You can build Tink from source or use language-specific packages. The following instructions get you started.
After you've finished installing and setting up Tink, continue with the Next Steps at the end of this page.
C++
Tink provides the following C++ libraries:
- A core C++ library, tink-cc. The latest release is 2.3.0
- A AWS KMS extension, tink-cc-awskms The latest release is 2.0.1.
- A Google Cloud KMS extension, tink-cc-gcpkms. The latest release is 2.2.0.
Tink C++ (tink-cc)
Tink C++ depends on:
- Protobuf 26.1
- Abseil LTS 20230802.0
- BoringSSL or OpenSSL >=1.1.1
- RapidJSON 1.1.0
- googletest 1.14.0 (test only)
- Wycheproof (test only)
Tink C++ supports:
- C++ >= 14
- OS:
- UbuntuLTS >= 20.04 (x86_64)
- macOS >= 12.5 Monterey (x86_64)
- Windows Server >= 2019 (x86_64)
- Compiler:
- GCC >= 7.5.0
- Apple Clang >= 14
- MSVC >= 2019
- Build system:
CMake
You should add tink-cc
as an in-tree dependency. For example:
cmake_minimum_required(VERSION 3.13)
project(YourProject CXX)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_STANDARD 14)
include(FetchContent)
# Import Tink as an in-tree dependency.
FetchContent_Declare(
tink
URL https://github.com/tink-crypto/tink-cc/archive/refs/tags/v2.3.0.zip
URL_HASH SHA256=363ce671ab5ce0b24f279d3647185597a25f407c3608db007315f79f151f436b
)
FetchContent_GetProperties(tink)
if(NOT googletest_POPULATED)
FetchContent_Populate(tink)
add_subdirectory(${tink_SOURCE_DIR} ${tink_BINARY_DIR} EXCLUDE_FROM_ALL)
endif()
add_executable(your_app your_app.cc)
target_link_libraries(your_app tink::static)
Bazel
Bzlmod
If you use Bazel with modules add
the following in your MODULE.bazel
file:
bazel_dep(name = "tink_cc", version = "2.3.0")
WORKSPACE
If you use Bazel with WORKSPACE
files add the following in your
WORKSPACE
file:
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "tink_cc",
urls = ["https://github.com/tink-crypto/tink-cc/archive/refs/tags/v2.3.0.zip"],
strip_prefix = "tink-2.3.0",
sha256 = "363ce671ab5ce0b24f279d3647185597a25f407c3608db007315f79f151f436b",
)
load("@tink_cc//:tink_cc_deps.bzl", "tink_cc_deps")
tink_cc_deps()
load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")
tink_cc_deps_init()
Tink C++ AWS KMS extension (tink-cc-awskms)
Tink C++ Google Cloud KMS depends on:
- Tink C++ 2.1.0
- AWS C++ SDK 1.7.345
- googletest 1.11.0 (test only)
Tink C++ AWS KMS supports:
- C++ >= 14
- OS:
- UbuntuLTS >= 20.04 (x86_64)
- macOS >= 12.5 Monterey (x86_64)
- Compiler:
- GCC >= 7.5.0
- Apple Clang >= 14
- Build system:
- Bazel >= 6 LTS
Bazel
You should add the following to you project's WORKSPACE
file:
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "tink_cc",
urls = ["https://github.com/tink-crypto/tink-cc/archive/refs/tags/v2.3.0.zip"],
strip_prefix = "tink-2.3.0",
sha256 = "363ce671ab5ce0b24f279d3647185597a25f407c3608db007315f79f151f436b",
)
load("@tink_cc//:tink_cc_deps.bzl", "tink_cc_deps")
tink_cc_deps()
load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")
tink_cc_deps_init()
http_archive(
name = "tink_cc_awskms",
urls = ["https://github.com/tink-crypto/tink-cc-awskms/archive/refs/tags/v2.0.1.zip"],
strip_prefix = "tink-cc-awskms-2.0.1",
sha256 = "366319b269f62af120ee312ce4c99ce3738ceb23ce3f9491b4859432f8b991a4",
)
load("@tink_cc_awskms//:tink_cc_awskms_deps.bzl", "tink_cc_awskms_deps")
tink_cc_awskms_deps()
Tink C++ Google Cloud KMS extension (tink-cc-gcpkms)
Tink C++ Google Cloud KMS depends on:
Tink C++ Google Cloud KMS supports:
- C++ >= 14
