# Resource key hash

The resource key hash is a mechanism allowing Google to verify the integrity of
the wrapped encryption keys without having access to the keys.

Generating the resource key hash requires access to the unwrapped key including
the DEK, the `resource_name` and the `perimeter_id` specified during the key
wrapping operation.

We use the cryptographic function HMAC-SHA256 with `unwrapped_dek` as a key and
the concatenation of metadata as data
`("ResourceKeyDigest:", resource_name, ":", perimeter_id)`.
The `resource_name` and `perimeter_id` should be UTF-8 encoded strings.

For example, when `resource_name = "my_resource"`,
`perimeter_id = "my_perimeter"` and `unwrapped_dek = 0xf00d`, the resource key
hash is:

    echo -n "ResourceKeyDigest:my_resource:my_perimeter" | openssl sha256 -mac HMAC -macopt hexkey:f00d -binary