Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Google Cloud Resources

Google Cloud Keys

search

Google Cloud Keys

This section describes how to manage Google Cloud keys on CCKM. Before proceeding, you must have a Google Cloud key ring added to the CCKM. Refer to Google Cloud Key Rings for details.

Key Types

CCKM supports two types of Google Cloud keys:

  • Symmetric: A randomly generated key is used to encrypt and decrypt the data.

  • Asymmetric: A public and private RSA key pair is used to encrypt and decrypt the data. The public key encrypts while the private key decrypts the data.

Key Creation Methods and Sources

Methods to create Google Cloud keys using CCKM are:

  • Creating/Uploading New Key Material: Add key material by creating and uploading new source key or creating new native key. The key source can be:

    • CipherTrust (Local): A new key is first created on the CipherTrust Manager. Then, this key material is uploaded to Google Cloud to create a new Google Cloud key. As the key material is uploaded from the CipherTrust Manager, the key origin is CCKM.

    • Google (Native): A new key is directly created on Google Cloud using the native Google application. The key origin is NATIVE.

  • Cloning Existing Key Material: Clone key material from an existing key to create a new key. The key source can be:

    • CipherTrust (Local): An existing local CipherTrust Manager key is first cloned on the CipherTrust Manager. Then, the cloned key material is uploaded to Google Cloud to create a new Google Cloud key. As the key material is uploaded from the CipherTrust Manager, the key origin is CCKM.

Creating/Uploading New Key Material

To add a Google Cloud key by creating/uploading new key material:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click Add Key. The Select Material Origin screen of the Add Google Key wizard is displayed.

  4. Under Select Method, select Create/Upload New Key Material. The Select Source section appears. Depending on your requirements, select from the following:

    Refer to Key Creation Methods and Sources for details on key sources.

Uploading CipherTrust (Local) Key Material

Upload the local key material using the CipherTrust Manager to configure the source key.

Select Material Origin > Select Source

  1. Select CipherTrust (Local).

  2. Click Next. The Configure CipherTrust (Local) Key screen is displayed.

Configure CipherTrust (Local) Key

  1. Select Key Type. The options are Symmetric and Asymmetric.

    • Symmetric: Creates and uploads a symmetric key.

    • Asymmetric: Creates and uploads an asymmetric key. Additional fields Algorithm and Key Size are displayed.

  2. Enter a Key Name. A new key with this name will be created on the CipherTrust Manager and its key material will be uploaded to Google Cloud.

  3. (Applicable to Asymmetric keys) Select the Algorithm. The options are RSA and EC.

  4. (Applicable to Asymmetric keys) Select the Key Size / Key Curve based on the algorithm:

    • For the RSA algorithm, select the Key Size. The options are 2048, 3072, and 4096.

    • For the EC algorithm, select the Key Curve. The options are prime256v1, secp384r1, and secp265k1.

  5. Click Next.

Configure Destination (Google) Key

  1. (Applicable to Asymmetric keys) Select the Key Purpose. A key purpose specifies the operation that the key can be used to perform. Depending on the key algorithm selected on the previous screen, the options are:

    • Decrypt: Enables the key for RSA encryption. This option is not applicable to EC algorithms.

    • Sign: Enables the key for elliptic curve signing and RSA signing.

  2. Enter a user-friendly alias as the Key Name. This will be the key name on Google Cloud. This name helps uniquely identify a Google Cloud key. By default, the Key Name you specified on the previous screen is populated.

    The key name can only contain alphanumeric characters and dashes.

  3. Select the desired Key Ring from the drop-down list.

  4. (Optional, applicable to Symmetric keys) Select Google Automatic Rotation and specify the following:

    1. Select Rotation Period from the drop-down list. This is the time period (in days) after which the key will rotate automatically, after the date specified in Starting on (see below). The options are 30, 90, 180, and 365 days.

      To specify a custom frequency, select Custom and specify the rotation frequency in the Rotate key every (days) field that appears. The default value is 1 day.

    2. Click the Starting on field, and select the key expiration date and time from the on-screen calendar.

      This is the time when the automatic key rotation becomes effective. Next automatic key rotation will happen after the specified Rotation Period.

    For example, if you set Rotation Period as 30 days and set Starting on as today, the key will automatically rotate after 30 days from today.