- OS:
- UbuntuLTS >= 20.04 (x86_64)
- macOS >= 12.5 Monterey (x86_64)
- Compiler:
- GCC >= 7.5.0
- Apple Clang >= 14
- Build system:
- Bazel >= 6 LTS
Bazel
You should add the following to you project's WORKSPACE
file:
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "tink_cc_gcpkms",
urls = ["https://github.com/tink-crypto/tink-cc-gcpkms/releases/download/v2.2.0/tink-cc-gcpkms-2.2.0.zip"],
strip_prefix = "tink-cc-gcpkms-2.2.0",
sha256 = "ffb9d05c64ca28b5eb54fe79e7c3f93fad68f00e45f74f6b9ce1bd3a32b3d6fd",
)
load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps.bzl", "tink_cc_gcpkms_deps")
tink_cc_gcpkms_deps()
load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps_init.bzl", "tink_cc_gcpkms_deps_init")
tink_cc_gcpkms_deps_init(register_go = True)
Go
Tink provides the following Go libraries:
- A core Tink library, tink-go. The latest release is v2.2.0
- A AWS KMS extension, tink-go-awskms The latest release is 2.1.0.
- A Google Cloud KMS extension, tink-go-gcpkms. The latest release is 2.2.0.
- A HashiCorp Vault extension, tink-go-hcvault. The latest release is 2.2.0.
All the Tink Go libraries are published as Go modules that can be used with standard Go tooling or Bazel.
Tink Go (tink-go)
Go tooling
Running the following command from you project directory:
go get github.com/tink-crypto/tink-go/v2@v2.2.0
See the official Go documentation.
Tink Go AWS KMS extension (tink-go-awskms)
Go tooling
Run the following command from you project directory:
go get github.com/tink-crypto/tink-go-awskms/v2@2.1.0
See the official Go documentation.
Tink Go Google Cloud KMS extension (tink-go-gcpkms)
Go tooling
Run the following command from you project directory:
go get github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0
See the official Go documentation.
Tink Go HashiCorp Vault extension (tink-go-hcvault)
Go tooling
Run the following command from you project directory:
go get github.com/tink-crypto/tink-go-hcvault/v2@v2.2.0
See the official Go documentation.
Java
Tink provides the following Java libraries:
- A core Java and Android library, tink-java The latest release is 1.15.0
- A AWS KMS extension, tink-java-awskms The latest release is 1.10.1.
- A Google Cloud KMS extension, tink-java-gcpkms. The latest release is 1.10.0
- A library, tink-java-apps that provides implementations for Google Payment Method Token, Server-Side Verification of Google AdMob Rewarded Ads, and RFC 8291 - Message Encryption for Web Push. The latest release is 1.11.0.
The Java version of Tink supports Java 8 or newer. You can either include the Tink Java Maven artifacts within your Maven or Gradle project, or use Bazel.
Tink Android is fully supported starting from API level 24. Most parts of Tink are expected to work starting from API level 21. The parts where Tink does not run out of the box with API level 21 are:
- The JWT library requires API level 24 since it uses classes such as
java.util.Optional
. This limitation can be avoided with desugaring. - The classes in
com.google.crypto.tink.integration.android
are only fully tested starting from API level 23. - Some APIs in
com.google.crypto.tink.streamingaead
useSeekableByteBufferChannel
which is only available from API level 24.
We note that due to technical reasons we only test Tink on Android on Google internal infrastructure. We don't expect any problems because of this, but if you encounter any problems please file an issue.
Tink Android requires no proguard configuration.
