Update KMS client library

go.mod

@@ -3,27 +3,31 @@ module github.com/tink-crypto/tink-go-gcpkms/v2
 go 1.19
 
 require (
+	cloud.google.com/go/kms v1.15.0
 	github.com/tink-crypto/tink-go/v2 v2.0.0
 	google.golang.org/api v0.128.0
+	google.golang.org/protobuf v1.30.0
 )
 
 require (
 	cloud.google.com/go/compute v1.19.3 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/iam v1.1.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/google/uuid v1.3.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.10.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.11.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	golang.org/x/crypto v0.9.0 // indirect
 	golang.org/x/net v0.10.0 // indirect
 	golang.org/x/oauth2 v0.8.0 // indirect
 	golang.org/x/sys v0.8.0 // indirect
 	golang.org/x/text v0.9.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
 	google.golang.org/grpc v1.55.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
 )

go.sum

@@ -1,9 +1,14 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.110.2 h1:sdFPBr6xG9/wkBbfhmUz/JmZC7X6LavQgcrVINrKiVA=
 cloud.google.com/go/compute v1.19.3 h1:DcTwsFgGev/wV5+q8o2fzgcHOaac+DKGC91ZlvpsQds=
 cloud.google.com/go/compute v1.19.3/go.mod h1:qxvISKp/gYnXkSAD1ppcSOveRAmzxicEv/JlizULFrI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/iam v1.1.0 h1:67gSqaPukx7O8WLLHMa0PNs3EBGd2eE4d+psbO/CO94=
+cloud.google.com/go/iam v1.1.0/go.mod h1:nxdHjaKfCr7fNYx/HJMM8LgiMugmveWlkatear5gVyk=
+cloud.google.com/go/kms v1.15.0 h1:xYl5WEaSekKYN5gGRyhjvZKM22GVBBCzegGNVPy+aIs=
+cloud.google.com/go/kms v1.15.0/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -53,15 +58,14 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
 github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.2.4 h1:uGy6JWR/uMIILU8wbf+OkstIrNiMjGpEIyhx8f6W7s4=
 github.com/googleapis/enterprise-certificate-proxy v0.2.4/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/gax-go/v2 v2.10.0 h1:ebSgKfMxynOdxw8QQuFOKMgomqeLGPqNLQox2bo42zg=
-github.com/googleapis/gax-go/v2 v2.10.0/go.mod h1:4UOEnMCrxsSqQ940WnTiD6qJ63le2ev3xfyagutxiPw=
+github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
+github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -159,7 +163,9 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
+google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
 google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
+google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=

integration/gcpkms/gcp_kms_aead.go

@@ -17,23 +17,27 @@
 package gcpkms
 
 import (
-	"encoding/base64"
+	"context"
+	"errors"
+	"hash/crc32"
 
-	"google.golang.org/api/cloudkms/v1"
+	kms "cloud.google.com/go/kms/apiv1"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
+	"cloud.google.com/go/kms/apiv1/kmspb"
 	"github.com/tink-crypto/tink-go/v2/tink"
 )
 
 // gcpAEAD represents a GCP KMS service to a particular URI.
 type gcpAEAD struct {
 	keyURI string
-	kms    cloudkms.Service
+	kms    kms.KeyManagementClient
 }
 
 var _ tink.AEAD = (*gcpAEAD)(nil)
 
 // newGCPAEAD returns a new GCP KMS service.
-func newGCPAEAD(keyURI string, kms *cloudkms.Service) tink.AEAD {
+func newGCPAEAD(keyURI string, kms *kms.KeyManagementClient) tink.AEAD {
 	return &gcpAEAD{
 		keyURI: keyURI,
 		kms:    *kms,
@@ -42,29 +46,63 @@ func newGCPAEAD(keyURI string, kms *cloudkms.Service) tink.AEAD {
 
 // Encrypt encrypts the plaintext with associatedData.
 func (a *gcpAEAD) Encrypt(plaintext, associatedData []byte) ([]byte, error) {
+	plaintextCRC32C := crc32c(plaintext)
+	associatedDataCRC32C := crc32c(associatedData)
 