  5. Select a Protection Level for the key. A protection level specifies how cryptographic operations are performed. The options are:

    • Software: Crypto operations are performed in software.

    • HSM: Crypto operations are performed in an HSM.

  6. (Applicable to Asymmetric keys) Select an Algorithm for the key. The options vary based on the Algorithm, Key Size / Key Curve (selected on the Configure Source Key screen), and key purpose.

  7. (Optional) Enter Tags. A tag is a label assigned to the key that consists of a user-defined key and a value.

    Note

    For Google label requirements, refer to Labeling keys | Cloud KMS Documentation | Google Cloud.

    To add a tag:

    1. Specify a tag name.

    2. Specify the tag value.

    3. Click the + button.

    Similarly, you can add more tags. To remove a tag, click the close (X) icon in the tag name.

  8. Click Next. The Add to Schedule screen is displayed.

Add to Schedule

  1. Select Schedule to Apply. The drop-down list shows the available key rotation schedules.

  2. Select the Key Origin from the available options. The key origin can be:

    • CipherTrust (Local): The local CipherTrust Manager.

    • Native: Native cloud, Google.

  3. Select an Algorithm. For the Native Key Origin, the Algorithm field is unavailable.

  4. Click Next.

The Review and Add Key screen is displayed.

Review and Add

This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, DESTINATION KEY, and KEY SCHEDULES sections.

Before adding the key, review all details. After the key is added, certain features will no longer be editable.

  1. Review the key details displayed on the screen.

    If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY, DESTINATION KEY, and KEY SCHEDULES sections and update details. Alternatively, click Back and make changes, as appropriate.

  2. Click Add Key.

    The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.

    When the status next to the SOURCE KEY, DESTINATION KEY, and KEY SCHEDULES sections becomes Complete and the Key ID links are displayed, the key is created successfully.

  3. Click Close. The Add Google Key wizard is closed.

The newly created key is displayed in the list of Google Cloud keys.

Creating Google (Native) Key Material

Create the key material directly using native Google application.

Select Material Origin > Select Source

  1. Select Google (Native).

  2. Click Next. The Configure Source Key screen is displayed.

Configure Source Key

  1. Select Key Type. The options are:

    • Symmetric: Creates a symmetric key. Additional field Google Automatic Rotation is displayed.

    • Asymmetric: Creates an asymmetric key. Additional fields Select Key Purpose and Algorithm are displayed.

  2. (Applicable to Asymmetric keys) Select Key Purpose. A key purpose specifies the operation that the key can be used to perform. The options are:

    • Decrypt: Enables the key for RSA encryption.

    • Sign: Enables the key for elliptic curve signing and RSA signing.

  3. Enter the Key Name. This name helps uniquely identify a key.

  4. Select the desired Key Ring from the drop-down list.

  5. (Optional, applicable to Symmetric keys) Select Google Automatic Rotation and specify the following:

    1. Select Rotation Period from the drop-down list. This is the time period (in days) after which the key will rotate automatically, after the date specified in Starting on (see below). The options are 30, 90, 180, and 365 days.

      To specify a custom frequency, select Custom and specify the rotation frequency in the Rotate key every (days) field that appears. The default value is 1 day.

    2. Click the Starting on field, and select the key expiration date and time from the on-screen calendar.

      This is the time when the automatic key rotation becomes effective. Next automatic key rotation will happen after the specified Rotation Period.

    For example, if you set Rotation Period as 30 days and set Starting on as today, the key will automatically rotate after 30 days from today.

  6. Select a Protection Level for the key. A protection level specifies how cryptographic operations are performed. The options are:

    • Software: Crypto operations are performed in software.

    • HSM: Crypto operations are performed in an HSM.

  7. (Applicable to Asymmetric keys) Select an Algorithm for the key. The options vary based on the selected key purpose.

  8. (Optional) Enter Tags. A tag is a label assigned to the key that consists of a user-defined key and a value.

    Note

    For Google label requirements, refer to Labeling keys | Cloud KMS Documentation | Google Cloud.

    To add a tag:

    1. Specify a tag name.

    2. Specify the tag value.

    3. Click the + button.

    Similarly, you can add more tags. To remove a tag, click the close (X) icon in the tag name.

