+
+    print('Created CryptoKey {}.'.format(response.name))
+    return response
+# [END kms_create_asymmetric_key]
+
 
 # [START kms_get_asymmetric_public]
-def getAsymmetricPublicKey(client, key_path):
+def get_asymmetric_public_key(key_name):
     """
     Retrieves the public key from a saved asymmetric key pair on Cloud KMS
 
+    Example key_name:
+      "projects/PROJECT_ID/locations/global/keyRings/RING_ID/cryptoKeys\
+              /KEY_ID/cryptoKeyVersions/1"
+
     Requires:
       cryptography.hazmat.backends.default_backend
       cryptography.hazmat.primitives.serialization
     """
-    request = client.projects() \
-                    .locations() \
-                    .keyRings() \
-                    .cryptoKeys() \
-                    .cryptoKeyVersions() \
-                    .getPublicKey(name=key_path)
-    response = request.execute()
-    key_txt = response['pem'].encode('ascii')
+
+    client = kms_v1.KeyManagementServiceClient()
+    response = client.get_public_key(key_name)
+
+    key_txt = response.pem.encode('ascii')
     key = serialization.load_pem_public_key(key_txt, default_backend())
     return key
 # [END kms_get_asymmetric_public]
 
 
 # [START kms_decrypt_rsa]
-def decryptRSA(ciphertext, client, key_path):
+def decrypt_rsa(ciphertext, key_name):
     """
     Decrypt the input ciphertext (bytes) using an
     'RSA_DECRYPT_OAEP_2048_SHA256' private key stored on Cloud KMS
 
-    Requires:
-      base64
+    Example key_name:
+      "projects/PROJECT_ID/locations/global/keyRings/RING_ID/cryptoKeys\
+              /KEY_ID/cryptoKeyVersions/1"
     """
-    request_body = {'ciphertext': base64.b64encode(ciphertext).decode('utf-8')}
-    request = client.projects() \
-                    .locations() \
-                    .keyRings() \
-                    .cryptoKeys() \
-                    .cryptoKeyVersions() \
-                    .asymmetricDecrypt(name=key_path,
-                                       body=request_body)
-    response = request.execute()
-    plaintext = base64.b64decode(response['plaintext'])
-    return plaintext
+
+    client = kms_v1.KeyManagementServiceClient()
+    response = client.asymmetric_decrypt(key_name, ciphertext)
+    return response.plaintext
 # [END kms_decrypt_rsa]
 
 
 # [START kms_encrypt_rsa]
-def encryptRSA(plaintext, client, key_path):
+def encrypt_rsa(plaintext, key_name):
     """
     Encrypt the input plaintext (bytes) locally using an
     'RSA_DECRYPT_OAEP_2048_SHA256' public key retrieved from Cloud KMS
 
+    Example key_name:
+      "projects/PROJECT_ID/locations/global/keyRings/RING_ID/cryptoKeys\
+              /KEY_ID/cryptoKeyVersions/1"
+
     Requires:
       cryptography.hazmat.primitives.asymmetric.padding
       cryptography.hazmat.primitives.hashes
     """
-    public_key = getAsymmetricPublicKey(client, key_path)
+    # get the public key
+    client = kms_v1.KeyManagementServiceClient()
+    response = client.get_public_key(key_name)
+    key_txt = response.pem.encode('ascii')
+    public_key = serialization.load_pem_public_key(key_txt, default_backend())
+
+    # encrypt plaintext
     pad = padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                        algorithm=hashes.SHA256(),
                        label=None)
@@ -86,46 +118,53 @@ def encryptRSA(plaintext, client, key_path):
 
 
 # [START kms_sign_asymmetric]
-def signAsymmetric(message, client, key_path):
+def sign_asymmetric(message, key_name):
     """
     Create a signature for a message using a private key stored on Cloud KMS
 
+    Example key_name:
+      "projects/PROJECT_ID/locations/global/keyRings/RING_ID/cryptoKeys\
+              /KEY_ID/cryptoKeyVersions/1"
+
     Requires:
-      base64
       hashlib
     """
     # Note: some key algorithms will require a different hash function
     # For example, EC_SIGN_P384_SHA384 requires SHA384
+    client = kms_v1.KeyManagementServiceClient()
     digest_bytes = hashlib.sha256(message).digest()
-    digest64 = base64.b64encode(digest_bytes)
-
-    digest_JSON = {'sha256': digest64.decode('utf-8')}
-    request = client.projects() \
-                    .locations() \
-                    .keyRings() \
-                    .cryptoKeys() \
-                    .cryptoKeyVersions() \
-                    .asymmetricSign(name=key_path,
-                                    body={'digest': digest_JSON})
-    response = request.execute()
-    return base64.b64decode(response.get('signature', None))
+
+    digest_json = {'sha256': digest_bytes}
+
+    response = client.asymmetric_sign(key_name, digest_json)
+    return response.signature
 # [END kms_sign_asymmetric]
 
 
 # [START kms_verify_signature_rsa]
-def verifySignatureRSA(signature, message, client, key_path):
+def verify_signature_rsa(signature, message, key_name):
     """
     Verify the validity of an 'RSA_SIGN_PSS_2048_SHA256' signature for the
     specified message
 
+    Example key_name:
+      "projects/PROJECT_ID/locations/global/keyRings/RING_ID/cryptoKeys\
+              /KEY_ID/cryptoKeyVersions/1"
+
     Requires:
       cryptography.exceptions.InvalidSignature
       cryptography.hazmat.primitives.asymmetric.padding
       cryptography.hazmat.primitives.asymmetric.utils
       cryptography.hazmat.primitives.hashes
       hashlib
     """
-    public_key = getAsymmetricPublicKey(client, key_path)
+    # get the public key
+    client = kms_v1.KeyManagementServiceClient()
+    response = client.get_public_key(key_name)
+    key_txt = response.pem.encode('ascii')
+    public_key = serialization.load_pem_public_key(key_txt, default_backend())
+
+    # get the digest of the message
     digest_bytes = hashlib.sha256(message).digest()
 
     try:
@@ -143,19 +182,29 @@ def verifySignatureRSA(signature, message, client, key_path):
 
 
 # [START kms_verify_signature_ec]
-def verifySignatureEC(signature, message, client, key_path):
+def verify_signature_ec(signature, message, key_name):
     """
     Verify the validity of an 'EC_SIGN_P256_SHA256' signature
     for the specified message
 
+    Example key_name:
+      "projects/PROJECT_ID/locations/global/keyRings/RING_ID/cryptoKeys\
+              /KEY_ID/cryptoKeyVersions/1"
+
     Requires:
       cryptography.exceptions.InvalidSignature
       cryptography.hazmat.primitives.asymmetric.ec
       cryptography.hazmat.primitives.asymmetric.utils
       cryptography.hazmat.primitives.hashes
       hashlib
     """
-    public_key = getAsymmetricPublicKey(client, key_path)
+    # get the public key
+    client = kms_v1.KeyManagementServiceClient()
+    response = client.get_public_key(key_name)
+    key_txt = response.pem.encode('ascii')
+    public_key = serialization.load_pem_public_key(key_txt, default_backend())
+
+    # get the digest of the message
     digest_bytes = hashlib.sha256(message).digest()
 
     try: