Each Cloud Key Management Service key has a purpose, which defines the cryptographic capabilities of the key. The purpose also determines which algorithms are supported for the key's versions. Each algorithm defines what parameters must be used for each cryptographic operation. Each key also has a protection level that indicates whether cryptographic operations are performed in software or in a hardware security module (HSM).
Key purposes
Cloud KMS provides key purposes for the following scenarios:
| Scenario | Key purpose (SDK) | Key purpose (API) | Supported methods |
|---|---|---|---|
| Symmetric encryption | encryption |
ENCRYPT_DECRYPT |
cryptoKeys.encrypt, cryptoKeys.decrypt |
| Raw symmetric encryption | raw-encryption |
RAW_ENCRYPT_DECRYPT |
cryptoKeys.rawEncrypt, cryptoKeys.rawDecrypt |