Skip to content

Commit 06c6041

Browse files
author
awstools
committed
feat(client-kms): This feature allows customers to use their keys stored in KMS to derive a shared secret which can then be used to establish a secured channel for communication, provide proof of possession, or establish trust with other parties.
1 parent 59f9e1a commit 06c6041

27 files changed

+802
-68
lines changed

‎clients/client-kms/README.md

+8
Original file line numberDiff line numberDiff line change
@@ -377,6 +377,14 @@ DeleteImportedKeyMaterial
377377

378378
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DeleteImportedKeyMaterialCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/DeleteImportedKeyMaterialCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/DeleteImportedKeyMaterialCommandOutput/)
379379

380+
</details>
381+
<details>
382+
<summary>
383+
DeriveSharedSecret
384+
</summary>
385+
386+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DeriveSharedSecretCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/DeriveSharedSecretCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/DeriveSharedSecretCommandOutput/)
387+
380388
</details>
381389
<details>
382390
<summary>

‎clients/client-kms/src/KMS.ts

+23
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ import {
3232
DeleteImportedKeyMaterialCommandInput,
3333
DeleteImportedKeyMaterialCommandOutput,
3434
} from "./commands/DeleteImportedKeyMaterialCommand";
35+
import {
36+
DeriveSharedSecretCommand,
37+
DeriveSharedSecretCommandInput,
38+
DeriveSharedSecretCommandOutput,
39+
} from "./commands/DeriveSharedSecretCommand";
3540
import {
3641
DescribeCustomKeyStoresCommand,
3742
DescribeCustomKeyStoresCommandInput,
@@ -191,6 +196,7 @@ const commands = {
191196
DeleteAliasCommand,
192197
DeleteCustomKeyStoreCommand,
193198
DeleteImportedKeyMaterialCommand,
199+
DeriveSharedSecretCommand,
194200
DescribeCustomKeyStoresCommand,
195201
DescribeKeyCommand,
196202
DisableKeyCommand,
@@ -377,6 +383,23 @@ export interface KMS {
377383
cb: (err: any, data?: DeleteImportedKeyMaterialCommandOutput) => void
378384
): void;
379385

386+
/**
387+
* @see {@link DeriveSharedSecretCommand}
388+
*/
389+
deriveSharedSecret(
390+
args: DeriveSharedSecretCommandInput,
391+
options?: __HttpHandlerOptions
392+
): Promise<DeriveSharedSecretCommandOutput>;
393+
deriveSharedSecret(
394+
args: DeriveSharedSecretCommandInput,
395+
cb: (err: any, data?: DeriveSharedSecretCommandOutput) => void
396+
): void;
397+
deriveSharedSecret(
398+
args: DeriveSharedSecretCommandInput,
399+
options: __HttpHandlerOptions,
400+
cb: (err: any, data?: DeriveSharedSecretCommandOutput) => void
401+
): void;
402+
380403
/**
381404
* @see {@link DescribeCustomKeyStoresCommand}
382405
*/

‎clients/client-kms/src/KMSClient.ts

+3
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ import {
7575
DeleteImportedKeyMaterialCommandInput,
7676
DeleteImportedKeyMaterialCommandOutput,
7777
} from "./commands/DeleteImportedKeyMaterialCommand";
78+
import { DeriveSharedSecretCommandInput, DeriveSharedSecretCommandOutput } from "./commands/DeriveSharedSecretCommand";
7879
import {
7980
DescribeCustomKeyStoresCommandInput,
8081
DescribeCustomKeyStoresCommandOutput,
@@ -178,6 +179,7 @@ export type ServiceInputTypes =
178179
| DeleteAliasCommandInput
179180
| DeleteCustomKeyStoreCommandInput
180181
| DeleteImportedKeyMaterialCommandInput
182+
| DeriveSharedSecretCommandInput
181183
| DescribeCustomKeyStoresCommandInput
182184
| DescribeKeyCommandInput
183185
| DisableKeyCommandInput
@@ -235,6 +237,7 @@ export type ServiceOutputTypes =
235237
| DeleteAliasCommandOutput
236238
| DeleteCustomKeyStoreCommandOutput
237239
| DeleteImportedKeyMaterialCommandOutput
240+
| DeriveSharedSecretCommandOutput
238241
| DescribeCustomKeyStoresCommandOutput
239242
| DescribeKeyCommandOutput
240243
| DisableKeyCommandOutput

