{"id":22878739,"url":"https://github.com/chicunic/google-cloud-kms-importing","last_synced_at":"2026-01-11T02:43:26.935Z","repository":{"id":173518342,"uuid":"527791344","full_name":"chicunic/google-cloud-kms-importing","owner":"chicunic","description":null,"archived":false,"fork":false,"pushed_at":"2022-08-24T02:38:10.000Z","size":3,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-06T20:39:46.872Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chicunic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-23T01:35:44.000Z","updated_at":"2022-08-23T01:35:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"d7d062e6-a361-4f71-b327-6e89648fd7c1","html_url":"https://github.com/chicunic/google-cloud-kms-importing","commit_stats":null,"previous_names":["chicunic/google-cloud-kms-importing"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chicunic%2Fgoogle-cloud-kms-importing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chicunic%2Fgoogle-cloud-kms-importing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chicunic%2Fgoogle-cloud-kms-importing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chicunic%2Fgoogle-cloud-kms-importing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chicunic","download_url":"https://codeload.github.com/chicunic/google-cloud-kms-importing/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246482644,"owners_count":20784735,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-13T16:31:01.347Z","updated_at":"2026-01-11T02:43:26.892Z","avatar_url":"https://github.com/chicunic.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# google-cloud-kms-importing\n\n## 概述\n\n根据 Google Cloud 文档[1]的描述，将密钥导入 Google Cloud KMS，主要包括以下步骤。\n\n- 格式化密钥\n- 封装\n- 导入\n- 验证\n\n## 格式化密钥\n\n这里主要讨论下如何将助记词生成的非对称密钥，格式化成可以导入的格式。\n\n1. 生成助记词\n\n   ```\n   candy maple cake sugar pudding cream honey rich smooth crumble sweet treat\n   ```\n\n2. 生成私钥\n\n   ```\n   0xc87509a1c067bbde78beb793e6fa76530b6382a4c0241e5e4a9ec0a0f44dc0d3\n   ```\n\n3. 使用`asn1`将私钥从16进制字符串转换为`pem`格式\n\n   ```js\n   const asn1 = require('asn1.js');\n   const crypto = require('crypto');\n   \n   const ECPrivateKeyASN = asn1.define('ECPrivateKey', function encode() {\n     this.seq().obj(\n       this.key('version').int(),\n       this.key('privateKey').octstr(),\n       this.key('parameters').explicit(0).objid().optional(),\n       this.key('publicKey').explicit(1).bitstr().optional(),\n     );\n   });\n   \n   const toPEM = (privateKeyHex) =\u003e {\n     const ecdh = crypto.createECDH('secp256k1');\n     const keypair = ecdh.setPrivateKey(privateKeyHex, 'hex');\n     const privateKey = keypair.getPrivateKey();\n     const publicKey = keypair.getPublicKey();\n     const privateKeyObject = {\n       version: 1,\n       privateKey,\n       publicKey: { data: publicKey },\n       parameters: [1, 3, 132, 0, 10],\n     };\n     return ECPrivateKeyASN.encode(privateKeyObject, 'pem', { label: 'EC PRIVATE KEY' });\n   };\n   ```\n\n   可以得到`pem`格式密钥\n\n   ```\n   -----BEGIN EC PRIVATE KEY-----\n   MHQCAQEEIMh1CaHAZ7veeL63k+b6dlMLY4KkwCQeXkqewKD0TcDToAcGBSuBBAAK\n   oUQDQgAEr4C5DSUUXaKMWDNZvrR7IXlrL+GiPBUR5EPnpk39sn10NMOA8KpMUA4i\n   CqGp0GhRSx/01QGeYk57oe/oKzQKWQ==\n   -----END EC PRIVATE KEY-----\n   ```\n\n\n\n4. 使用`openssl`命令将私钥从`pem`格式转换为`der`格式\n\n   ```bash\n   openssl pkcs8 -topk8 -nocrypt -inform PEM -outform DER \\\n       -in /path/to/asymmetric-key-pem \\\n       -out /path/to/formatted-key\n   ```\n\n\n## 封装\n\n封装的方式共有两种。\n\n### 使用 Google Cloud CLI 自动封装密钥\n\n使用 Google Cloud CLI 自动封装密钥需要在本地准备好密钥的源文件，在本地安装 Google Cloud CLI 和 Pyca 加密库。Google Cloud KMS 官方推荐这种封装方法。\n\n使用`gcloud`命令可以实现自动封装和导入。这时只需要提供未封装的密钥文件。\n\n### 手动封装密钥\n\n在某些情况下，由于合规或者监管要求，可能必须手动封装密钥。这种情况下，需要重新编译 OpenSSL 以添加对“使用填充的 AES 密钥封装”的支持。\n\n## 导入\n\n1. 创建目标密钥环\n2. 创建目标密钥\n3. 创建导入作业\n4. 检查导入作业的状态\n5. 自动封装和导入密钥\n6. 导入手动封装的密钥\n\n## 验证\n\n1. 验证密钥材料是否相同\n2. 验证对 Cloud HSM 密钥的证明\n\n## References\n\n[1]: https://cloud.google.com/kms/docs/importing-a-key\t\"将密钥导入到 Cloud KMS 中\"\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchicunic%2Fgoogle-cloud-kms-importing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchicunic%2Fgoogle-cloud-kms-importing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchicunic%2Fgoogle-cloud-kms-importing/lists"}