trait Kms extends FlagCloseable
Represents a KMS interface and allows symmetric encryption/decryption with keys stored in the KMS.
- Alphabetic
- By Inheritance
- Kms
- FlagCloseable
- AutoCloseable
- AnyRef
- Any
- Hide All
- Show All
- Public
- Protected
Type Members
- abstract type CreateKeySpec <: KmsCreateKeySpec
- case class ReaderState(count: Int, readers: MultiSet[String]) extends Product with Serializable
- Definition Classes
- FlagCloseable
Abstract Value Members
- abstract def config: KmsConfig
- abstract def decryptAsymmetricInternal(keyId: KmsKeyId, data: ByteString256, encryptionKeyScheme: EncryptionKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString190]
- Attributes
- protected
- abstract def decryptSymmetricInternal(keyId: KmsKeyId, data: ByteString6144)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString4096]
- Attributes
- protected
- abstract def deleteKeyInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
- Attributes
- protected
- abstract def encryptSymmetricInternal(keyId: KmsKeyId, data: ByteString4096)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString6144]
- Attributes
- protected
- abstract def generateAsymmetricEncryptionKeyPairInternal(encryptionKeyScheme: EncryptionKeyScheme, createKeySpec: Option[CreateKeySpec] = None, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
- Attributes
- protected
- abstract def generateSigningKeyPairInternal(signingKeyScheme: SigningKeyScheme, createKeySpec: Option[CreateKeySpec] = None, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
- Attributes
- protected
- abstract def generateSymmetricEncryptionKeyInternal(createKeySpec: Option[CreateKeySpec] = None, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
- Attributes
- protected
- abstract def getPublicEncryptionKeyInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, EncryptionPublicKey]
- Attributes
- protected
- abstract def getPublicSigningKeyInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, SigningPublicKey]
- Attributes
- protected
- abstract def keyExistsAndIsActiveInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
- Attributes
- protected
- abstract def logger: TracedLogger
- Attributes
- protected
- Definition Classes
- FlagCloseable
- abstract def signInternal(keyId: KmsKeyId, data: ByteString4096, signingKeyScheme: SigningKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString]
- Attributes
- protected
- abstract def timeouts: ProcessingTimeout
- Attributes
- protected
- Definition Classes
- FlagCloseable
Concrete Value Members
- final def !=(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def ##: Int
- Definition Classes
- AnyRef → Any
- final def ==(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def asInstanceOf[T0]: T0
- Definition Classes
- Any
- def clone(): AnyRef
- Attributes
- protected[lang]
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.CloneNotSupportedException]) @native() @HotSpotIntrinsicCandidate()
- final def close(): Unit
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
- Definition Classes
- FlagCloseable → AutoCloseable
- Annotations
- @SuppressWarnings()
- def closingTimeout: FiniteDuration
- Attributes
- protected
- Definition Classes
- FlagCloseable
- def decryptAsymmetric(keyId: KmsKeyId, data: ByteString256, encryptionKeyScheme: EncryptionKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString190]
Asymmetrically decrypt the data passed as a byte array using a KMS private key.
Asymmetrically decrypt the data passed as a byte array using a KMS private key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to decrypt. The higher bound on the data size we can decrypt is 256bytes (i.e. the ciphertext length for RSA2048-OAEP-SHA256 encryption; when using RSAES-OAEP the ciphertext size is always equal to the size of the Modulus).
- encryptionKeyScheme
the encryption algorithm that was used to encrypt the plaintext message. The algorithm must be compatible with the KMS key that you specify.
- returns
a decrypted byte string or an error if it fails to decrypt
- def decryptSymmetric(keyId: KmsKeyId, data: ByteString6144)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString4096]
Symmetrically decrypt the data passed as a byte array using a KMS symmetric key.
Symmetrically decrypt the data passed as a byte array using a KMS symmetric key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to decrypt. The higher bound on the data size we can decrypt is 6144 bytes (i.e. maximum accepted input size for the external KMSs that we support).
- returns
a decrypted byte string or an error if it fails to decrypt
- def deleteKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
Schedule a deletion of a KMS key (takes between 7-30 days)
Schedule a deletion of a KMS key (takes between 7-30 days)
- keyId
key identifier (e.g. AWS key ARN)
- returns
an error if it fails to schedule a deletion of a key
- def encryptSymmetric(keyId: KmsKeyId, data: ByteString4096)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString6144]
Symmetrically encrypt the data passed as a byte string using a KMS symmetric key.
Symmetrically encrypt the data passed as a byte string using a KMS symmetric key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to encrypt. The higher bound on the data size we can encrypt is 4kb (i.e. maximum accepted input size for the external KMSs that we support).
- returns
an encrypted byte string or an error if it fails to encrypt
- final def eq(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def equals(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef → Any
- def generateAsymmetricEncryptionKeyPair(encryptionKeyScheme: EncryptionKeyScheme, createKeySpec: Option[CreateKeySpec] = None, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
Creates a new (asymmetric) encryption key pair in the KMS and returns a key identifier.