‎clients/client-kms/src/commands/CreateGrantCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ export interface CreateGrantCommandOutput extends CreateGrantResponse, __Metadat
104104
* GranteePrincipal: "STRING_VALUE", // required
105105
* RetiringPrincipal: "STRING_VALUE",
106106
* Operations: [ // GrantOperationList // required
107-
* "Decrypt" || "Encrypt" || "GenerateDataKey" || "GenerateDataKeyWithoutPlaintext" || "ReEncryptFrom" || "ReEncryptTo" || "Sign" || "Verify" || "GetPublicKey" || "CreateGrant" || "RetireGrant" || "DescribeKey" || "GenerateDataKeyPair" || "GenerateDataKeyPairWithoutPlaintext" || "GenerateMac" || "VerifyMac",
107+
* "Decrypt" || "Encrypt" || "GenerateDataKey" || "GenerateDataKeyWithoutPlaintext" || "ReEncryptFrom" || "ReEncryptTo" || "Sign" || "Verify" || "GetPublicKey" || "CreateGrant" || "RetireGrant" || "DescribeKey" || "GenerateDataKeyPair" || "GenerateDataKeyPairWithoutPlaintext" || "GenerateMac" || "VerifyMac" || "DeriveSharedSecret",
108108
* ],
109109
* Constraints: { // GrantConstraints
110110
* EncryptionContextSubset: { // EncryptionContextType

‎clients/client-kms/src/commands/CreateKeyCommand.ts

+11-5
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,12 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
7171
* <p>Asymmetric KMS keys contain an RSA key pair, Elliptic Curve (ECC) key pair, or an
7272
* SM2 key pair (China Regions only). The private key in an asymmetric KMS key never leaves
7373
* KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to
74-
* download the public key so it can be used outside of KMS. KMS keys with RSA or SM2 key
75-
* pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
76-
* KMS keys with ECC key pairs can be used only to sign and verify messages. For
74+
* download the public key so it can be used outside of KMS. Each KMS key can have only one key usage. KMS keys with RSA key
75+
* pairs can be used to encrypt and decrypt data or sign and verify messages (but not both).
76+
* KMS keys with NIST-recommended ECC key pairs can be used to sign and verify messages or
77+
* derive shared secrets (but not both). KMS keys with <code>ECC_SECG_P256K1</code>
78+
* can be used only to sign and verify messages. KMS keys with SM2 key pairs (China Regions only)
79+
* can be used to either encrypt and decrypt data, sign and verify messages, or derive shared secrets (you must choose one key usage type). For
7780
* information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the
7881
* <i>Key Management Service Developer Guide</i>.</p>
7982
* <p> </p>
@@ -204,7 +207,7 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
204207
* const input = { // CreateKeyRequest
205208
* Policy: "STRING_VALUE",
206209
* Description: "STRING_VALUE",
207-
* KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC",
210+
* KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC" || "KEY_AGREEMENT",
208211
* CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
209212
* KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
210213
* Origin: "AWS_KMS" || "EXTERNAL" || "AWS_CLOUDHSM" || "EXTERNAL_KEY_STORE",
@@ -229,7 +232,7 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
229232
* // CreationDate: new Date("TIMESTAMP"),
230233
* // Enabled: true || false,
231234
* // Description: "STRING_VALUE",
232-
* // KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC",
235+
* // KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC" || "KEY_AGREEMENT",
233236
* // KeyState: "Creating" || "Enabled" || "Disabled" || "PendingDeletion" || "PendingImport" || "PendingReplicaDeletion" || "Unavailable" || "Updating",
234237
* // DeletionDate: new Date("TIMESTAMP"),
235238
* // ValidTo: new Date("TIMESTAMP"),
@@ -246,6 +249,9 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
246249
* // SigningAlgorithms: [ // SigningAlgorithmSpecList
247250
* // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
248251
* // ],
252+
* // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
253+
* // "ECDH",
254+
* // ],
249255
* // MultiRegion: true || false,
250256
* // MultiRegionConfiguration: { // MultiRegionConfiguration
251257
* // MultiRegionKeyType: "PRIMARY" || "REPLICA",

‎clients/client-kms/src/commands/DecryptCommand.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,8 @@ export interface DecryptCommandOutput extends DecryptResponse, __MetadataBearer
207207
* <code>KeyUsage</code> must be <code>ENCRYPT_DECRYPT</code>. For signing and verifying
208208
* messages, the <code>KeyUsage</code> must be <code>SIGN_VERIFY</code>. For generating and
209209
* verifying message authentication codes (MACs), the <code>KeyUsage</code> must be
210-
* <code>GENERATE_VERIFY_MAC</code>. To find the <code>KeyUsage</code> of a KMS key, use the
210+
* <code>GENERATE_VERIFY_MAC</code>. For deriving key agreement secrets, the
211+
* <code>KeyUsage</code> must be <code>KEY_AGREEMENT</code>. To find the <code>KeyUsage</code> of a KMS key, use the
211212
* <a>DescribeKey</a> operation.</p>
212213
* <p>To find the encryption or signing algorithms supported for a particular KMS key, use the
213214
* <a>DescribeKey</a> operation.</p>

0 commit comments

Comments
 (0)