Class CryptoKeyVersion (3.1.0) 

CryptoKeyVersion(mapping=None, *, ignore_unknown_fields=False, **kwargs)

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Attributes
Name Description
name str
Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.
state google.cloud.kms_v1.types.CryptoKeyVersion.CryptoKeyVersionState
The current state of the CryptoKeyVersion.
protection_level google.cloud.kms_v1.types.ProtectionLevel
Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
algorithm google.cloud.kms_v1.types.CryptoKeyVersion.CryptoKeyVersionAlgorithm
Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
attestation google.cloud.kms_v1.types.KeyOperationAttestation
Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.
create_time google.protobuf.timestamp_pb2.Timestamp
Output only. The time at which this CryptoKeyVersion was created.
generate_time google.protobuf.timestamp_pb2.Timestamp
Output only. The time this CryptoKeyVersion's key material was generated.
destroy_time google.protobuf.timestamp_pb2.Timestamp
Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.
destroy_event_time google.protobuf.timestamp_pb2.Timestamp
Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.
import_job str
Output only. The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported.
import_time google.protobuf.timestamp_pb2.Timestamp
Output only. The time at which this CryptoKeyVersion's key material was most recently imported.
import_failure_reason str
Output only. The root cause of the most recent import failure. Only present if state is IMPORT_FAILED.
generation_failure_reason str
Output only. The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED.
external_destruction_failure_reason str
Output only. The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED.
external_protection_level_options google.cloud.kms_v1.types.ExternalProtectionLevelOptions
ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
reimport_eligible bool
Output only. Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version.

Classes

CryptoKeyVersionAlgorithm

CryptoKeyVersionAlgorithm(value)

The algorithm of the CryptoKeyVersion, indicating what parameters must be used for each cryptographic operation.

The GOOGLE_SYMMETRIC_ENCRYPTION algorithm is usable with CryptoKey.purpose ENCRYPT_DECRYPT.

Algorithms beginning with RSA_SIGN_ are usable with CryptoKey.purpose ASYMMETRIC_SIGN.

The fields in the name after RSA_SIGN_ correspond to the following parameters: padding algorithm, modulus bit length, and digest algorithm.

For PSS, the salt length used is equal to the length of digest algorithm. For example, RSA_SIGN_PSS_2048_SHA256 will use PSS with a salt length of 256 bits or 32 bytes.

Algorithms beginning with RSA_DECRYPT_ are usable with CryptoKey.purpose ASYMMETRIC_DECRYPT.

The fields in the name after RSA_DECRYPT_ correspond to the following parameters: padding algorithm, modulus bit length, and digest algorithm.

Algorithms beginning with EC_SIGN_ are usable with CryptoKey.purpose ASYMMETRIC_SIGN.

The fields in the name after EC_SIGN_ correspond to the following parameters: elliptic curve, digest algorithm.

Algorithms beginning with HMAC_ are usable with CryptoKey.purpose MAC.

The suffix following HMAC_ corresponds to the hash algorithm being used (eg. SHA256).

For more information, see Key purposes and algorithms.

CryptoKeyVersionState

CryptoKeyVersionState(value)

The state of a CryptoKeyVersion, indicating if it can be used.

CryptoKeyVersionView

CryptoKeyVersionView(value)

A view for CryptoKeyVersions. Controls the level of detail returned for CryptoKeyVersions in KeyManagementService.ListCryptoKeyVersions and KeyManagementService.ListCryptoKeys.