huaweicloud-encryption-sdk-python 1.2.1__py3-none-any.whl

huaweicloud_encryptionsdk/keyrings/kmskeyring/kms_multi_region_keyring.py

@@ -0,0 +1,8 @@
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+
+class KMSMultiRegionKeyring(KMSKeyring):
+
+    def do_decrypt(self, data_key_materials: DataKeyMaterials):
+        self.real_decrypt(data_key_materials)

huaweicloud_encryptionsdk/keyrings/raw_keyring_factory.py

@@ -0,0 +1,27 @@
+from huaweicloud_encryptionsdk.exception.errors import KeyringNotFoundException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.keyring_factory import KeyringFactory
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_aes_keyring import RawAesKeyring
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_rsa_keyring import RawRSAKeyring
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_sm2_keyring import RawSM2Keyring
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_sm4_keyring import RawSM4Keyring
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_sm4_cbc_keyring import RawSM4CBCKeyring
+from huaweicloud_encryptionsdk.model.enums.keyring_type_enum import KeyringTypeEnum
+
+
+class RawKeyringFactory(KeyringFactory):
+
+    def get_keyring(self, type: str):
+        keyring_type_enum = KeyringTypeEnum.get_raw_keyring_type(type)
+        if keyring_type_enum is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NOT_FOUND_EXCEPTION.message)
+        if keyring_type_enum == KeyringTypeEnum.RAW_AES:
+            return RawAesKeyring()
+        elif keyring_type_enum == KeyringTypeEnum.RAW_RSA:
+            return RawRSAKeyring()
+        elif keyring_type_enum == KeyringTypeEnum.RAW_SM2:
+            return RawSM2Keyring()
+        elif keyring_type_enum == KeyringTypeEnum.RAW_SM4_GCM:
+            return RawSM4Keyring()
+        elif keyring_type_enum == KeyringTypeEnum.RAW_SM4_CBC:
+            return RawSM4CBCKeyring()
+        return None

huaweicloud_encryptionsdk/keyrings/rawkeyring/raw_aes_keyring.py

@@ -0,0 +1,63 @@
+import os
+import logging
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+from huaweicloud_encryptionsdk.common.utils import serialize_context, byte_to_secret_key
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_keyring import RawKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+
+logger = logging.getLogger(__name__)
+
+AES_IV_LEN = 12
+AES_TAG_LEN = 16
+
+
+class RawAesKeyring(RawKeyring):
+
+    def real_encrypt(self, key_bytes: bytes, ciphertext_data_keys: list, data_key_materials: DataKeyMaterials):
+        try:
+            iv = os.urandom(AES_IV_LEN)
+            cipher = Cipher(algorithms.AES(key_bytes), modes.GCM(iv))
+            encryptor = cipher.encryptor()
+            aad = serialize_context(data_key_materials.encryption_contexts)
+            if aad:
+                encryptor.authenticate_additional_data(aad)
+            original_data_key = data_key_materials.plaintext_data_key
+            encrypted = encryptor.update(original_data_key) + encryptor.finalize()
+            encrypted_with_tag = encrypted + encryptor.tag
+            message = iv + encrypted_with_tag
+            ciphertext_data_keys.append(CiphertextDataKey(data_key=message))
+        except Exception as e:
+            raise EncryptException(ErrorMessage.ENCRYPT_EXCEPTION.message, e)
+
+    def real_decrypt(self, key_bytes: bytes, ciphertext_data_key: CiphertextDataKey, data_key_materials: DataKeyMaterials) -> bool:
+        try:
+            data_key = ciphertext_data_key.data_key
+            algo = data_key_materials.crypto_algorithm
+            if algo is not None and len(data_key) < AES_IV_LEN + AES_TAG_LEN:
+                raise ValueError("data key too short")
+            iv = data_key[:AES_IV_LEN]
+            tag = data_key[-AES_TAG_LEN:]
+            ct = data_key[AES_IV_LEN:-AES_TAG_LEN]
+            cipher = Cipher(algorithms.AES(key_bytes), modes.GCM(iv, tag, min_tag_length=AES_TAG_LEN))
+            decryptor = cipher.decryptor()
+            aad = serialize_context(data_key_materials.encryption_contexts)
+            if aad:
+                decryptor.authenticate_additional_data(aad)
+            decrypted = decryptor.update(ct) + decryptor.finalize()
+            algo_name = data_key_materials.crypto_algorithm.get_algorithm_name() if data_key_materials.crypto_algorithm else "AES"
+            data_key_materials.plaintext_data_key = byte_to_secret_key(decrypted, algo_name)
+            return True
+        except Exception:
+            logger.warning("one master key may be not match when decrypt data key in RawAesKeyring")
+        return False
+
+    def get_decrypt_secret_key(self) -> list[bytes]:
+        return self.symmetric_key
+
+    def get_encrypt_secret_key(self) -> list[bytes]:
+        return self.symmetric_key