Tink Java (tink-java)
Maven
You can include Tink Java and the Tink Android library using Maven:
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>tink</artifactId>
<version>1.15.0</version>
</dependency>
If you are targeting Android, you can use tink-android
from
Gradle using:
dependencies {
implementation 'com.google.crypto.tink:tink-android:1.15.0'
}
Bazel
The recommended way Bazel users can add
Tink Java as a dependency is by installing the Maven release artifact using
the rules_jvm_external
tool in their WORKSPACE
file:
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
RULES_JVM_EXTERNAL_TAG = "6.1"
RULES_JVM_EXTERNAL_SHA ="d31e369b854322ca5098ea12c69d7175ded971435e55c18dd9dd5f29cc5249ac"
http_archive(
name = "rules_jvm_external",
strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
sha256 = RULES_JVM_EXTERNAL_SHA,
url = "https://github.com/bazelbuild/rules_jvm_external/releases/download/%s/rules_jvm_external-%s.tar.gz" % (RULES_JVM_EXTERNAL_TAG, RULES_JVM_EXTERNAL_TAG)
)
load("@rules_jvm_external//:repositories.bzl", "rules_jvm_external_deps")
rules_jvm_external_deps()
load("@rules_jvm_external//:setup.bzl", "rules_jvm_external_setup")
rules_jvm_external_setup()
load("@rules_jvm_external//:defs.bzl", "maven_install")
maven_install(
artifacts = [
"com.google.crypto.tink:tink:1.15.0",
# ... other dependencies ...
],
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
If you want to build tink-java
from source, for example to pin a specific
commit, you can include it as an http_archive
in your WORKSPACE
file:
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
TINK_COMMIT="f4127f6b6ab9c367d41ade1f50db6f0ef9909044"
TINK_SHA256="e246f848f7749e37f558955ecb50345b04d79ddb9d8d1e8ae19f61e8de530582"
http_archive(
name = "tink_java",
urls = ["https://github.com/tink-crypto/tink-java/archive/%s.zip" % TINK_COMMIT],
strip_prefix = "tink-%s" % TINK_COMMIT,
sha256 = TINK_SHA256
)
load("@tink_java//:tink_java_deps.bzl", "TINK_MAVEN_ARTIFACTS", "tink_java_deps")
tink_java_deps()
load("@tink_java//:tink_java_deps_init.bzl", "tink_java_deps_init")
tink_java_deps_init()
# rules_jvm_external is imported and initialized by tink_java_deps and
# tink_java_deps_init.
load("@rules_jvm_external//:defs.bzl", "maven_install")
maven_install(
artifacts = TINK_MAVEN_ARTIFACTS + # ... other dependencies ...
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
Tink Java AWS KMS extension (tink-java-awskms)
Maven
You can include Tink Java and the Tink Android library using Maven:
<dependencies>
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>tink-awskms</artifactId>
<version>1.10.1</version>
</dependency>
</dependencies>
Bazel
You can install the com.google.crypto.tink:tink-awskms
Maven artifact
alongside com.google.crypto.tink:tink
using the
rules_jvm_external
tool.
# ...
maven_install(
artifacts = [
"com.google.crypto.tink:tink:1.15.0",
"com.google.crypto.tink:tink-awskms:1.10.1",
# ... other dependencies ...
],
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
Alternatively, you can include it as an http_archive
dependency:
# ...
http_archive(
name = "tink_java",
urls = ["https://github.com/tink-crypto/tink-java/releases/download/v1.15.0/tink-java-1.15.0.zip"],
strip_prefix = "tink-java-1.15.0",
sha256 = "e246f848f7749e37f558955ecb50345b04d79ddb9d8d1e8ae19f61e8de530582",
)
load("@tink_java//:tink_java_deps.bzl", "TINK_MAVEN_ARTIFACTS", "tink_java_deps")
tink_java_deps()
load("@tink_java//:tink_java_deps_init.bzl", "tink_java_deps_init")
tink_java_deps_init()
http_archive(
name = "tink_java_awskms",
urls = ["https://github.com/tink-crypto/tink-java-awskms/releases/download/v1.10.1/tink-java-awskms-1.10.1.zip"],
strip_prefix = "tink-java-awskms-1.10.1",
sha256 = "5f08f3a343fb2028784ee2344e102cf4f753b4d23252318b3f8ac48208d3e2fa",
)
load("@tink_java_awskms//:tink_java_awskms_deps.bzl", "TINK_JAVA_AWSKMS_MAVEN_ARTIFACTS")
maven_install(
artifacts = TINK_MAVEN_ARTIFACTS + TINK_JAVA_AWSKMS_MAVEN_ARTIFACTS + [
# ... other dependencies ...
],
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
Tink Java Google Cloud KMS extension (tink-java-gcpkms)
Maven
<dependencies>
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>tink-gcpkms</artifactId>
<version>1.10.0/version>
</dependency>
</dependencies>
Bazel
You can install the com.google.crypto.tink:tink-gcpkms
Maven artifact
alongside com.google.crypto.tink:tink
using the
rules_jvm_external
tool.