-	req := &cloudkms.EncryptRequest{
-		Plaintext:                   base64.URLEncoding.EncodeToString(plaintext),
-		AdditionalAuthenticatedData: base64.URLEncoding.EncodeToString(associatedData),
+	req := &kmspb.EncryptRequest{
+		Name:                              a.keyURI,
+		Plaintext:                         plaintext,
+		PlaintextCrc32C:                   wrapperspb.Int64(int64(plaintextCRC32C)),
+		AdditionalAuthenticatedData:       associatedData,
+		AdditionalAuthenticatedDataCrc32C: wrapperspb.Int64(int64(associatedDataCRC32C)),
 	}
-	resp, err := a.kms.Projects.Locations.KeyRings.CryptoKeys.Encrypt(a.keyURI, req).Do()
+
+	ctx := context.Background()
+	resp, err := a.kms.Encrypt(ctx, req)
 	if err != nil {
 		return nil, err
 	}
 
-	return base64.StdEncoding.DecodeString(resp.Ciphertext)
+	// Perform integrity verification on result.
+	if !resp.VerifiedPlaintextCrc32C {
+		return nil, errors.New("Encrypt: request corrupted in-transit")
+	}
+	if int64(crc32c(resp.Ciphertext)) != resp.CiphertextCrc32C.Value {
+		return nil, errors.New("Encrypt: response corrupted in-transit")
+	}
+
+	return resp.Ciphertext, nil
 }
 
 // Decrypt decrypts ciphertext with with associatedData.
 func (a *gcpAEAD) Decrypt(ciphertext, associatedData []byte) ([]byte, error) {
+	ciphertextCRC32C := crc32c(ciphertext)
+	associatedDataCRC32C := crc32c(associatedData)
 
-	req := &cloudkms.DecryptRequest{
-		Ciphertext:                  base64.URLEncoding.EncodeToString(ciphertext),
-		AdditionalAuthenticatedData: base64.URLEncoding.EncodeToString(associatedData),
+	req := &kmspb.DecryptRequest{
+		Name:                              a.keyURI,
+		Ciphertext:                        ciphertext,
+		CiphertextCrc32C:                  wrapperspb.Int64(int64(ciphertextCRC32C)),
+		AdditionalAuthenticatedData:       associatedData,
+		AdditionalAuthenticatedDataCrc32C: wrapperspb.Int64(int64(associatedDataCRC32C)),
 	}
-	resp, err := a.kms.Projects.Locations.KeyRings.CryptoKeys.Decrypt(a.keyURI, req).Do()
+
+	ctx := context.Background()
+	resp, err := a.kms.Decrypt(ctx, req)
 	if err != nil {
 		return nil, err
 	}
-	return base64.StdEncoding.DecodeString(resp.Plaintext)
+
+	// Perform integrity verification on result.
+	if int64(crc32c(resp.Plaintext)) != resp.PlaintextCrc32C.Value {
+		return nil, errors.New("Decrypt: response corrupted in-transit")
+	}
+
+	return resp.Plaintext, nil
+}
+
+// Compute text's CRC32C.
+func crc32c(data []byte) uint32 {
+	t := crc32.MakeTable(crc32.Castagnoli)
+	return crc32.Checksum(data, t)
 }

integration/gcpkms/gcp_kms_client.go

@@ -25,25 +25,25 @@ import (
 	"runtime"
 	"strings"
 
-	"google.golang.org/api/cloudkms/v1"
-	"google.golang.org/api/option"
 	"github.com/tink-crypto/tink-go/v2/core/registry"
 	"github.com/tink-crypto/tink-go/v2/tink"
+	"google.golang.org/api/option"
+
+	kms "cloud.google.com/go/kms/apiv1"
 )
 
 const (
 	gcpPrefix = "gcp-kms://"
 )
 
 var (
-	errCred       = errors.New("invalid credential path")
 	tinkUserAgent = "Tink/" + tink.Version + " Golang/" + runtime.Version()
 )
 
 // gcpClient represents a client that connects to the GCP KMS backend.
 type gcpClient struct {
 	keyURIPrefix string
-	kms          *cloudkms.Service
+	kms          *kms.KeyManagementClient
 }
 
 var _ registry.KMSClient = (*gcpClient)(nil)
@@ -57,14 +57,14 @@ func NewClientWithOptions(ctx context.Context, uriPrefix string, opts ...option.
 	}
 
 	opts = append(opts, option.WithUserAgent(tinkUserAgent))
-	kmsService, err := cloudkms.NewService(ctx, opts...)
+	client, err := kms.NewKeyManagementClient(ctx, opts...)
 	if err != nil {
 		return nil, err
 	}
 
 	return &gcpClient{
 		keyURIPrefix: uriPrefix,
-		kms:          kmsService,
+		kms:          client,
 	}, nil
 }