  9. Click Next. The Add to Schedule screen is displayed.

Add to Schedule

  1. Select Schedule to Apply. The drop-down list shows the available key rotation schedules.

  2. Select the Key Origin from the available options. The key origin can be:

    • CipherTrust (Local): The local CipherTrust Manager.

    • Native: Native cloud, Google.

  3. Select an Algorithm. For the Native Key Origin, the Algorithm field is unavailable.

  4. Click Next.

The Review and Add Key screen is displayed.

Review and Add

This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, NATIVE KEY, and KEY SCHEDULES sections.

Before adding the key, review all details. After the key is added, certain features will no longer be editable.

  1. Review the key details displayed on the screen.

    If details are incorrect or you want to make any changes, click Edit next to the NATIVE KEY and KEY SCHEDULES sections and update details. Alternatively, click Back and make changes, as appropriate.

  2. Click Add Key.

    The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.

    When the status next to the NATIVE KEY and KEY SCHEDULES sections becomes Complete and the Key ID link is displayed, the key is created successfully.

  3. Click Close. The Add Google Key wizard is closed.

The newly created key is displayed in the list of Google Cloud keys. The origin of the key is NATIVE.

Cloning Existing Key Material

To add a new Google Cloud key by cloning key material existing on the CipherTrust Manager:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click Add Key. The Select Material Origin screen of the Add Google Key wizard is displayed.

  4. Under Select Method, select Clone Existing Key Material. The Select Source section appears. Depending on your requirements, select from the following:

    Refer to Key Creation Methods and Sources for details on these key sources.

Cloning CipherTrust (Local) Key Material

Clone and upload the local key material using the CipherTrust Manager to configure the source key.

Select Material Origin > Select Source

  1. Select CipherTrust (Local).

  2. Click Next. The Select CipherTrust (Local) Key screen is displayed.

Select CipherTrust (Local) Key

  1. Select an Algorithm. The options are AES, RSA, and EC.

  2. Select the Key Size based on the key type:

    • For an AES key, the option is 256.

    • For an RSA key, the options are 2048, 3072, and 4096.

    • For an EC key, the options are prime256v1, secp384r1, and secp256k1.

  3. Select the desired CipherTrust (Local) Key from the list.

  4. Click Next. The Configure Destination (Google) Key screen is displayed.

Configure Destination (Google) Key

  1. (Applicable to Asymmetric keys) Select Key Purpose. A key purpose specifies the operation that the key can be used to perform. The options are:

    • Decrypt: Enables the key for RSA encryption. This option is not applicable to EC algorithms.

    • Sign: Enables the key for elliptic curve signing and RSA signing.

  2. Enter a user-friendly alias as the Key Name. This will be the key name on Google Cloud. This name helps uniquely identify a Google Cloud key. By default, the CipherTrust Key Name you specified on the previous screen is populated.

    The key name can only contain alphanumeric characters and dashes.

  3. Select the desired Key Ring. The drop-down list shows the key rings in the project location linked with the configured Google Cloud connection.

  4. (Optional) Select Google Automatic Rotation and specify the following:

    1. Select Rotation Period from the drop-down list. This is the time period (in days) after which the key will rotate automatically, after the date specified in Starting on (see below). The options are 30, 90, 180, and 365 days.

      To specify a custom frequency, select Custom and specify the rotation frequency in the Rotate key every (days) field that appears. The default value is 1 day.

    2. Click the Starting on field, and select the key expiration date and time from the on-screen calendar.

      This is the time when the automatic key rotation becomes effective. Next automatic key rotation will happen after the specified Rotation Period.

    For example, if you set Rotation Period as 30 days and set Starting on as today, the key will automatically rotate after 30 days from today.

  5. Select a Protection Level for the key. A protection level specifies how cryptographic operations are performed. The options are:

    • Software: Crypto operations are performed in software.

    • HSM: Crypto operations are performed in an HSM.

  6. Select the Algorithm for the key.

  7. (Optional) Enter Tags. A tag is a label assigned to the key that consists of a user-defined key and a value.

    Note

    For Google label requirements, refer to Labeling keys | Cloud KMS Documentation | Google Cloud.

    To add a tag:

    1. Specify a tag name.

    2. Specify the tag value.

    3. Click the + button.

    Similarly, you can add more tags. To remove a tag, click the close (X) icon in the tag name.

