Skip to content

Commit 186cef2

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: [google-cloud-kms] Support KEY_ENCAPSULATION purpose and quantum-safe algorithms ML_KEM_768, ML_KEM_1024 and KEM_XWING (googleapis#14399)
BEGIN_COMMIT_OVERRIDE feat: Support KEY_ENCAPSULATION purpose and quantum-safe algorithms ML_KEM_768, ML_KEM_1024 and KEM_XWING feat: Add PublicKeyFormat enums XWING_RAW_BYTES (used for KEM_XWING) and DER END_COMMIT_OVERRIDE - [ ] Regenerate this pull request now. feat: Add PublicKeyFormat enums XWING_RAW_BYTES (used for KEM_XWING) and DER PiperOrigin-RevId: 805449810 Source-Link: googleapis/googleapis@f8146b4 Source-Link: https://github.com/googleapis/googleapis-gen/commit/79c8e5c202c1956a15a48c8ef7db0a47f201a7f5 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiNzljOGU1YzIwMmMxOTU2YTE1YTQ4YzhlZjdkYjBhNDdmMjAxYTdmNSJ9 --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 3bfaf76 commit 186cef2

File tree

18 files changed

+1596
-0
lines changed

18 files changed

+1596
-0
lines changed

‎packages/google-cloud-kms/google/cloud/kms/__init__.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@
8484
CreateCryptoKeyVersionRequest,
8585
CreateImportJobRequest,
8686
CreateKeyRingRequest,
87+
DecapsulateRequest,
88+
DecapsulateResponse,
8789
DecryptRequest,
8890
DecryptResponse,
8991
DestroyCryptoKeyVersionRequest,
@@ -173,6 +175,8 @@
173175
"CreateCryptoKeyVersionRequest",
174176
"CreateImportJobRequest",
175177
"CreateKeyRingRequest",
178+
"DecapsulateRequest",
179+
"DecapsulateResponse",
176180
"DecryptRequest",
177181
"DecryptResponse",
178182
"DestroyCryptoKeyVersionRequest",

‎packages/google-cloud-kms/google/cloud/kms_v1/__init__.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,8 @@
7777
CreateCryptoKeyVersionRequest,
7878
CreateImportJobRequest,
7979
CreateKeyRingRequest,
80+
DecapsulateRequest,
81+
DecapsulateResponse,
8082
DecryptRequest,
8183
DecryptResponse,
8284
DestroyCryptoKeyVersionRequest,
@@ -139,6 +141,8 @@
139141
"CryptoKey",
140142
"CryptoKeyVersion",
141143
"CryptoKeyVersionTemplate",
144+
"DecapsulateRequest",
145+
"DecapsulateResponse",
142146
"DecryptRequest",
143147
"DecryptResponse",
144148
"DestroyCryptoKeyVersionRequest",

‎packages/google-cloud-kms/google/cloud/kms_v1/gapic_metadata.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,11 @@
292292
"create_key_ring"
293293
]
294294
},
295+
"Decapsulate": {
296+
"methods": [
297+
"decapsulate"
298+
]
299+
},
295300
"Decrypt": {
296301
"methods": [
297302
"decrypt"
@@ -437,6 +442,11 @@
437442
"create_key_ring"
438443
]
439444
},
445+
"Decapsulate": {
446+
"methods": [
447+
"decapsulate"
448+
]
449+
},
440450
"Decrypt": {
441451
"methods": [
442452
"decrypt"
@@ -582,6 +592,11 @@
582592
"create_key_ring"
583593
]
584594
},
595+
"Decapsulate": {
596+
"methods": [
597+
"decapsulate"
598+
]
599+
},
585600
"Decrypt": {
586601
"methods": [
587602
"decrypt"

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/async_client.py‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3867,6 +3867,99 @@ async def sample_mac_verify():
38673867
# Done; return the response.
38683868
return response
38693869

