Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6d67417

Browse files
chlowellchlowell
authored
CryptographyClient implemented with service calls (Azure#6537)
1 parent 3913346 commit 6d67417

32 files changed

+3495
-425
lines changed

‎doc/sphinx/ref/azure.keyvault.key_vault_id.rst‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎doc/sphinx/ref/azure.keyvault.keys.aio.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,18 @@
11
azure.keyvault.keys.aio package
22
===============================
33

4+
Submodules
5+
----------
6+
7+
azure.keyvault.keys.aio.client module
8+
-------------------------------------
9+
10+
.. automodule:: azure.keyvault.keys.aio.client
11+
:members:
12+
:undoc-members:
13+
:show-inheritance:
14+
15+
416
Module contents
517
---------------
618

‎doc/sphinx/ref/azure.keyvault.keys.crypto.aio.rst‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
azure.keyvault.keys.crypto.aio package
2+
======================================
3+
4+
Submodules
5+
----------
6+
7+
azure.keyvault.keys.crypto.aio.client module
8+
--------------------------------------------
9+
10+
.. automodule:: azure.keyvault.keys.crypto.aio.client
11+
:members:
12+
:undoc-members:
13+
:show-inheritance:
14+
15+
16+
Module contents
17+
---------------
18+
19+
.. automodule:: azure.keyvault.keys.crypto.aio
20+
:members:
21+
:undoc-members:
22+
:show-inheritance:

‎doc/sphinx/ref/azure.keyvault.keys.crypto.rst‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
azure.keyvault.keys.crypto package
2+
==================================
3+
4+
Subpackages
5+
-----------
6+
7+
.. toctree::
8+
9+
azure.keyvault.keys.crypto.aio
10+
11+
Submodules
12+
----------
13+
14+
azure.keyvault.keys.crypto.client module
15+
----------------------------------------
16+
17+
.. automodule:: azure.keyvault.keys.crypto.client
18+
:members:
19+
:undoc-members:
20+
:show-inheritance:
21+
22+
azure.keyvault.keys.crypto.enums module
23+
---------------------------------------
24+
25+
.. automodule:: azure.keyvault.keys.crypto.enums
26+
:members:
27+
:undoc-members:
28+
:show-inheritance:
29+
30+
31+
Module contents
32+
---------------
33+
34+
.. automodule:: azure.keyvault.keys.crypto
35+
:members:
36+
:undoc-members:
37+
:show-inheritance:

‎doc/sphinx/ref/azure.keyvault.keys.rst‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,31 @@ Subpackages
77
.. toctree::
88

99
azure.keyvault.keys.aio
10+
azure.keyvault.keys.crypto
1011

1112
Submodules
1213
----------
1314

14-
azure.keyvault.keys.version module
15-
----------------------------------
15+
azure.keyvault.keys.client module
16+
---------------------------------
1617

17-
.. automodule:: azure.keyvault.keys.version
18+
.. automodule:: azure.keyvault.keys.client
19+
:members:
20+
:undoc-members:
21+
:show-inheritance:
22+
23+
azure.keyvault.keys.enums module
24+
--------------------------------
25+
26+
.. automodule:: azure.keyvault.keys.enums
27+
:members:
28+
:undoc-members:
29+
:show-inheritance:
30+
31+
azure.keyvault.keys.models module
32+
---------------------------------
33+
34+
.. automodule:: azure.keyvault.keys.models
1835
:members:
1936
:undoc-members:
2037
:show-inheritance:

‎sdk/keyvault/azure-keyvault-keys/HISTORY.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@
55
- Removed `azure.core.Configuration` from the public API in preparation for a
66
revamped configuration API. Static `create_config` methods have been renamed
77
`_create_config`, and will be removed in a future release.
8+
- Removed `wrap_key` and `unwrap_key` from `KeyClient`. These are now available
9+
through `CryptographyClient`.
810
- This version of the library requires `azure-core` 1.0.0b2
911
- If you later want to revert to a version requiring azure-core 1.0.0b1,
1012
of this or another Azure SDK library, you must explicitly install azure-core
1113
1.0.0b1 as well. For example:
1214
`pip install azure-core==1.0.0b1 azure-keyvault-keys==4.0.0b1`
1315

1416
### New features:
17+
- Added `CryptographyClient`, a client for performing cryptographic operations
18+
(encrypt/decrypt, wrap/unwrap, sign/verify) with a key.
1519
- Distributed tracing framework OpenCensus is now supported
1620
- Added support for HTTP challenge based authentication, allowing clients to
1721
interact with vaults in sovereign clouds.
@@ -54,7 +58,7 @@ only)
5458

