많은 암호화 라이브러리에서 키는 일부 바이트 시퀀스만으로 식별되는 경우가 많습니다. 예를 들어 키 바이트를 제외하고 계산에 IV도 필요한 EVP_EncryptInit_ex와 같은 OpenSSL 함수 또는 키 시퀀스와 AlgorithmParameterSpec를 모두 사용하는 javax.crypto 메서드 Cipher.init를 고려해 보세요. 이러한 함수는 올바르게 사용하기 어렵고 잘못된 매개변수를 전달하면 심각한 결과를 초래할 수 있습니다.
Tink는 다르게 하려는 목표를 가지고 있으며 키가 항상 키 자료와 메타데이터 (매개변수)로 구성되기를 기대합니다.
예를 들어 전체 AEAD 키는 암호화 및 복호화의 작동 방식을 정확하게 지정합니다. 즉, 두 함수 \(\mathrm{Enc}\) 및\(\mathrm{Dec}\)와 암호문이 인코딩되는 방식 (예: 초기화 벡터, 암호화, 태그)을 지정합니다.
Tink의 AES 키는 길이가 128, 192 또는 256비트인 바이트 시퀀스일 뿐만 아니라 키를 계산하는 데 필요한 해당 알고리즘 사양을 parameters 객체의 형태로 저장합니다. 따라서 전체 AES-EAX 키와 전체 AES-GCM 키는 Tink에서 서로 다른 객체입니다.
[null,null,["최종 업데이트: 2025-07-25(UTC)"],[[["\u003cp\u003eIn Tink, a Key is a cryptographic object encompassing both key material and metadata, ensuring clear and complete functionality specification.\u003c/p\u003e\n"],["\u003cp\u003eUnlike traditional libraries, Tink Keys include necessary parameters like IV and algorithm specifications, simplifying usage and mitigating potential errors.\u003c/p\u003e\n"],["\u003cp\u003eTink Keys fully define cryptographic operations, including encryption, decryption, and ciphertext encoding, as exemplified by AEAD keys.\u003c/p\u003e\n"],["\u003cp\u003eDifferent key types with distinct algorithm specifications, like AES-EAX and AES-GCM, are treated as separate objects within Tink.\u003c/p\u003e\n"],["\u003cp\u003eTink incorporates Keys into Keysets, enabling key rotation and enhanced security practices.\u003c/p\u003e\n"]]],["Tink's **Key** includes both key material and metadata, defining its functionality. Unlike other libraries that only use byte sequences, Tink requires complete parameter specifications. A full AEAD key defines encryption and decryption processes, along with ciphertext encoding. AES keys in Tink include algorithm specifications, making different AES types distinct objects. Keys in Tink exist as parts of a set of keys called a Keyset, allowing key rotation.\n"],null,["# Keys\n\n| In Tink, a **Key** describes a complete cryptographic object, and consists of the key material plus all necessary metadata which describes its functionality.\n\nIn many cryptographic libraries, keys are often identified by only some byte\nsequences. Consider for example OpenSSL functions such as `EVP_EncryptInit_ex`,\nwhich apart from the key bytes, also needs the IV for computation; or the\njavax.crypto method `Cipher.init`, which takes both a key sequence and an\n`AlgorithmParameterSpec`. Such functions are often difficult to use correctly\nand passing the wrong parameters can have serious consequences.\n\nTink aims to be different, and expects a key to always consist of both the key\nmaterial and the metadata (the parameters).\n\nA full AEAD key for example specifies in exact detail how encryption and\ndecryption works - it specifies the two functions \\\\(\\\\mathrm{Enc}\\\\) and\n\\\\(\\\\mathrm{Dec}\\\\), and how the ciphertext is encoded (e.g. initialization vector,\nfollowed by the encryption, followed by the tag).\n\nAn AES key in Tink is not only a byte sequence of length 128, 192 or 256 bits,\nbut it also stores the corresponding algorithm specifications needed to compute\nthe key, in the form of a [parameters](/tink/design/parameters) object. Hence, a\nfull AES-EAX key and a full AES-GCM key are different objects in Tink.\n| **Note:** In Tink, keys are part of a [keyset](/tink/design/keysets) - a set of keys which implement the same primitive, which facilitates key rotation."]]