Creates a new (asymmetric) encryption key pair in the KMS and returns a key identifier.
- encryptionKeyScheme
defines the encryption key scheme to which the key is going to be used for.
- createKeySpec
defines an optional create key specification (e.g. for AWS we can a select a new key to be multi-region). If we use None we use the default specification (e.g. for AWS multiRegion = false).
- name
an optional name to identify the key.
- returns
a key id or an error if it fails to create a key
- def generateSigningKeyPair(signingKeyScheme: SigningKeyScheme, createKeySpec: Option[CreateKeySpec] = None, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
Creates a new signing key pair in the KMS and returns its key identifier.
Creates a new signing key pair in the KMS and returns its key identifier.
- signingKeyScheme
defines the signing key scheme to which the key is going to be used for.
- createKeySpec
defines an optional create key specification (e.g. for AWS we can a select a new key to be multi-region). If we use None we use the default specification (e.g. for AWS multiRegion = false).
- name
an optional name to identify the key.
- returns
a key id or an error if it fails to create a key
- def generateSymmetricEncryptionKey(createKeySpec: Option[CreateKeySpec] = None, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
Creates a new symmetric encryption key in the KMS and returns its key identifier.
Creates a new symmetric encryption key in the KMS and returns its key identifier. The specific encryption scheme is not necessary (default is taken) because this is intended to be used to generate a KMS wrapper key.
- createKeySpec
defines an optional create key specification (e.g. for AWS we can a select a new key to be multi-region). If we use None we use the default specification (e.g. for AWS multiRegion = false).
- name
an optional name to identify the key.
- returns
a key id or an error if it fails to create a key
- final def getClass(): Class[_ <: AnyRef]
- Definition Classes
- AnyRef → Any
- Annotations
- @native() @HotSpotIntrinsicCandidate()
- def getPublicEncryptionKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, EncryptionPublicKey]
Get public key for encryption from KMS given a KMS key identifier.
Get public key for encryption from KMS given a KMS key identifier.
- keyId
key identifier (e.g. AWS key ARN)
- returns
the public encryption key for that keyId
- def getPublicSigningKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, SigningPublicKey]
Get public key for signing from KMS given a KMS key identifier.
Get public key for signing from KMS given a KMS key identifier.
- keyId
key identifier (e.g. AWS key ARN)
- returns
the public signing key for that keyId
- def hashCode(): Int
- Definition Classes
- AnyRef → Any
- Annotations
- @native() @HotSpotIntrinsicCandidate()
- def internalPerformUnlessClosingF[A](name: String)(f: => Future[A])(implicit ec: ExecutionContext, traceContext: TraceContext): UnlessShutdown[Future[A]]
- Attributes
- protected
- Definition Classes
- FlagCloseable
- def isClosing: Boolean
Check whether we're closing.
Check whether we're closing. Susceptible to race conditions; unless you're using using this as a flag to the retry lib or you really know what you're doing, prefer performUnlessClosing and friends.
- Definition Classes
- FlagCloseable
- final def isInstanceOf[T0]: Boolean
- Definition Classes
- Any
- def keepTrackOfOpenFutures: Boolean
track running futures on shutdown
track running futures on shutdown
set to true to get detailed information about all futures that did not complete during shutdown. if set to false, we don't do anything.
- Attributes
- protected
- Definition Classes
- FlagCloseable
- def keyExistsAndIsActive(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
Checks that a key identified by keyId exists in the KMS and is not deleted or disabled, and therefore can be used.
Checks that a key identified by keyId exists in the KMS and is not deleted or disabled, and therefore can be used.
- keyId
key identifier (e.g. AWS key ARN)
- returns
error if it fails to find key
- def maxSleepMillis: Long
- Attributes
- protected
- Definition Classes
- FlagCloseable
- final def ne(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- final def notify(): Unit
- Definition Classes
- AnyRef
- Annotations
- @native() @HotSpotIntrinsicCandidate()
- final def notifyAll(): Unit
- Definition Classes
- AnyRef
- Annotations
- @native() @HotSpotIntrinsicCandidate()
- def onCloseFailure(e: Throwable): Unit
- Attributes
- protected
- Definition Classes
- FlagCloseable
- def onClosed(): Unit
- Attributes
- protected
- Definition Classes
- FlagCloseable
- def performUnlessClosing[A](name: String)(f: => A)(implicit traceContext: TraceContext): UnlessShutdown[A]
Performs the task given by
funless a shutdown has been initiated.Performs the task given by
funless a shutdown has been initiated. The shutdown will only begin afterfcompletes, but other tasks may execute concurrently withf, if started using this function, or one of the other variants (performUnlessClosingF and performUnlessClosingEitherT). The tasks are assumed to take less than closingTimeout to complete.DO NOT CALL
this.closeas part off, because it will result in a deadlock.- f
The task to perform
- returns
scala.None$ if a shutdown has been initiated. Otherwise the result of the task.