  8. Click Next. The Add to Schedule screen is displayed.

Add to Schedule

  1. Select Schedule to Apply. The drop-down list shows the available key rotation schedules.

  2. Select the Key Origin from the available options. The key origin can be:

    • CipherTrust (Local): The local CipherTrust Manager.

    • Native: Native cloud, Google.

  3. Select an Algorithm. For the Native Key Origin, the Algorithm field is unavailable.

  4. Click Next.

The Review and Add Key screen is displayed.

Review and Add

This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, DESTINATION KEY, and KEY SCHEDULES sections.

Before adding the key, review all details. After the key is added, certain features will no longer be editable.

  1. Review the key details displayed on the screen.

    If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY, DESTINATION KEY, and KEY SCHEDULES sections and update details. Alternatively, click Back and make changes, as appropriate.

  2. Click Add Key.

    The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.

    When the status next to the DESTINATION KEY and KEY SCHEDULES sections becomes Complete and the Key ID link is displayed, the key is created successfully.

  3. Click Close. The Add Google Key wizard is closed.

The newly created key is displayed in the list of Google Cloud keys.

Viewing Google Cloud Keys

The Google Keys page shows the list of Google Cloud keys available on the CipherTrust Manager.

To view the Google Cloud keys:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google. The list of available Google Cloud keys is displayed. The Google Keys page displays the following details:

    Field Description
    Name Unique, user-friendly name of the Google Cloud key. Click the link to view additional details of the key or edit the key. Refer to Viewing or Editing Details of Google Cloud Keys. This name is useful in searching for specific keys.
    Status State of the Google Cloud key. The status can be:
    • Available
    • Not Available
    • Deleted
    Purpose Purpose of the Google Cloud key. The purpose can be:
    •Encrypt Decrypt
    •Asymmetric Sign
    •Asymmetric Decrypt
    Protection Protection level of the Google Cloud key. The protection level can be Software or HSM.
    Algorithm Algorithm of the Google Cloud key. A number of algorithms are supported.
    Key Ring Name of the Google Cloud key ring where the key resides.
    Location Location where the Google Cloud key is created.
    Project Project where the Google Cloud key is created.
    Organization Organization where the Google Cloud key is created.
    Creation Date Date and time when the Google Cloud key is created.
    Next Google Rotation Date and time of the next Google Cloud key rotation.

Sometimes, you might notice certain Google Cloud keys are displayed as grayed out. This happens when the keys are no longer accessible. For example, when:

  • Any cloud permissions on the keys are changed. The keys are no longer accessible from the Google Cloud connection.

  • Connection is changed in KMS. The new connection does not have permissions to access the keys.

  • When Google Cloud locations are changed or removed. The keys from the configured location are no longer accessible.

Refreshing Google Cloud Keys

Refreshing is the process of downloading keys created in Google Cloud key rings to CCKM. You can refresh keys from all Google Cloud key rings at once.

Refreshing All Keys

To refresh all keys:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google. The Google Keys page is displayed. This page displays the list of Google Cloud keys.

  3. Click Refresh All. The This may take a while... message is displayed.

    Note

    Refresh all keys is a time intensive operation that could take several hours or days to complete. It will continue running in the background.

  4. Click Refresh All to continue.

A message Refresh started... is displayed on the screen. To cancel the refresh, click Cancel Refresh.

The refreshed keys are listed on the Cloud Keys > Google > Google Keys page.

Refreshing Specific Keys

To refresh a key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google. The Google Keys page is displayed. This page displays the list of Google Cloud keys.

  3. Click the overflow icon (Overflow Icon) corresponding to the desired key.

  4. Click Refresh.

A message Key refreshed successfully.

The refreshed key is listed on the Cloud Keys > Google > Google Keys page.

Viewing Versions of a Key

To view the versions of a key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the expand icon (Expand Icon) to the left of the desired key. The key version details are displayed:

    Field Description
    Version Version number of the key.
    State State of the key version. The state can be Aborted, Enabled, Disabled, Destroy Scheduled, or Destroyed.
    Algorithm Algorithm used for the key version.
    Origin Source of the key material used for the version. The origin can be:
    • CCKM: Key material is created on CCKM.
    • Native: Key material is created on the cloud.
    • External (Unknown): Source of the key material is unknown. It is different than CCKM and the native cloud.
    Refer to Key Creation Methods and Sources for details.
    Creation Date Date and time when the key version is created.
    Version Resource URL URL of the key version resource on the CipherTrust Manager.