# ...
maven_install(
artifacts = [
"com.google.crypto.tink:tink:1.15.0",
"com.google.crypto.tink:tink-gcpkms:1.10.0",
# ... other dependencies ...
],
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
Alternatively, you can include it as an http_archive
dependency:
# ...
http_archive(
name = "tink_java",
urls = ["https://github.com/tink-crypto/tink-java/releases/download/v1.15.0/tink-java-1.15.0.zip"],
strip_prefix = "tink-java-1.15.0",
sha256 = "e246f848f7749e37f558955ecb50345b04d79ddb9d8d1e8ae19f61e8de530582",
)
load("@tink_java//:tink_java_deps.bzl", "TINK_MAVEN_ARTIFACTS", "tink_java_deps")
tink_java_deps()
load("@tink_java//:tink_java_deps_init.bzl", "tink_java_deps_init")
tink_java_deps_init()
http_archive(
name = "tink_java_gcpkms",
urls = ["https://github.com/tink-crypto/tink-java-gcpkms/releases/download/v1.10.0/tink-java-gcpkms-1.10.0.zip"],
strip_prefix = "tink-java-gcpkms-1.10.0",
sha256 = "ad85625cc4409f2f6ab13a8eef39c965501585e9323d59652cce322b3d2c09a2",
)
load("@tink_java_gcpkms//:tink_java_gcpkms_deps.bzl", "TINK_JAVA_GCPKMS_MAVEN_ARTIFACTS")
maven_install(
artifacts = TINK_MAVEN_ARTIFACTS + TINK_JAVA_GCPKMS_MAVEN_ARTIFACTS + [
# ... other dependencies ...
],
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
Tink Java Apps extensions (tink-java-apps)
Maven
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>apps-webpush</artifactId>
<version>1.11.0</version>
</dependency>
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>apps-paymentmethodtoken</artifactId>
<version>1.11.0</version>
</dependency>
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>apps-rewardedads</artifactId>
<version>1.11.0</version>
</dependency>
Bazel
You can install any of the com.google.crypto.tink:apps-*
Maven artifacts
using the rules_jvm_external
tool.
# ...
maven_install(
artifacts = [
"com.google.crypto.tink:apps-webpush:1.11.0",
"com.google.crypto.tink:apps-paymentmethodtoken:1.11.0",
"com.google.crypto.tink:apps-rewardedads:1.11.0",
# ... other dependencies ...
],
repositories = [
"https://maven.google.com",
"https://repo1.maven.org/maven2",
],
)
ObjC
See the HOWTO on GitHub
Python
The Tink Python library, tink-py supports Python 3.8 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and ARM64) and Windows (x86-64). The latest release is 1.10.0. It can be installed locally using Pip or used with Bazel.
Tink Python provides integrations with AWS KMS, Google Cloud KMS and HashiCorp Vault.
Pip
You can install the Tink Python binary release for your system from PyPI, by running the following command:
pip3 install tink==1.10.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.10.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.10.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.10.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.10.0
If a binary package is not published for your environment, pip
automatically resorts to building the project using the source distribution
published to PyPI. If this is the case, you need Bazel
or Bazelisk and the protobuf
compiler installed to successfully build the project.
Bazel
Bazel users can include Tink Python in their
WORKSPACE
file as follows:
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "tink_py",
urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.10.0/tink-py-1.10.0.zip"],
strip_prefix = "tink-py-1.10.0",
sha256 = "767453aae4aad6de4fbb4162992184aa427b7b27864fe9912c270b24c673e1cc",
)
load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")
tink_py_deps()
load("@rules_python//python:repositories.bzl", "py_repositories")
py_repositories()
load("@tink_py//:tink_py_deps_init.bzl", "tink_py_deps_init")
tink_py_deps_init("tink_py")
Next steps
Once you've finished setting up Tink, continue with the standard Tink usage steps:
- Choose a primitive – Decide which primitive to use based on your use case
- Manage keys – Protect your keys with your external KMS, generate keysets, and rotate your keys