package vault.v1

Get desktop application:
View/edit binary Protocol Buffers messages

• rpc Liveness (LivenessRequest, LivenessResponse)

  service.proto:64

  message LivenessRequest

  service.proto:7

  (message has no fields)

  message LivenessResponse

  service.proto:8

  • string status = 1

• rpc CreateDEK (CreateDEKRequest, CreateDEKResponse)

  service.proto:65

  message CreateDEKRequest

  service.proto:40

  • string keyring = 1

  message CreateDEKResponse

  service.proto:44

  • string key_id = 1

• rpc Encrypt (EncryptRequest, EncryptResponse)

  service.proto:66

  message EncryptRequest

  service.proto:12

  • string keyring = 1

  • string data = 2

• rpc EncryptBulk (EncryptBulkRequest, EncryptBulkResponse)

  service.proto:67

  message EncryptBulkRequest

  service.proto:22

  • string keyring = 1

  • repeated string data = 2

  message EncryptBulkResponse

  service.proto:27

  • repeated EncryptResponse encrypted = 1

• rpc Decrypt (DecryptRequest, DecryptResponse)

  service.proto:68

  message DecryptRequest

  service.proto:31

  • string keyring = 1

  • string encrypted = 2

  message DecryptResponse

  service.proto:36

  • string plaintext = 1

• rpc ReEncrypt (ReEncryptRequest, ReEncryptResponse)

  service.proto:71

  ReEncrypt rec

  message ReEncryptRequest

  service.proto:48

  • string keyring = 1

  • string encrypted = 2

  • optional string key_id = 3

    Specify the key_id to use for re-encryption. If not provided, the latest will be used

  message ReEncryptResponse

  service.proto:55

  • string encrypted = 1

  • string key_id = 2

• rpc ReEncryptDEKs (ReEncryptDEKsRequest, ReEncryptDEKsResponse)

  service.proto:72

  message ReEncryptDEKsRequest

  service.proto:60

  (message has no fields)

  message ReEncryptDEKsResponse

  service.proto:61

  (message has no fields)

Used in: Encrypted

• AES_256_GCM = 0

• string id = 1

• int64 created_at = 2

  Linux milliseconds since epoch

• bytes key = 3

Used as response type in: VaultService.Encrypt

Used as field type in: EncryptBulkResponse

• string encrypted = 1

• string key_id = 2

Encrypted contains the output of the encryption and all of the metadata required to decrypt it

Used in: EncryptedDataEncryptionKey

• Algorithm algorithm = 1

• bytes nonce = 2

• bytes ciphertext = 3

• string encryption_key_id = 4

  key id of the key that encrypted this data

• int64 time = 5

  time of encryption we can use this later to figure out if a piece of data should be re-encrypted

This is stored in the database in whatever format the database uses

• string id = 1

• int64 created_at = 2

  Linux milliseconds since epoch

• optional Encrypted encrypted = 3

KeyEncryptionKey is a key used to encrypt data encryption keys

• string id = 1

• int64 created_at = 2

• bytes key = 3