Disabling a Key Version

If required, you can disable an enabled version of a key. An aborted, destroy scheduled, or destroyed key version cannot be disabled.

A disabled version cannot operate on data. After the key version is disabled, there is a delay of up to a few hours during which it can still operate on data. You can again enable the version later. All versions of a key can also be disable at once. Refer to Disabling All Versions of a Key.

To disable a key version:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the expand icon (Expand Icon) to the left of the desired key.

  4. Click the overflow icon (Overflow Icon) corresponding to the desired version.

  5. Click Disable Version. The Disable Key Version dialog box is displayed.

  6. Click Yes, Disable to confirm the action.

The state of the key version changes to Disabled.

Enabling a Key Version

If required, you can enable a disabled version of a key. An aborted, destroy scheduled, or destroyed key version cannot be enabled.

To enable a key version:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the expand icon (Expand Icon) to the left of the desired key.

  4. Click the overflow icon (Overflow Icon) corresponding to the desired version.

  5. Click Enable Version. The Enable Key Version dialog box is displayed.

  6. Click Yes, Enable to confirm the action.

The state of the key version changes to Enabled.

Downloading Public Key of an Asymmetric Version

The public key of asymmetric versions of a Google Cloud key can be downloaded.

To download the public key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the expand icon (Expand Icon) to the left of the desired key.

  4. Click the overflow icon (Overflow Icon) corresponding to the desired asymmetric version.

  5. Click Get Public Key.

The public key of (public-key.pem) the asymmetric key version is downloaded to your machine.

Scheduling Destruction of a Key Version

With CCKM, you can schedule destruction of a Google Cloud key version. The version will be destroyed 24 hours after you schedule the destruction. However, you can cancel the schedule destruction before the scheduled destruction time.

Caution

When a key version is destroyed from CCKM, the version is immediately disabled, and cannot be recovered. Any data encrypted or signed by the version cannot decrypted or verified.

To schedule destruction of a key version:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the expand icon (Expand Icon) to the left of the desired key.

  4. Click the overflow icon (Overflow Icon) corresponding to the desired version.

  5. Click Schedule Destruction. The Schedule Key Version Destruction dialog box is displayed.

    Note

    If you confirm scheduled destruction, the version will be destroyed after 24 hours and cannot be recovered.

  6. Click Yes, Schedule Destruction to confirm the action.

The state of the key version changes to Destroy Scheduled. After 24 hours, the state will become Destroyed.

Canceling Scheduled Destruction of a Key Version

A scheduled destruction of a key version can be canceled before the destruction time arrives (that is, within 24 hours after you scheduled destruction).

To cancel the schedule destruction of a key version:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the expand icon (Expand Icon) to the left of the desired key.

  4. Click the overflow icon (Overflow Icon) corresponding to the desired version with the Destroy Scheduled state.

  5. Click Cancel Destruction. The Cancel Key Version Destruction dialog box is displayed.

  6. Click Yes, Cancel Destruction to confirm the action.

The state of the key version changes to Disabled. The disabled key version can be enabled, if required. Refer to Enabling a Key Version.

Enabling All Versions of a Key

With CCKM, you can enable all disabled versions of a key at once. Aborted, destroy scheduled, or destroyed key versions cannot be enabled.

To enable all disabled versions of a key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the overflow icon (Overflow Icon) corresponding to the desired key.

  4. Click Enable All Key Versions. The Enable All Versions dialog box is displayed.

  5. Click Yes, Enable.

All the key versions disabled earlier are now enabled. The status of the key versions changes to Enabled.

Disabling All Versions of a Key

With CCKM, you can disable all enabled versions of a key at once. Aborted, destroy scheduled, or destroyed key versions cannot be disabled.

A disabled version cannot operate on data. After the key version is disabled, there is a delay of up to a few hours during which it can still operate on data. You can again enable the version later. Individual versions of a key can also be disabled. Refer to Disabling a Key Version.

To disable all enabled versions of a key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the overflow icon (Overflow Icon) corresponding to the desired key.

  4. Click Disable All Key Versions. The Disable All Versions dialog box is displayed.

  5. Click Yes, Disable.

All the key versions enabled earlier are now disabled. The status of the key versions changes to Disabled.

