Tink setup

You can build Tink from source or use language-specific packages. The following instructions get you started.

After you've finished installing and setting up Tink, continue with the Next Steps at the end of this page.

C++

Tink provides the following C++ libraries:

Tink C++ (tink-cc)

Tink C++ depends on:

Tink C++ supports:

  • C++ >= 14
  • OS:
    • UbuntuLTS >= 20.04 (x86_64)
    • macOS >= 12.5 Monterey (x86_64)
    • Windows Server >= 2019 (x86_64)
  • Compiler:
    • GCC >= 7.5.0
    • Apple Clang >= 14
    • MSVC >= 2019
  • Build system:

CMake

You should add tink-cc as an in-tree dependency. For example:

cmake_minimum_required(VERSION 3.13)
project(YourProject CXX)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_STANDARD 14)
include(FetchContent)

# Import Tink as an in-tree dependency.
FetchContent_Declare(
  tink
  URL       https://github.com/tink-crypto/tink-cc/archive/refs/tags/v2.3.0.zip
  URL_HASH  SHA256=363ce671ab5ce0b24f279d3647185597a25f407c3608db007315f79f151f436b
)
FetchContent_GetProperties(tink)
if(NOT googletest_POPULATED)
  FetchContent_Populate(tink)
    add_subdirectory(${tink_SOURCE_DIR} ${tink_BINARY_DIR} EXCLUDE_FROM_ALL)
endif()

add_executable(your_app your_app.cc)
target_link_libraries(your_app tink::static)

Bazel

Bzlmod

If you use Bazel with modules add the following in your MODULE.bazel file:

bazel_dep(name = "tink_cc", version = "2.3.0")

WORKSPACE

If you use Bazel with WORKSPACE files add the following in your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_cc",
    urls = ["https://github.com/tink-crypto/tink-cc/archive/refs/tags/v2.3.0.zip"],
    strip_prefix = "tink-2.3.0",
    sha256 = "363ce671ab5ce0b24f279d3647185597a25f407c3608db007315f79f151f436b",
)

load("@tink_cc//:tink_cc_deps.bzl", "tink_cc_deps")

tink_cc_deps()

load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")

tink_cc_deps_init()

Tink C++ AWS KMS extension (tink-cc-awskms)

Tink C++ Google Cloud KMS depends on:

Tink C++ AWS KMS supports:

  • C++ >= 14
  • OS:
    • UbuntuLTS >= 20.04 (x86_64)
    • macOS >= 12.5 Monterey (x86_64)
  • Compiler:
    • GCC >= 7.5.0
    • Apple Clang >= 14
  • Build system:

Bazel

You should add the following to you project's WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_cc",
    urls = ["https://github.com/tink-crypto/tink-cc/archive/refs/tags/v2.3.0.zip"],
    strip_prefix = "tink-2.3.0",
    sha256 = "363ce671ab5ce0b24f279d3647185597a25f407c3608db007315f79f151f436b",
)

load("@tink_cc//:tink_cc_deps.bzl", "tink_cc_deps")

tink_cc_deps()

load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")

tink_cc_deps_init()

http_archive(
    name = "tink_cc_awskms",
    urls = ["https://github.com/tink-crypto/tink-cc-awskms/archive/refs/tags/v2.0.1.zip"],
    strip_prefix = "tink-cc-awskms-2.0.1",
    sha256 = "366319b269f62af120ee312ce4c99ce3738ceb23ce3f9491b4859432f8b991a4",
)

load("@tink_cc_awskms//:tink_cc_awskms_deps.bzl", "tink_cc_awskms_deps")

tink_cc_awskms_deps()

Tink C++ Google Cloud KMS extension (tink-cc-gcpkms)

Tink C++ Google Cloud KMS depends on:

Tink C++ Google Cloud KMS supports:

  • C++ >= 14
  • OS:
    • UbuntuLTS >= 20.04 (x86_64)
    • macOS >= 12.5 Monterey (x86_64)
  • Compiler:
    • GCC >= 7.5.0
    • Apple Clang >= 14
  • Build system:

Bazel

You should add the following to you project's WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_cc_gcpkms",
    urls = ["https://github.com/tink-crypto/tink-cc-gcpkms/releases/download/v2.3.0/tink-cc-gcpkms-2.3.0.zip"],
    strip_prefix = "tink-cc-gcpkms-2.3.0",
    sha256 = "5af0d0a502afc346bbaa40f226e8f3b28fe3f5def696cbaaa7bc13702af78901",
)

load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps.bzl", "tink_cc_gcpkms_deps")

tink_cc_gcpkms_deps()

load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps_init.bzl", "tink_cc_gcpkms_deps_init")

tink_cc_gcpkms_deps_init(register_go = True)

Go

Tink provides the following Go libraries:

All the Tink Go libraries are published as Go modules that can be used with standard Go tooling or Bazel.

Tink Go (tink-go)

Go tooling

Running the following command from you project directory:

go get github.com/tink-crypto/tink-go/v2@v2.2.0

See the official Go documentation.

Tink Go AWS KMS extension (tink-go-awskms)

Go tooling

Run the following command from you project directory:

go get github.com/tink-crypto/tink-go-awskms/v2@2.1.0

See the official Go documentation.

Tink Go Google Cloud KMS extension (tink-go-gcpkms)

Go tooling

Run the following command from you project directory:

go get github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0

See the official Go documentation.

Tink Go HashiCorp Vault extension (tink-go-hcvault)

Go tooling

Run the following command from you project directory:

go get github.com/tink-crypto/tink-go-hcvault/v2@v2.2.0

See the official Go documentation.

Java

Set up Tink Java and extensions

ObjC

See the HOWTO on GitHub

Python

The Tink Python library, tink-py supports Python 3.8 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and ARM64) and Windows (x86-64). The latest release is 1.10.0. It can be installed locally using Pip or used with Bazel.

Tink Python provides integrations with AWS KMS, Google Cloud KMS and HashiCorp Vault.

Pip

You can install the Tink Python binary release for your system from PyPI, by running the following command:

pip3 install tink==1.10.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.10.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.10.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.10.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.10.0

If a binary package is not published for your environment, pip automatically resorts to building the project using the source distribution published to PyPI. If this is the case, you need Bazel or Bazelisk and the protobuf compiler installed to successfully build the project.

Bazel

Bazel users can include Tink Python in their WORKSPACE file as follows:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_py",
    urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.10.0/tink-py-1.10.0.zip"],
    strip_prefix = "tink-py-1.10.0",
    sha256 = "767453aae4aad6de4fbb4162992184aa427b7b27864fe9912c270b24c673e1cc",
)

load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")
tink_py_deps()

load("@rules_python//python:repositories.bzl", "py_repositories")
py_repositories()

load("@tink_py//:tink_py_deps_init.bzl", "tink_py_deps_init")
tink_py_deps_init("tink_py")

Next steps

Once you've finished setting up Tink, continue with the standard Tink usage steps:

  • Choose a primitive – Decide which primitive to use based on your use case
  • Manage keys – Protect your keys with your external KMS, generate keysets, and rotate your keys