Skip to content

Commit 33823aa

Browse files
yoshi-automationyoshi-automation
committed
feat(cloudkms): update the API
#### cloudkms:v1 The following keys were added: - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.description - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.flatPath - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.httpMethod - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.id - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.parameterOrder - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.parameters.name.description - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.parameters.name.location - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.parameters.name.pattern - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.parameters.name.required - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.parameters.name.type - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.path - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.request.$ref - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.response.$ref - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.decapsulate.scopes - schemas.DecapsulateRequest.description - schemas.DecapsulateRequest.id - schemas.DecapsulateRequest.properties.ciphertext.description - schemas.DecapsulateRequest.properties.ciphertext.format - schemas.DecapsulateRequest.properties.ciphertext.type - schemas.DecapsulateRequest.properties.ciphertextCrc32c.description - schemas.DecapsulateRequest.properties.ciphertextCrc32c.format - schemas.DecapsulateRequest.properties.ciphertextCrc32c.type - schemas.DecapsulateRequest.type - schemas.DecapsulateResponse.description - schemas.DecapsulateResponse.id - schemas.DecapsulateResponse.properties.name.description - schemas.DecapsulateResponse.properties.name.type - schemas.DecapsulateResponse.properties.protectionLevel.description - schemas.DecapsulateResponse.properties.protectionLevel.enum - schemas.DecapsulateResponse.properties.protectionLevel.enumDescriptions - schemas.DecapsulateResponse.properties.protectionLevel.type - schemas.DecapsulateResponse.properties.sharedSecret.description - schemas.DecapsulateResponse.properties.sharedSecret.format - schemas.DecapsulateResponse.properties.sharedSecret.type - schemas.DecapsulateResponse.properties.sharedSecretCrc32c.description - schemas.DecapsulateResponse.properties.sharedSecretCrc32c.format - schemas.DecapsulateResponse.properties.sharedSecretCrc32c.type - schemas.DecapsulateResponse.properties.verifiedCiphertextCrc32c.description - schemas.DecapsulateResponse.properties.verifiedCiphertextCrc32c.type - schemas.DecapsulateResponse.type The following keys were changed: - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.getPublicKey.parameters.publicKeyFormat.enum - resources.projects.resources.locations.resources.keyRings.resources.cryptoKeys.resources.cryptoKeyVersions.methods.getPublicKey.parameters.publicKeyFormat.enumDescriptions - schemas.CryptoKey.properties.purpose.enum - schemas.CryptoKey.properties.purpose.enumDescriptions - schemas.CryptoKeyVersion.properties.algorithm.enum - schemas.CryptoKeyVersion.properties.algorithm.enumDescriptions - schemas.CryptoKeyVersionTemplate.properties.algorithm.enum - schemas.CryptoKeyVersionTemplate.properties.algorithm.enumDescriptions - schemas.ImportCryptoKeyVersionRequest.properties.algorithm.enum - schemas.ImportCryptoKeyVersionRequest.properties.algorithm.enumDescriptions - schemas.PublicKey.properties.algorithm.enum - schemas.PublicKey.properties.algorithm.enumDescriptions - schemas.PublicKey.properties.publicKeyFormat.enum - schemas.PublicKey.properties.publicKeyFormat.enumDescriptions
1 parent f6daacd commit 33823aa