Scheduling Destruction of All Versions of a Key

With CCKM, you can schedule destruction of all versions of key at once. The versions will be destroyed 24 hours after you schedule the destruction. However, you can cancel the schedule destruction before the scheduled destruction time.

Caution

When a key version is destroyed from CCKM, the version is immediately disabled, and cannot be recovered. Any data encrypted or signed by the version cannot decrypted or verified.

To schedule destruction of all versions of a key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the overflow icon (Overflow Icon) corresponding to the desired key.

  4. Click Destroy All Versions. The Schedule Destruction dialog box is displayed.

  5. Click Yes, Schedule Destruction.

All the key versions are scheduled for destruction. The status of the key versions changes to Destroy Scheduled.

Canceling Scheduled Destruction of All Key Versions

A scheduled destruction of all key versions can be canceled before the destruction time arrives (that is, within 24 hours after you scheduled destruction).

To cancel the schedule destruction of all key versions:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the overflow icon (Overflow Icon) corresponding to the desired key.

  4. Click Cancel Destruction. The Cancel Key Version Destruction dialog box is displayed.

  5. Click Yes, Cancel Destruction to confirm the action.

The state of all enabled key versions changes to Disabled. The disabled key versions can be enabled, if required. Refer to Enabling All Versions of a Key.

Adding a Key Version

CCKM provides two methods to add a new version to a key. Refer to Key Creation Methods and Sources for details on key creation methods and key sources.

To add a new key version:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google.

  3. Click the overflow icon (Overflow Icon) corresponding to the desired key.

  4. Click Add Version. The Add Version dialog box is displayed.

  5. Select Method. The options are:

Adding Key Version by Creating New Key Material

  1. Select Create/Upload New Key Material as the method.

  2. Select Source. The options are:

    • CipherTrust (Local): Select this option, select the Algorithm, and specify Key Name for the new key version.

    • Google (Native): Select this option to create a new native Google Cloud key.

  3. Click Add Version.

A new version is added to the key.

Adding Key Version by Cloning Existing Key Material

  1. Select Clone Existing Key Material as the method.

  2. Select CipherTrust (Local) for the Source.

  3. Select an Algorithm.

  4. Select a Key Size.

    Note

    Depending on the algorithm of the existing key, the Algorithm and Key Size options for the new key version will vary.

  5. Select a Source Key from the list.

  6. Click Save.

A new version is added to the key.

Viewing or Editing Details of Google Cloud Keys

After a key is created, you can add or update tags and key rotation schedules, and also rotate key versions in the edit view. You can perform various operations on key versions.

In the edit view of a key, you can view all the key details such as its purpose, protection level, and location etc.

To view or edit an Google Cloud key:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Cloud Keys > Google. The list of available Google Cloud keys is displayed.

  3. Click the overflow icon (ellipsis) corresponding to the desired key and click View/Edit. Alternatively, you can click the key name link. The edit view of the key is displayed. The edit view is divided into:

Updating Default Algorithm for New Key Versions

To update the default algorithm for the new versions of the asymmetric key:

  1. In the ALGORITHM section, select the desired algorithm from the Select Default Algorithm for New Version drop-down list.

  2. Click Update.

The default algorithm is updated for the new versions of the key.

The key labels are updated.

Adding or Updating Labels

A label is a tag assigned to the key, which consists of a user-defined key and a value.

Note

For Google label requirements, refer to Labeling keys | Cloud KMS Documentation | Google Cloud.

To add or update key labels, in the LABELS section:

  1. Under Label, specify a tag key.

  2. Enter the tag value.

  3. Click the + button.

    Similarly, you can add more tags. To remove a tag, click the close (X) icon in the tag name.

  4. Click Update.

The key labels are updated.

Updating Key Rotation Schedule

To update a key rotation schedule, in the ROTATION section:

  1. Select Rotation Schedule. The drop-down list shows the available key rotation schedules.

  2. Select the Key Origin. The options are CipherTrust (External), CipherTrust (Local), and Native (Google). Refer to Key Creation Methods and Sources for details on sources.

  3. Select the Algorithm for the key.

  4. Click Update.

The key rotation schedule is updated.

Performing Key Version Operations

With CCKM, you enable/disable, add or rotate, and schedule destruction of key versions. Also, you can download public key of asymmetric versions of a key.