5559
### `azure-keyvault` features not implemented in this release
5660
- Certificate management APIs
57-
- Cryptographic operations, e.g. sign, un/wrap, verify, en- and
61+
- Cryptographic operations, e.g. sign, un/wrap_key, verify, en- and
5862
decrypt
5963
- National cloud support. This release supports public global cloud vaults,
6064
e.g. https://{vault-name}.vault.azure.net

‎sdk/keyvault/azure-keyvault-keys/README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,26 @@ for key in keys:
152152
print(key.name)
153153
```
154154
155+
### Cryptographic operations
156+
`CryptographyClient` enables cryptographic operations (encrypt/decrypt,
157+
wrap/unwrap, sign/verify) using a particular key.
158+
159+
```py
160+
from azure.identity import DefaultAzureCredential
161+
from azure.keyvault.keys import KeyClient
162+
from azure.keyvault.keys.crypto import EncryptionAlgorithm
163+
164+
credential = DefaultAzureCredential()
165+
key_client = KeyClient(vault_url=vault_url, credential=credential)
166+
167+
key = key_client.get_key("my-key")
168+
crypto_client = key_client.get_cryptography_client(key)
169+
170+
result = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, plaintext)
171+
crypto_client.decrypt(result.algorithm, result.ciphertext)
172+
```
173+
See the [reference documentation][reference_docs] for more information.
174+
155175
### Async operations
156176
This library includes a complete async API supported on Python 3.5+. To use it, you must
157177
first install an async transport, such as [`aiohttp`](https://pypi.org/project/aiohttp/).

‎sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/aio/client.py‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,16 @@
33
# Licensed under the MIT License.
44
# ------------------------------------
55
from datetime import datetime
6-
from typing import Any, AsyncIterable, Mapping, Optional, Dict, List
6+
from typing import Any, AsyncIterable, Mapping, Optional, Dict, List, Union
77

88
from azure.core.exceptions import ResourceExistsError, ResourceNotFoundError
99
from azure.core.tracing.decorator import distributed_trace
1010
from azure.core.tracing.decorator_async import distributed_trace_async
1111
from azure.keyvault.keys.models import DeletedKey, JsonWebKey, Key, KeyBase, KeyOperationResult
1212
from azure.keyvault.keys._shared import AsyncKeyVaultClientBase
1313

14+
from ..crypto.aio import CryptographyClient
15+
1416

1517
class KeyClient(AsyncKeyVaultClientBase):
1618
"""A high-level asynchronous interface for managing a vault's keys.
@@ -30,6 +32,12 @@ class KeyClient(AsyncKeyVaultClientBase):
3032

3133
# pylint:disable=protected-access
3234

35+
def get_cryptography_client(self, key: Union[Key, str], **kwargs: Any) -> CryptographyClient:
36+
# the initializer requires a credential but won't actually use it in this case because we pass in this
37+
# KeyClient's generated client, whose pipeline (and auth policy) is fully configured
38+
credential = object()
39+
return CryptographyClient(key, credential, generated_client=self._client, **kwargs)
40+
3341
@distributed_trace_async
3442
async def create_key(
3543
self,

‎sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/client.py‎

Lines changed: 9 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
from azure.core.tracing.decorator import distributed_trace
2020

2121
from ._shared import KeyVaultClientBase
22+
from .crypto import CryptographyClient
2223
from .models import Key, KeyBase, DeletedKey, KeyOperationResult
2324

2425

@@ -40,6 +41,14 @@ class KeyClient(KeyVaultClientBase):
4041

4142
# pylint:disable=protected-access
4243

44+
def get_cryptography_client(self, key, **kwargs):
45+
# type: (Union[Key, str], Any) -> CryptographyClient
46+
47+
# the initializer requires a credential but won't actually use it in this case because we pass in this
48+
# KeyClient's generated client, whose pipeline (and auth policy) is fully configured
49+
credential = object()
50+
return CryptographyClient(key, credential, generated_client=self._client, **kwargs)
51+
4352
@distributed_trace
4453
def create_key(
4554
self,
@@ -510,69 +519,3 @@ def import_key(self, name, key, hsm=None, enabled=None, not_before=None, expires
510519