File tree

2 files changed

+339
-7
lines changed

2 files changed

+339
-7
lines changed

‎discovery/cloudkms-v1.json

Lines changed: 130 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1795,6 +1795,35 @@
17951795
"https://www.googleapis.com/auth/cloudkms"
17961796
]
17971797
},
1798+
"decapsulate": {
1799+
"description": "Decapsulates data that was encapsulated with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose KEY_ENCAPSULATION.",
1800+
"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/keyRings/{keyRingsId}/cryptoKeys/{cryptoKeysId}/cryptoKeyVersions/{cryptoKeyVersionsId}:decapsulate",
1801+
"httpMethod": "POST",
1802+
"id": "cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.decapsulate",
1803+
"parameterOrder": [
1804+
"name"
1805+
],
1806+
"parameters": {
1807+
"name": {
1808+
"description": "Required. The resource name of the CryptoKeyVersion to use for decapsulation.",
1809+
"location": "path",
1810+
"pattern": "^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+/cryptoKeyVersions/[^/]+$",
1811+
"required": true,
1812+
"type": "string"
1813+
}
1814+
},
1815+
"path": "v1/{+name}:decapsulate",
1816+
"request": {
1817+
"$ref": "DecapsulateRequest"
1818+
},
1819+
"response": {
1820+
"$ref": "DecapsulateResponse"
1821+
},
1822+
"scopes": [
1823+
"https://www.googleapis.com/auth/cloud-platform",
1824+
"https://www.googleapis.com/auth/cloudkms"
1825+
]
1826+
},
17981827
"destroy": {
17991828
"description": "Schedule a CryptoKeyVersion for destruction. Upon calling this method, CryptoKeyVersion.state will be set to DESTROY_SCHEDULED, and destroy_time will be set to the time destroy_scheduled_duration in the future. At that time, the state will automatically change to DESTROYED, and the key material will be irrevocably destroyed. Before the destroy_time is reached, RestoreCryptoKeyVersion may be called to reverse the process.",
18001829
"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/keyRings/{keyRingsId}/cryptoKeys/{cryptoKeysId}/cryptoKeyVersions/{cryptoKeyVersionsId}:destroy",
@@ -1871,12 +1900,16 @@
18711900
"enum": [
18721901
"PUBLIC_KEY_FORMAT_UNSPECIFIED",
18731902
"PEM",
1874-
"NIST_PQC"
1903+
"DER",
1904+
"NIST_PQC",
1905+
"XWING_RAW_BYTES"
18751906
],
18761907
"enumDescriptions": [
18771908
"If the public_key_format field is not specified: - For PQC algorithms, an error will be returned. - For non-PQC algorithms, the default format is PEM, and the field pem will be populated. Otherwise, the public key will be exported through the public_key field in the requested format.",
18781909
"The returned public key will be encoded in PEM format. See the [RFC7468](https://tools.ietf.org/html/rfc7468) sections for [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and [Textual Encoding of Subject Public Key Info] (https://tools.ietf.org/html/rfc7468#section-13) for more information.",
1879-
"This is supported only for PQC algorithms. The key material is returned in the format defined by NIST PQC standards (FIPS 203, FIPS 204, and FIPS 205)."
1910+
"The returned public key will be encoded in DER format (the PrivateKeyInfo structure from RFC 5208).",
1911+
"This is supported only for PQC algorithms. The key material is returned in the format defined by NIST PQC standards (FIPS 203, FIPS 204, and FIPS 205).",
1912+
"The returned public key is in raw bytes format defined in its standard https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem."
18801913
],
18811914
"location": "query",
18821915
"type": "string"
@@ -2402,7 +2435,7 @@
24022435
}
24032436
}
24042437
},
2405-
"revision": "20250523",
2438+
"revision": "20250731",
24062439
"rootUrl": "https://cloudkms.googleapis.com/",
24072440
"schemas": {
24082441
"AsymmetricDecryptRequest": {
@@ -2799,15 +2832,17 @@
27992832
"ASYMMETRIC_SIGN",
28002833
"ASYMMETRIC_DECRYPT",
28012834
"RAW_ENCRYPT_DECRYPT",
2802-
"MAC"
2835+
"MAC",
2836+
"KEY_ENCAPSULATION"
28032837
],
28042838
"enumDescriptions": [
28052839
"Not specified.",
28062840
"CryptoKeys with this purpose may be used with Encrypt and Decrypt.",
28072841
"CryptoKeys with this purpose may be used with AsymmetricSign and GetPublicKey.",
28082842
"CryptoKeys with this purpose may be used with AsymmetricDecrypt and GetPublicKey.",
28092843
"CryptoKeys with this purpose may be used with RawEncrypt and RawDecrypt. This purpose is meant to be used for interoperable symmetric encryption and does not support automatic CryptoKey rotation.",