To perform a operation on a key version, under the Key Versions section:

  1. Click the overflow icon (Overflow Icon) corresponding to the desired version. A popup menu appears.

  2. Select the desired operation. Depending on the current state, the options can be Disable Version, Enable Version, and Schedule Destruction. An Aborted version cannot be enabled, disabled, or scheduled for destruction.

    To download the public key of an asymmetric key version, click Get Public Key. The public key of (public-key.pem) the asymmetric key version is downloaded to your machine.

  3. Confirm the operation.

Note

To rotate all versions of a key, click Rotate under the Key Versions section.

Managing Principals and Roles

Assigning Principals and Roles

To assign the principles and roles:

  1. Expand PERMISSIONS.

  2. Click Assign Principal/Role. The Assign Principal/Role wizard will open.

  3. In the ADD PRINCIPAL section, select a principal Type from the drop-down list. The available types are User, Service Account, Group, and Domain.

  4. Add Principals. You can add multiple principals separated by a comma.

    To add additional principals, click Add More Principals.

  5. In the SELECT ROLES section, select a Role from the drop-down list.

  6. Click Set Conditions. The Add Conditions wizard is displayed.

    1. Enter Title.

    2. (Optional) Enter Description.

    3. (Optional) Enter Condition. You can enter the condition in Basic View or Raw View.

      Click the desired tab to view the instructions.

      Note

      • Ensure the correctness of the logical expressions (conditions) you add. Neither CCKM nor GCP checks for the logical validity of the added conditions.

      • Provide input in valid formats. CCKM performs input data validation similar to GCP.

      1. Select a Condition Type.

      2. Select an Operator.

      3. Select a Detail from the drop-down list, for the selected Condition Type. It can be Resource Type, Resource Service, Value, etc.

        To add additional conditions, click Add Condition.

        You can also add Group Condition, click Add Group Condition. Group condition contains details of more than one Condition.

      Note

      • If you add multiple conditions and group conditions, you need to provide the relation between the conditions and relation between the conditions within the group condition. The relation can be AND or OR.

      • You can also add conditions within the conditions and group conditions and group conditions within the conditions and group conditions.

      Enter the details in the text area.

    4. Click Save.

    To add additional roles, click Add More Roles.

  7. Click Save.

If the added principals already exist, the principal/role will be assigned and you will see a success message.

Editing Roles

To edit the roles:

  1. Expand PERMISSIONS.

  2. Expand the desired Role.

  3. Under the expanded role, click the overflow icon (Overflow Icon) corresponding to the desired principal.

  4. Click Edit. The Edit Roles wizard is displayed.

  5. Update the existing Role.

  6. Click Set Conditions. The Add Conditions wizard is displayed.

    1. Enter Title.

    2. (Optional) Enter Description.

    3. (Optional) Enter Condition. You can enter the condition in Basic View or Raw View.

      Click the desired tab to view the instructions.

      Note

      • Ensure the correctness of the logical expressions (conditions) you add. Neither CCKM nor GCP checks for the logical validity of the added conditions.

      • Provide input in valid formats. CCKM performs input data validation similar to GCP.

      1. Select a Condition Type.

      2. Select an Operator.

      3. Select a Detail from the drop-down list, for the selected Condition Type. It can be Resource Type, Resource Service, Value, etc.

        To add additional conditions, click Add Condition.

        You can also add Group Condition, click Add Group Condition. Group condition contains details of more than one Condition.

      Note

      • If you add multiple conditions and group conditions, you need to provide the relation between the conditions and relation between the conditions within the group condition. The relation can be AND or OR.

      • You can also add conditions within the conditions and group conditions and group conditions within the conditions and group conditions.

      Enter the details in the text area.

    4. Click Save.

    To add additional roles, click Add More Roles.

  7. Click Update.

Removing Principals

To remove the principals:

  1. Expand PERMISSIONS.

  2. Expand the desired Role.

  3. Under the expanded role, click the overflow icon (Overflow Icon) corresponding to the desired principal.

  4. Click Remove. The Remove Principal dialog box is displayed.

  5. Click Remove.

On successful deletion, a Google key updated successfully message is displayed on the screen.

Note

After deleting all the principals of a role, the role will be removed.

On this page