Resource key hash
The resource key hash is a mechanism allowing Google to verify the integrity of
the wrapped encryption keys without having access to the keys.
Generating the resource key hash requires access to the unwrapped key including
the DEK, the resource_name and the perimeter_id specified during the key
wrapping operation.
We use the cryptographic function HMAC-SHA256 with unwrapped_dek as a key and
the concatenation of metadata as data
("ResourceKeyDigest:", resource_name, ":", perimeter_id).
The resource_name and perimeter_id should be UTF-8 encoded strings.
For example, when resource_name = "my_resource",
perimeter_id = "my_perimeter" and unwrapped_dek = 0xf00d, the resource key
hash is:
echo -n "ResourceKeyDigest:my_resource:my_perimeter" | openssl sha256 -mac HMAC -macopt hexkey:f00d -binary
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-11-14 UTC.
[null,null,["Last updated 2024-11-14 UTC."],[[["The resource key hash ensures Google can verify the integrity of wrapped encryption keys without needing access to the actual keys."],["Generating the hash requires the unwrapped key, resource name, and perimeter ID used during key wrapping."],["It utilizes HMAC-SHA256, using the unwrapped key as the key and a concatenation of resource details as data for the hash calculation."],["The resource name and perimeter ID need to be UTF-8 encoded strings for the hash generation."]]],[]]