huaweicloud_encryptionsdk/keyrings/rawkeyring/raw_keyring.py

@@ -0,0 +1,112 @@
+import logging
+from abc import abstractmethod
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from huaweicloud_encryptionsdk.common.utils import is_empty
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, HuaweicloudException, KeyringNotMatchException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.keyring import Keyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+logger = logging.getLogger(__name__)
+
+
+class RawKeyring(Keyring):
+
+    def __init__(self):
+        self._private_key: list[bytes] = []
+        self._public_key: list[bytes] = []
+        self._symmetric_key: list[bytes] = []
+
+    @property
+    def private_key(self):
+        return self._private_key
+
+    def set_private_key(self, keys):
+        if isinstance(keys, list):
+            self._private_key.extend(keys)
+        else:
+            self._private_key.extend(keys)
+
+    @property
+    def public_key(self):
+        return self._public_key
+
+    def set_public_key(self, keys):
+        if isinstance(keys, list):
+            self._public_key.extend(keys)
+        else:
+            self._public_key.extend(keys)
+
+    @property
+    def symmetric_key(self):
+        return self._symmetric_key
+
+    def set_symmetric_key(self, keys):
+        if isinstance(keys, list):
+            self._symmetric_key.extend(keys)
+        else:
+            self._symmetric_key.extend(keys)
+
+    @abstractmethod
+    def get_decrypt_secret_key(self) -> list[bytes]:
+        pass
+
+    @abstractmethod
+    def get_encrypt_secret_key(self) -> list[bytes]:
+        pass
+
+    @abstractmethod
+    def real_encrypt(self, key_bytes: bytes, ciphertext_data_keys: list, data_key_materials: DataKeyMaterials):
+        pass
+
+    @abstractmethod
+    def real_decrypt(self, key_bytes: bytes, ciphertext_data_key: CiphertextDataKey, data_key_materials: DataKeyMaterials) -> bool:
+        pass
+
+    def encrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        encrypt_secret_key = self.get_encrypt_secret_key()
+        if is_empty(encrypt_secret_key):
+            raise HuaweicloudException(ErrorMessage.MASTER_KEY_SHOULD_NOT_NULL.message)
+        try:
+            self._do_encrypt(data_key_materials, encrypt_secret_key)
+        except Exception as e:
+            raise EncryptException(ErrorMessage.ENCRYPT_EXCEPTION.message, e)
+        return data_key_materials
+
+    def _do_encrypt(self, data_key_materials: DataKeyMaterials, master_secret_key: list[bytes]):
+        ciphertext_data_keys = data_key_materials.ciphertext_data_keys
+        with ThreadPoolExecutor() as executor:
+            futures = []
+            for key_bytes in master_secret_key:
+                future = executor.submit(self._encrypt_with_key, key_bytes, ciphertext_data_keys, data_key_materials)
+                futures.append(future)
+            for future in as_completed(futures):
+                try:
+                    future.result()
+                except Exception as e:
+                    logger.warning("encrypt data key error by local master key: %s", e)
+        if len(ciphertext_data_keys) <= 0:
+            raise EncryptException(ErrorMessage.ENCRYPT_DATA_KEY_EXCEPTION.message)
+        data_key_materials.ciphertext_data_keys = ciphertext_data_keys
+
+    def _encrypt_with_key(self, key_bytes, ciphertext_data_keys, data_key_materials):
+        self.real_encrypt(key_bytes, ciphertext_data_keys, data_key_materials)
+
+    def decrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        decrypt_secret_key = self.get_decrypt_secret_key()
+        if is_empty(decrypt_secret_key):
+            raise HuaweicloudException(ErrorMessage.MASTER_KEY_SHOULD_NOT_NULL.message)
+        self._do_decrypt(data_key_materials, decrypt_secret_key)
+        if is_empty(data_key_materials.ciphertext_data_keys):
+            raise KeyringNotMatchException(ErrorMessage.KEYRING_NOT_MATCH_EXCEPTION.message)
+        return data_key_materials
+
+    def _do_decrypt(self, data_key_materials: DataKeyMaterials, master_secret_key: list[bytes]):
+        ciphertext_data_keys = data_key_materials.ciphertext_data_keys
+        for key_bytes in master_secret_key:
+            for ciphertext_data_key in ciphertext_data_keys:
+                is_decrypted = self.real_decrypt(key_bytes, ciphertext_data_key, data_key_materials)
+                if is_decrypted:
+                    return
+        raise KeyringNotMatchException(ErrorMessage.KEYRING_NOT_MATCH_EXCEPTION.message)

