tink
tink copied to clipboard
tink-crypto
support for azure key vault
Hi, are there plans for supporting Azure in addition to GCP and AWS KMS?
It's not high priority at the moment, but if you can contribute we'll help review your code.
Yes, absolutely.
On Tue, Mar 26, 2019 at 1:08 AM 99M8 [email protected] wrote:
Great. Then I would love to take it on. Is it ok, @thaidn https://github.com/thaidn ?
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/google/tink/issues/158#issuecomment-476516426, or mute the thread https://github.com/notifications/unsubscribe-auth/AAAdbPk0-a02qRud3qELOrOYNV0EPZ-Iks5vadV8gaJpZM4YefRa .
-- https://vnhacker.blogspot.com
Closing for now, as we don't have resources to work on it, but potential contributors are encouraged to re-open.
Hey @thaidn, Is anyone working on this? I would like to contribute here (for go, maybe java as well).
This looks pretty easy, but - Azure key vault doesn't support symmetric keys so the implementation would need to use an asymmetric RSA key (RSA-OAEP-256). The interface in aead.go accepts AAD, but it isn't passed when encrypting DEKs with the remote KMS (code.
Anyone willing to weigh in?
Over the years we found several reason to redesign our KMS integration. I will leave this open for now though -- but we should first do the redesign.
Thanks Thomas. If the reasons are written down somewhere, I'd be curious to see them for my own understanding.
My two cents - without Azure support, there's a whole swatch of multi-cloud users that won't adopt Tink.
Hi, did the redesign happen? If not, are you still open to accept Azure Key Vault integration with the current design?
We don't plan this and I will close this. The issue is that maintaining these integrations is not trivial. Furthermore, an implementation can be done by anyone (not just us) in a separate repository.