Managing Encryption Keys in GCP using Cloud HSM

Overview of Cloud HSM

Cloud HSMs ( Hardware Security Modules ) can be used to create encryption keys and perform cryptographic operations. This service is fully managed; therefore, users can safeguard their sensitive workloads without worrying about the administrative burden of maintaining an HSM cluster. The service offers the following benefits: worldwide accessibility; a straightforward, uniform, and unified API; automatic sizing based on user requirements; centralized management; and compliance with regulations.

Encryption keys can be managed and cryptographic operations can be performed using a cluster of Hardware Security Modules (HSMs) hosted in the cloud.

Now for the content, Navigate to the Google cloud console.

• In the dropdown menu at the top left corner, make sure that My First Project is selected.

• Click on the eclipse bar to open the menu; then, click on Security, followed by Key Management.

• Click on Enable to enable the Key Management service in GCP.

Refresh the page if the Cloud Key Management Service (KMS) API is not enabled. If enabling the KMS API service takes a longer time, then log out from the GCP console and log in again. Check if the KMS API is enabled. If not, repeat the process until the KMS API is enabled.

• Now, click on CREATE KEY RING besides three dots of Key Management.

• Type a name for your key ring in the Key ring name field; here, we have used EccKey. Select Multi-Region under Location type and select global(Global) under Multi-region drop-down menu; then, click on Create.

• In the Create Key page, select Key name under Name and Protection Level. Type a name for your key under Key Name; here, we have used TestKey. Then, select HSM under Protection level. Then click on CONTINUE.

• In the Purpose dropdown menu, select Symmetric encrypt/decrypt. Click on CONTINUE

• Keep the settings as it is and click on Create.

• Click on TestKey in the Key Management page to open the test key.

• Click on VERSIONS and then click on the more options button under Actions; then, click on Download attestation.

• In the Download attestation popup, click on DOWNLOAD ATTESTATION.

• Click on Activate Cloud Shell in the GCP to open the cloud shell.

• Click on Cloud Shell; then, click on Upload under the three dot button.

• Click on Choose Files in the Upload popup.

• Navigate to the location where the file is downloaded and select the attestation file; then, click on Open.

• Now, click on Upload to start uploading the file.

• Wait until the upload is complete.

• In the TestKey page, click on Verify attestation.

• In the Verify attestation popup, click on OPEN GCLOUD CLI.

• A gcloud CLI will open with a code to verify the key; press Enter to execute the code.

• Wait for the execution to complete; then, the following message will be displayed: “The attestation has been verified.”

If Authorize Cloushell popup appears, click AUTHORIZE.

• GO to https://dl.google.com/dl/cloudsdk/channels/rapid/GoogleCloudSDKInstaller.exe, open the file, and click on downloads and open the file.

• Select the checkbox for Turn on screen reader mode and click on Next.

• In the Agreement window, click on I Agree.

• In the Please select install type popup, select Single user (Admin) and click on Next.

• Under Destination Folder. select the location where you want to install the CLI and click on Next >.

• In the next screen, click on Install.

• Wait for successful installation and click on Next.

• Click on Finish in the next screen.

• The gcloud CLI will be opened. Type Y and press Enter when prompted for Would you like to login?.

• Select the account from which you want to log in.

Enter your Google username and password if asked.

• Scroll down and click on Allow to allow the gcloud CLI.

• When asked to select a project, type the number of your project and press Enter.

• Type Y and press Enter when asked to configure the default region.

• Type the number corresponding to your region from the list and press Enter.

• Type the following command to create a plaintext file and press Enter:

echo “Test file” >> plaintext

• Type the following command to create an empty cyphertext file and press Enter:

echo “ “ >> Cyphertext

• To encrypt the plaintext file using HSM key, run the following command and press Enter:

TypeCopy
gcloud kms encrypt --key TestKey --keyring EccKey --location us-east1  --plaintext-file plaintext --ciphertext-file Cyphertext

• Navigate to cyphertext and open it with Notepad.
• You can now view the encrypted text.