2810-
"CryptoKeys with this purpose may be used with MacSign."
2844+
"CryptoKeys with this purpose may be used with MacSign.",
2845+
"CryptoKeys with this purpose may be used with GetPublicKey and Decapsulate."
28112846
],
28122847
"type": "string"
28132848
},
@@ -2866,6 +2901,9 @@
28662901
"HMAC_SHA512",
28672902
"HMAC_SHA224",
28682903
"EXTERNAL_SYMMETRIC_ENCRYPTION",
2904+
"ML_KEM_768",
2905+
"ML_KEM_1024",
2906+
"KEM_XWING",
28692907
"PQ_SIGN_ML_DSA_65",
28702908
"PQ_SIGN_SLH_DSA_SHA2_128S",
28712909
"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
@@ -2907,6 +2945,9 @@
29072945
"HMAC-SHA512 signing with a 512 bit key.",
29082946
"HMAC-SHA224 signing with a 224 bit key.",
29092947
"Algorithm representing symmetric encryption by an external key manager.",
2948+
"ML-KEM-768 (FIPS 203)",
2949+
"ML-KEM-1024 (FIPS 203)",
2950+
"X-Wing hybrid KEM combining ML-KEM-768 with X25519 following datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.",
29102951
"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
29112952
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
29122953
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
@@ -3078,6 +3119,9 @@
30783119
"HMAC_SHA512",
30793120
"HMAC_SHA224",
30803121
"EXTERNAL_SYMMETRIC_ENCRYPTION",
3122+
"ML_KEM_768",
3123+
"ML_KEM_1024",
3124+
"KEM_XWING",
30813125
"PQ_SIGN_ML_DSA_65",
30823126
"PQ_SIGN_SLH_DSA_SHA2_128S",
30833127
"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
@@ -3119,6 +3163,9 @@
31193163
"HMAC-SHA512 signing with a 512 bit key.",
31203164
"HMAC-SHA224 signing with a 224 bit key.",
31213165
"Algorithm representing symmetric encryption by an external key manager.",
3166+
"ML-KEM-768 (FIPS 203)",
3167+
"ML-KEM-1024 (FIPS 203)",
3168+
"X-Wing hybrid KEM combining ML-KEM-768 with X25519 following datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.",
31223169
"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
31233170
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
31243171
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
@@ -3146,6 +3193,66 @@
31463193
},
31473194
"type": "object"
31483195
},
3196+
"DecapsulateRequest": {
3197+
"description": "Request message for KeyManagementService.Decapsulate.",
3198+
"id": "DecapsulateRequest",
3199+
"properties": {
3200+
"ciphertext": {
3201+
"description": "Required. The ciphertext produced from encapsulation with the named CryptoKeyVersion public key(s).",
3202+
"format": "byte",
3203+
"type": "string"
3204+
},
3205+
"ciphertextCrc32c": {
3206+
"description": "Optional. A CRC32C checksum of the DecapsulateRequest.ciphertext. If specified, KeyManagementService will verify the integrity of the received DecapsulateRequest.ciphertext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(DecapsulateRequest.ciphertext) is equal to DecapsulateRequest.ciphertext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
3207+
"format": "int64",
3208+
"type": "string"
3209+
}
3210+
},
3211+
"type": "object"
3212+
},
3213+
"DecapsulateResponse": {
3214+
"description": "Response message for KeyManagementService.Decapsulate.",
3215+
"id": "DecapsulateResponse",
3216+
"properties": {
3217+
"name": {
3218+
"description": "The resource name of the CryptoKeyVersion used for decapsulation. Check this field to verify that the intended resource was used for decapsulation.",
3219+
"type": "string"
3220+
},
3221+
"protectionLevel": {
3222+
"description": "The ProtectionLevel of the CryptoKeyVersion used in decapsulation.",
3223+
"enum": [
3224+
"PROTECTION_LEVEL_UNSPECIFIED",
3225+
"SOFTWARE",
3226+
"HSM",
3227+
"EXTERNAL",
3228+
"EXTERNAL_VPC"
3229+
],
3230+
"enumDescriptions": [
3231+
"Not specified.",
3232+
"Crypto operations are performed in software.",
3233+
"Crypto operations are performed in a Hardware Security Module.",
3234+
"Crypto operations are performed by an external key manager.",
3235+
"Crypto operations are performed in an EKM-over-VPC backend."
3236+
],
3237+
"type": "string"
3238+
},
3239+
"sharedSecret": {
3240+
"description": "The decapsulated shared_secret originally encapsulated with the matching public key.",
3241+
"format": "byte",
3242+
"type": "string"
3243+
},
3244+
"sharedSecretCrc32c": {
3245+
