将公钥导入 Google KMS

Question

Use Case: client will create public/private keys and provide me the public key. I'm suppose to Encrypt(RSA) the message with public Key and send the message to Client. client will decrypt the message with private Key

Key Generation: Client was generated the public/private keys by using openssl. commands given below.

openssl genrsa -des3 -out private.pem 2048
openssl rsa -in private.pem -outform PEM -pubout -out public.pem 

Challenge: I'm suppose to save the public key somewhere. since we are already utilizing the Google KMS, is there a way I can maintain only the public key in Google KMS? I have gone through https://cloud.google.com/kms/docs/importing-a-key#create_importjob but below command is failing with gcloud.kms.keys.versions.import) INVALID_ARGUMENT: Wrapped key is too short.

Import Command Used:

gcloud kms keys versions import \
   --import-job {job_name} \
   --location {location} \
   --keyring {keyring}  \
   --key {key_name} \
   --algorithm "rsa-decrypt-oaep-2048-sha256"\
   --rsa-aes-wrapped-key-file public.pem

also I'm not able to convert public key to PCKS#8 DER format by executing below command. getting / crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY

openssl pkcs8 -topk8 -nocrypt -inform PEM -outform DER \
    -in /path/to/publicKey.pem \
    -out /path/to/publicKey_formtted.pem

Answer 1

Cloud KMS is designed around securing private or secret keys. In most cryptographic protocols, public keys are not confidential, so you can just store it as metadata for your system and do the encryption locally in your application.

Thanks for using GCP and Cloud KMS.