support for azure key vault

[codethatrocks]

Hi, are there plans for supporting Azure in addition to GCP and AWS KMS?

[thaidn]

It's not high priority at the moment, but if you can contribute we'll help review your code.

[thaidn]

Yes it is.

[thaidn]

Yes, absolutely.

…

On Tue, Mar 26, 2019 at 1:08 AM 99M8 ***@***.***> wrote: Great. Then I would love to take it on. Is it ok, @thaidn <https://github.com/thaidn> ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#158 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAdbPk0-a02qRud3qELOrOYNV0EPZ-Iks5vadV8gaJpZM4YefRa> .

-- https://vnhacker.blogspot.com

[przydatek]

Hi @99M8 , are you still interested in contributing?

[przydatek]

Closing for now, as we don't have resources to work on it, but potential contributors are encouraged to re-open.

[pawelprazak]

asking theoretically, what size would this task be, M, L?

[thaidn]

It's similar to #405.

[thejasn]

Hey @thaidn,
Is anyone working on this? I would like to contribute here (for go, maybe java as well).

[sfc-gh-kleonhard]

This looks pretty easy, but - Azure key vault doesn't support symmetric keys so the implementation would need to use an asymmetric RSA key (RSA-OAEP-256). The interface in aead.go accepts AAD, but it isn't passed when encrypting DEKs with the remote KMS (code.

Anyone willing to weigh in?

[tholenst]

Over the years we found several reason to redesign our KMS integration. I will leave this open for now though -- but we should first do the redesign.

[sfc-gh-kleonhard]

Thanks Thomas. If the reasons are written down somewhere, I'd be curious to see them for my own understanding.

My two cents - without Azure support, there's a whole swatch of multi-cloud users that won't adopt Tink.

[svrakitin]

Hi, did the redesign happen? If not, are you still open to accept Azure Key Vault integration with the current design?

[tholenst]

We don't plan this and I will close this. The issue is that maintaining these integrations is not trivial. Furthermore, an implementation can be done by anyone (not just us) in a separate repository.