資源索引鍵雜湊
資源金鑰雜湊是一種機制，可讓 Google 驗證
取得金鑰存取權，即使無法存取金鑰。
產生資源金鑰雜湊需要存取未包裝的金鑰，包括
DEK、金鑰期間指定的 resource_name 和 perimeter_id
包裝作業
我們使用加密編譯函式 HMAC-SHA256，搭配 unwrapped_dek 做為金鑰，
將中繼資料串連為資料
("ResourceKeyDigest:", resource_name, ":", perimeter_id)。
resource_name 和 perimeter_id 應為 UTF-8 編碼字串。
例如，在 resource_name = "my_resource" 時
perimeter_id = "my_perimeter" 和 unwrapped_dek = 0xf00d，資源金鑰
雜湊是：
echo -n "ResourceKeyDigest:my_resource:my_perimeter" | openssl sha256 -mac HMAC -macopt hexkey:f00d -binary
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2024-08-22 (世界標準時間)。
[null,null,["上次更新時間：2024-08-22 (世界標準時間)。"],[[["The resource key hash ensures Google can verify the integrity of wrapped encryption keys without needing access to the actual keys."],["Generating the hash requires the unwrapped key, resource name, and perimeter ID used during key wrapping."],["It utilizes HMAC-SHA256, using the unwrapped key as the key and a concatenation of resource details as data for the hash calculation."],["The resource name and perimeter ID need to be UTF-8 encoded strings for the hash generation."]]],["The core mechanism is generating a resource key hash to verify wrapped encryption key integrity. This involves using HMAC-SHA256 with the unwrapped DEK as the key and a specific concatenation of metadata as data. The metadata consists of \"ResourceKeyDigest:\", the UTF-8 encoded `resource_name`, \":\", and the UTF-8 encoded `perimeter_id`. An example shows generating the hash using `openssl` with a sample `resource_name`, `perimeter_id`, and `unwrapped_dek`.\n"]]