self.vault_url, name, key=key, hsm=hsm, key_attributes=attributes, tags=tags, **kwargs
511520
)
512521
return Key._from_key_bundle(bundle)
513-
514-
@distributed_trace
515-
def wrap_key(self, name, algorithm, value, version=None, **kwargs):
516-
# type: (str, str, Optional[str], bytes, Mapping[str, Any]) -> KeyOperationResult
517-
"""Wraps a symmetric key using a specified key.
518-
519-
The WRAP operation supports encryption of a symmetric key using a key
520-
encryption key that has previously been stored in an Azure Key Vault.
521-
The WRAP operation is only strictly necessary for symmetric keys stored
522-
in Azure Key Vault since protection with an asymmetric key can be
523-
performed using the public portion of the key. This operation is
524-
supported for asymmetric keys as a convenience for callers that have a
525-
key-reference but do not have access to the public key material. This
526-
operation requires the keys/wrapKey permission.
527-
528-
:param str name: The name of the key
529-
:param str version: The version of the key.
530-
:param algorithm: algorithm identifier. Possible values include:
531-
'RSA-OAEP', 'RSA-OAEP-256', 'RSA1_5'
532-
:type algorithm: str or
533-
~azure.security.keyvault.v7_0.models.JsonWebKeyEncryptionAlgorithm
534-
:param value:
535-
:type value: bytes
536-
:returns: The wrapped symmetric key.
537-
:rtype: ~azure.keyvault.keys.models.Key
538-
539-
"""
540-
if version is None:
541-
version = ""
542-
543-
bundle = self._client.wrap_key(
544-
self.vault_url, name, key_version=version, algorithm=algorithm, value=value, **kwargs
545-
)
546-
return KeyOperationResult(id=bundle.kid, value=bundle.result)
547-
548-
@distributed_trace
549-
def unwrap_key(self, name, algorithm, value, version=None, **kwargs):
550-
# type: (str, str, Optional[str], bytes, Mapping[str, Any]) -> KeyOperationResult
551-
"""Unwraps a symmetric key using the specified key that was initially used
552-
for wrapping that key.
553-
554-
The UNWRAP operation supports decryption of a symmetric key using the
555-
target key encryption key. This operation is the reverse of the WRAP
556-
operation. The UNWRAP operation applies to asymmetric and symmetric
557-
keys stored in Azure Key Vault since it uses the private portion of the
558-
key. This operation requires the keys/unwrapKey permission.
559-
560-
:param str name: The name of the key
561-
:param str version: The version of the key.
562-
:param algorithm: algorithm identifier. Possible values include:
563-
'RSA-OAEP', 'RSA-OAEP-256', 'RSA1_5'
564-
:type algorithm: str or
565-
~azure.security.keyvault.v7_0.models.JsonWebKeyEncryptionAlgorithm
566-
:param value:
567-
:type value: bytes
568-
:returns: The unwrapped symmetric key.
569-
:rtype: ~azure.keyvault.keys.models.Key
570-
571-
"""
572-
if version is None:
573-
version = ""
574-
575-
bundle = self._client.unwrap_key(
576-
self.vault_url, name, key_version=version, algorithm=algorithm, value=value, **kwargs
577-
)
578-
return KeyOperationResult(id=bundle.kid, value=bundle.result)

‎sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/crypto/__init__.py‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# ------------------------------------
2+
# Copyright (c) Microsoft Corporation.
3+
# Licensed under the MIT License.
4+
# ------------------------------------
5+
from collections import namedtuple
6+
7+
DecryptResult = namedtuple("DecryptResult", ["decrypted_bytes"])
8+
EncryptResult = namedtuple("EncryptResult", ["key_id", "algorithm", "ciphertext", "authentication_tag"])
9+
SignResult = namedtuple("SignResult", ["key_id", "algorithm", "signature"])
10+
VerifyResult = namedtuple("VerifyResult", ["result"])
11+
UnwrapKeyResult = namedtuple("UnwrapKeyResult", ["unwrapped_bytes"])
12+
WrapKeyResult = namedtuple("WrapKeyResult", ["key_id", "algorithm", "encrypted_key"])
13+
14+
from .client import CryptographyClient
15+
from .enums import EncryptionAlgorithm, KeyWrapAlgorithm, SignatureAlgorithm
16+
17+
18+
__all__ = [
19+
"CryptographyClient",
20+
"DecryptResult",
21+
"EncryptionAlgorithm",
22+
"EncryptResult",
23+
"KeyWrapAlgorithm",
24+
"SignatureAlgorithm",
25+
"SignResult",
26+
"UnwrapKeyResult",
27+
"VerifyResult",
28+
"WrapKeyResult",
29+
]

0 commit comments

Comments
 (0)