3870+
async def decapsulate(
3871+
self,
3872+
request: Optional[Union[service.DecapsulateRequest, dict]] = None,
3873+
*,
3874+
retry: OptionalRetry = gapic_v1.method.DEFAULT,
3875+
timeout: Union[float, object] = gapic_v1.method.DEFAULT,
3876+
metadata: Sequence[Tuple[str, Union[str, bytes]]] = (),
3877+
) -> service.DecapsulateResponse:
3878+
r"""Decapsulates data that was encapsulated with a public key
3879+
retrieved from
3880+
[GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]
3881+
corresponding to a
3882+
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
3883+
[CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
3884+
KEY_ENCAPSULATION.
3885+
3886+
.. code-block:: python
3887+
3888+
# This snippet has been automatically generated and should be regarded as a
3889+
# code template only.
3890+
# It will require modifications to work:
3891+
# - It may require correct/in-range values for request initialization.
3892+
# - It may require specifying regional endpoints when creating the service
3893+
# client as shown in:
3894+
# https://googleapis.dev/python/google-api-core/latest/client_options.html
3895+
from google.cloud import kms_v1
3896+
3897+
async def sample_decapsulate():
3898+
# Create a client
3899+
client = kms_v1.KeyManagementServiceAsyncClient()
3900+
3901+
# Initialize request argument(s)
3902+
request = kms_v1.DecapsulateRequest(
3903+
name="name_value",
3904+
ciphertext=b'ciphertext_blob',
3905+
)
3906+
3907+
# Make the request
3908+
response = await client.decapsulate(request=request)
3909+
3910+
# Handle the response
3911+
print(response)
3912+
3913+
Args:
3914+
request (Optional[Union[google.cloud.kms_v1.types.DecapsulateRequest, dict]]):
3915+
The request object. Request message for
3916+
[KeyManagementService.Decapsulate][google.cloud.kms.v1.KeyManagementService.Decapsulate].
3917+
retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any,
3918+
should be retried.
3919+
timeout (float): The timeout for this request.
3920+
metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be
3921+
sent along with the request as metadata. Normally, each value must be of type `str`,
3922+
but for metadata keys ending with the suffix `-bin`, the corresponding values must
3923+
be of type `bytes`.
3924+
3925+
Returns:
3926+
google.cloud.kms_v1.types.DecapsulateResponse:
3927+
Response message for
3928+
[KeyManagementService.Decapsulate][google.cloud.kms.v1.KeyManagementService.Decapsulate].
3929+
3930+
"""
3931+
# Create or coerce a protobuf request object.
3932+
# - Use the request object if provided (there's no risk of modifying the input as
3933+
# there are no flattened fields), or create one.
3934+
if not isinstance(request, service.DecapsulateRequest):
3935+
request = service.DecapsulateRequest(request)
3936+
3937+
# Wrap the RPC method; this adds retry and timeout information,
3938+
# and friendly error handling.
3939+
rpc = self._client._transport._wrapped_methods[
3940+
self._client._transport.decapsulate
3941+
]
3942+
3943+
# Certain fields should be provided within the metadata header;
3944+
# add these here.
3945+
metadata = tuple(metadata) + (
3946+
gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
3947+
)
3948+
3949+
# Validate the universe domain.
3950+
self._client._validate_universe_domain()
3951+
3952+
# Send the request.
3953+
response = await rpc(
3954+
request,
3955+
retry=retry,
3956+
timeout=timeout,
3957+
metadata=metadata,
3958+
)
3959+
3960+
# Done; return the response.
3961+
return response
3962+
38703963
async def generate_random_bytes(
38713964
self,
38723965
request: Optional[Union[service.GenerateRandomBytesRequest, dict]] = None,

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/client.py‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4313,6 +4313,97 @@ def sample_mac_verify():
43134313
# Done; return the response.
43144314
return response
43154315