- Definition Classes
- FlagCloseable
- def performUnlessClosingCheckedT[A, N, R](name: String, onClosing: => Checked[A, N, R])(etf: => CheckedT[Future, A, N, R])(implicit ec: ExecutionContext, traceContext: TraceContext): CheckedT[Future, A, N, R]
- Definition Classes
- FlagCloseable
- def performUnlessClosingEitherT[E, R](name: String, onClosing: => E)(etf: => EitherT[Future, E, R])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[Future, E, R]
Performs the EitherT[Future] given by
etfunless a shutdown has been initiated, in which case the provided error is returned instead.Performs the EitherT[Future] given by
etfunless a shutdown has been initiated, in which case the provided error is returned instead. Bothetfand the error are lazy;etfis only evaluated if there is no shutdown, the error only if we're shutting down. The shutdown will only begin afteretfcompletes, but other tasks may execute concurrently withetf, if started using this function, or one of the other variants (performUnlessClosing and performUnlessClosingF). The tasks are assumed to take less than closingTimeout to complete.DO NOT CALL
this.closeas part ofetf, because it will result in a deadlock.- etf
The task to perform
- Definition Classes
- FlagCloseable
- def performUnlessClosingEitherTF[E, R](name: String, onClosing: => E)(etf: => EitherT[Future, E, Future[R]])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[Future, E, Future[R]]
- Definition Classes
- FlagCloseable
- def performUnlessClosingEitherU[E, R](name: String)(etf: => EitherT[Future, E, R])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[FutureUnlessShutdown, E, R]
- Definition Classes
- FlagCloseable
- def performUnlessClosingEitherUSF[E, R](name: String)(etf: => EitherT[FutureUnlessShutdown, E, R])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[FutureUnlessShutdown, E, R]
- Definition Classes
- FlagCloseable
- def performUnlessClosingF[A](name: String)(f: => Future[A])(implicit ec: ExecutionContext, traceContext: TraceContext): FutureUnlessShutdown[A]
Performs the Future given by
funless a shutdown has been initiated.Performs the Future given by
funless a shutdown has been initiated. The future is lazy and not evaluated during shutdown. The shutdown will only begin afterfcompletes, but other tasks may execute concurrently withf, if started using this function, or one of the other variants (performUnlessClosing and performUnlessClosingEitherT). The tasks are assumed to take less than closingTimeout to complete.DO NOT CALL
this.closeas part off, because it will result in a deadlock.- f
The task to perform
- returns
The future completes with com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if a shutdown has been initiated. Otherwise the result of the task wrapped in com.digitalasset.canton.lifecycle.UnlessShutdown.Outcome.
- Definition Classes
- FlagCloseable
- def performUnlessClosingUSF[A](name: String)(f: => FutureUnlessShutdown[A])(implicit ec: ExecutionContext, traceContext: TraceContext): FutureUnlessShutdown[A]
- Definition Classes
- FlagCloseable
- def runOnShutdown[T](task: RunOnShutdown)(implicit traceContext: TraceContext): Unit
Register a task to run when shutdown is initiated.
Register a task to run when shutdown is initiated.
You can use this for example to register tasks that cancel long-running computations, whose termination you can then wait for in "closeAsync".
- Definition Classes
- FlagCloseable
- def runStateChanged(waitingState: Boolean = false): Unit
- Attributes
- protected
- Definition Classes
- FlagCloseable
- Annotations
- @VisibleForTesting()
- def sign(keyId: KmsKeyId, data: ByteString4096, signingKeyScheme: SigningKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString]
Sign the data passed as a byte string using a KMS key.
Sign the data passed as a byte string using a KMS key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to sign. The higher bound on the data size we can sign is 4kb (i.e. maximum accepted input size for the external KMSs that we support).
- signingKeyScheme
the signing algorithm to use to generate the signature
- returns
a byte string corresponding to the signature of the data
- final def synchronized[T0](arg0: => T0): T0
- Definition Classes
- AnyRef
- def toString(): String
- Definition Classes
- AnyRef → Any
- final def wait(arg0: Long, arg1: Int): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(arg0: Long): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException]) @native()
- final def wait(): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- def waitForActive(kmsKeyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
Helper method waiting for a key to exist and be active
- def waitForActiveAndGetAs[A](kmsKeyId: KmsKeyId)(task: (KmsKeyId) => EitherT[Future, KmsError, A])(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, A]
Helper method to get a key just after its creation, retrying if necessary until it's available
- def withRetries[T](description: String)(task: => EitherT[Future, KmsError, T])(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, T]
- Attributes
- protected
- object ReaderState extends Serializable
- Definition Classes
- FlagCloseable