"description": "Integrity verification field. A CRC32C checksum of the returned DecapsulateResponse.shared_secret. An integrity check of DecapsulateResponse.shared_secret can be performed by computing the CRC32C checksum of DecapsulateResponse.shared_secret and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: receiving this response message indicates that KeyManagementService is able to successfully decrypt the ciphertext. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
3246+
"format": "int64",
3247+
"type": "string"
3248+
},
3249+
"verifiedCiphertextCrc32c": {
3250+
"description": "Integrity verification field. A flag indicating whether DecapsulateRequest.ciphertext_crc32c was received by KeyManagementService and used for the integrity verification of the ciphertext. A false value of this field indicates either that DecapsulateRequest.ciphertext_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set DecapsulateRequest.ciphertext_crc32c but this field is still false, discard the response and perform a limited number of retries.",
3251+
"type": "boolean"
3252+
}
3253+
},
3254+
"type": "object"
3255+
},
31493256
"DecryptRequest": {
31503257
"description": "Request message for KeyManagementService.Decrypt.",
31513258
"id": "DecryptRequest",
@@ -3505,6 +3612,9 @@
35053612
"HMAC_SHA512",
35063613
"HMAC_SHA224",
35073614
"EXTERNAL_SYMMETRIC_ENCRYPTION",
3615+
"ML_KEM_768",
3616+
"ML_KEM_1024",
3617+
"KEM_XWING",
35083618
"PQ_SIGN_ML_DSA_65",
35093619
"PQ_SIGN_SLH_DSA_SHA2_128S",
35103620
"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
@@ -3546,6 +3656,9 @@
35463656
"HMAC-SHA512 signing with a 512 bit key.",
35473657
"HMAC-SHA224 signing with a 224 bit key.",
35483658
"Algorithm representing symmetric encryption by an external key manager.",
3659+
"ML-KEM-768 (FIPS 203)",
3660+
"ML-KEM-1024 (FIPS 203)",
3661+
"X-Wing hybrid KEM combining ML-KEM-768 with X25519 following datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.",
35493662
"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
35503663
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
35513664
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
@@ -4260,6 +4373,9 @@
42604373
"HMAC_SHA512",
42614374
"HMAC_SHA224",
42624375
"EXTERNAL_SYMMETRIC_ENCRYPTION",
4376+
"ML_KEM_768",
4377+
"ML_KEM_1024",
4378+
"KEM_XWING",
42634379
"PQ_SIGN_ML_DSA_65",
42644380
"PQ_SIGN_SLH_DSA_SHA2_128S",
42654381
"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
@@ -4301,6 +4417,9 @@
43014417
"HMAC-SHA512 signing with a 512 bit key.",
43024418
"HMAC-SHA224 signing with a 224 bit key.",
43034419
"Algorithm representing symmetric encryption by an external key manager.",
4420+
"ML-KEM-768 (FIPS 203)",
4421+
"ML-KEM-1024 (FIPS 203)",
4422+
"X-Wing hybrid KEM combining ML-KEM-768 with X25519 following datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.",
43044423
"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
43054424
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
43064425
"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
@@ -4347,12 +4466,16 @@
43474466
"enum": [
43484467
"PUBLIC_KEY_FORMAT_UNSPECIFIED",
43494468
"PEM",
4350-
"NIST_PQC"
4469+
"DER",
4470+
"NIST_PQC",
4471+
"XWING_RAW_BYTES"
43514472
],
43524473
"enumDescriptions": [
43534474
"If the public_key_format field is not specified: - For PQC algorithms, an error will be returned. - For non-PQC algorithms, the default format is PEM, and the field pem will be populated. Otherwise, the public key will be exported through the public_key field in the requested format.",
43544475
"The returned public key will be encoded in PEM format. See the [RFC7468](https://tools.ietf.org/html/rfc7468) sections for [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and [Textual Encoding of Subject Public Key Info] (https://tools.ietf.org/html/rfc7468#section-13) for more information.",
4355-
"This is supported only for PQC algorithms. The key material is returned in the format defined by NIST PQC standards (FIPS 203, FIPS 204, and FIPS 205)."
4476+
"The returned public key will be encoded in DER format (the PrivateKeyInfo structure from RFC 5208).",
4477+
"This is supported only for PQC algorithms. The key material is returned in the format defined by NIST PQC standards (FIPS 203, FIPS 204, and FIPS 205).",
4478+
"The returned public key is in raw bytes format defined in its standard https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem."
43564479
],
43574480
"type": "string"
43584481
}

0 commit comments

Comments
 (0)