4316+
def decapsulate(
4317+
self,
4318+
request: Optional[Union[service.DecapsulateRequest, dict]] = None,
4319+
*,
4320+
retry: OptionalRetry = gapic_v1.method.DEFAULT,
4321+
timeout: Union[float, object] = gapic_v1.method.DEFAULT,
4322+
metadata: Sequence[Tuple[str, Union[str, bytes]]] = (),
4323+
) -> service.DecapsulateResponse:
4324+
r"""Decapsulates data that was encapsulated with a public key
4325+
retrieved from
4326+
[GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]
4327+
corresponding to a
4328+
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
4329+
[CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
4330+
KEY_ENCAPSULATION.
4331+
4332+
.. code-block:: python
4333+
4334+
# This snippet has been automatically generated and should be regarded as a
4335+
# code template only.
4336+
# It will require modifications to work:
4337+
# - It may require correct/in-range values for request initialization.
4338+
# - It may require specifying regional endpoints when creating the service
4339+
# client as shown in:
4340+
# https://googleapis.dev/python/google-api-core/latest/client_options.html
4341+
from google.cloud import kms_v1
4342+
4343+
def sample_decapsulate():
4344+
# Create a client
4345+
client = kms_v1.KeyManagementServiceClient()
4346+
4347+
# Initialize request argument(s)
4348+
request = kms_v1.DecapsulateRequest(
4349+
name="name_value",
4350+
ciphertext=b'ciphertext_blob',
4351+
)
4352+
4353+
# Make the request
4354+
response = client.decapsulate(request=request)
4355+
4356+
# Handle the response
4357+
print(response)
4358+
4359+
Args:
4360+
request (Union[google.cloud.kms_v1.types.DecapsulateRequest, dict]):
4361+
The request object. Request message for
4362+
[KeyManagementService.Decapsulate][google.cloud.kms.v1.KeyManagementService.Decapsulate].
4363+
retry (google.api_core.retry.Retry): Designation of what errors, if any,
4364+
should be retried.
4365+
timeout (float): The timeout for this request.
4366+
metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be
4367+
sent along with the request as metadata. Normally, each value must be of type `str`,
4368+
but for metadata keys ending with the suffix `-bin`, the corresponding values must
4369+
be of type `bytes`.
4370+
4371+
Returns:
4372+
google.cloud.kms_v1.types.DecapsulateResponse:
4373+
Response message for
4374+
[KeyManagementService.Decapsulate][google.cloud.kms.v1.KeyManagementService.Decapsulate].
4375+
4376+
"""
4377+
# Create or coerce a protobuf request object.
4378+
# - Use the request object if provided (there's no risk of modifying the input as
4379+
# there are no flattened fields), or create one.
4380+
if not isinstance(request, service.DecapsulateRequest):
4381+
request = service.DecapsulateRequest(request)
4382+
4383+
# Wrap the RPC method; this adds retry and timeout information,
4384+
# and friendly error handling.
4385+
rpc = self._transport._wrapped_methods[self._transport.decapsulate]
4386+
4387+
# Certain fields should be provided within the metadata header;
4388+
# add these here.
4389+
metadata = tuple(metadata) + (
4390+
gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
4391+
)
4392+
4393+
# Validate the universe domain.
4394+
self._validate_universe_domain()
4395+
4396+
# Send the request.
4397+
response = rpc(
4398+
request,
4399+
retry=retry,
4400+
timeout=timeout,
4401+
metadata=metadata,
4402+
)
4403+
4404+
# Done; return the response.
4405+
return response
4406+
43164407
def generate_random_bytes(
43174408
self,
43184409
request: Optional[Union[service.GenerateRandomBytesRequest, dict]] = None,

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/transports/base.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -504,6 +504,11 @@ def _prep_wrapped_messages(self, client_info):
504504
default_timeout=60.0,
505505
client_info=client_info,
506506
),
507+
self.decapsulate: gapic_v1.method.wrap_method(
508+
self.decapsulate,
509+
default_timeout=None,
510+
client_info=client_info,
511+
),
507512
self.generate_random_bytes: gapic_v1.method.wrap_method(
508513
self.generate_random_bytes,
509514
default_retry=retries.Retry(
@@ -815,6 +820,15 @@ def mac_verify(
815820
]:
816821
raise NotImplementedError()
817822

823+
@property
824+
def decapsulate(
825+
self,
826+
) -> Callable[
827+
[service.DecapsulateRequest],
828+
Union[service.DecapsulateResponse, Awaitable[service.DecapsulateResponse]],
829+
]:
830+
raise NotImplementedError()
831+
818832
@property
819833
def generate_random_bytes(
820834
self,

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/transports/grpc.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1166,6 +1166,38 @@ def mac_verify(
11661166
)
11671167
return self._stubs["mac_verify"]
11681168

1169+
@property
1170+
def decapsulate(
1171+
self,
1172+
) -> Callable[[service.DecapsulateRequest], service.DecapsulateResponse]:
1173+
r"""Return a callable for the decapsulate method over gRPC.
1174+
1175+
Decapsulates data that was encapsulated with a public key
1176+
retrieved from
1177+
[GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]
1178+
corresponding to a
1179+
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
1180+
[CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
1181+
KEY_ENCAPSULATION.
1182+
1183+
Returns:
1184+
Callable[[~.DecapsulateRequest],
1185+
~.DecapsulateResponse]:
1186+
A function that, when called, will call the underlying RPC
1187+
on the server.
1188+
"""
1189+
# Generate a "stub function" on-the-fly which will actually make
1190+
# the request.
1191+
# gRPC handles serialization and deserialization, so we just need
1192+
# to pass in the functions for each.
1193+
if "decapsulate" not in self._stubs:
1194+
self._stubs["decapsulate"] = self._logged_channel.unary_unary(
1195+
"/google.cloud.kms.v1.KeyManagementService/Decapsulate",
1196+
request_serializer=service.DecapsulateRequest.serialize,
1197+
response_deserializer=service.DecapsulateResponse.deserialize,
1198+
)
1199+
return self._stubs["decapsulate"]
1200+
11691201
@property
11701202
def generate_random_bytes(
11711203
self,

‎packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/transports/grpc_asyncio.py‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1205,6 +1205,38 @@ def mac_verify(
12051205
)
12061206
return self._stubs["mac_verify"]
12071207

1208+
@property
1209+
def decapsulate(
1210+
self,
1211+
) -> Callable[[service.DecapsulateRequest], Awaitable[service.DecapsulateResponse]]:
1212+
r"""Return a callable for the decapsulate method over gRPC.
1213+
1214+
Decapsulates data that was encapsulated with a public key
1215+
retrieved from
1216+
[GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]
1217+
corresponding to a
1218+
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
1219+
[CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
1220+
KEY_ENCAPSULATION.
1221+
1222+
Returns:
1223+
Callable[[~.DecapsulateRequest],
1224+
Awaitable[~.DecapsulateResponse]]:
1225+
A function that, when called, will call the underlying RPC
1226+
on the server.
1227+
"""
1228+
# Generate a "stub function" on-the-fly which will actually make
1229+
# the request.
1230+
# gRPC handles serialization and deserialization, so we just need
1231+
# to pass in the functions for each.
1232+
if "decapsulate" not in self._stubs:
1233+
self._stubs["decapsulate"] = self._logged_channel.unary_unary(
1234+
"/google.cloud.kms.v1.KeyManagementService/Decapsulate",
1235+
request_serializer=service.DecapsulateRequest.serialize,
1236+
response_deserializer=service.DecapsulateResponse.deserialize,
1237+
)
1238+
return self._stubs["decapsulate"]
1239+
12081240
@property
12091241
def generate_random_bytes(
12101242
self,
@@ -1603,6 +1635,11 @@ def _prep_wrapped_messages(self, client_info):
16031635
default_timeout=60.0,
16041636
client_info=client_info,
16051637
),
1638+
self.decapsulate: self._wrap_method(
1639+
self.decapsulate,
1640+
default_timeout=None,
1641+
client_info=client_info,
1642+
),
16061643
self.generate_random_bytes: self._wrap_method(
16071644
self.generate_random_bytes,
16081645
default_retry=retries.AsyncRetry(

0 commit comments

Comments
 (0)