huaweicloud_encryptionsdk/keyrings/rawkeyring/raw_rsa_keyring.py

@@ -0,0 +1,55 @@
+import logging
+
+from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives import hashes, serialization
+
+from huaweicloud_encryptionsdk.common.utils import byte_to_secret_key, get_public_key, get_private_key
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_keyring import RawKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+logger = logging.getLogger(__name__)
+
+
+class RawRSAKeyring(RawKeyring):
+
+    def real_encrypt(self, key_bytes: bytes, ciphertext_data_keys: list, data_key_materials: DataKeyMaterials):
+        try:
+            public_key = serialization.load_der_public_key(key_bytes)
+            encode_datakey = data_key_materials.plaintext_data_key
+            encrypted = public_key.encrypt(
+                encode_datakey,
+                padding.OAEP(
+                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                    algorithm=hashes.SHA256(),
+                    label=None
+                )
+            )
+            ciphertext_data_keys.append(CiphertextDataKey(data_key=encrypted))
+        except Exception as e:
+            raise EncryptException(ErrorMessage.ENCRYPT_EXCEPTION.message, e)
+
+    def real_decrypt(self, key_bytes: bytes, ciphertext_data_key: CiphertextDataKey, data_key_materials: DataKeyMaterials) -> bool:
+        try:
+            private_key = serialization.load_der_private_key(key_bytes, password=None)
+            decrypted = private_key.decrypt(
+                ciphertext_data_key.data_key,
+                padding.OAEP(
+                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                    algorithm=hashes.SHA256(),
+                    label=None
+                )
+            )
+            algo_name = data_key_materials.crypto_algorithm.get_algorithm_name() if data_key_materials.crypto_algorithm else "AES"
+            data_key_materials.plaintext_data_key = byte_to_secret_key(decrypted, algo_name)
+            return True
+        except Exception:
+            logger.warning("one master key may be not match when decrypt data key in RawRSAKeyring")
+        return False
+
+    def get_encrypt_secret_key(self) -> list[bytes]:
+        return self.public_key
+
+    def get_decrypt_secret_key(self) -> list[bytes]:
+        return self.private_key

huaweicloud_encryptionsdk/keyrings/rawkeyring/raw_sm2_keyring.py

@@ -0,0 +1,75 @@
+import logging
+
+from huaweicloud_encryptionsdk.common.utils import byte_to_secret_key
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_keyring import RawKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+logger = logging.getLogger(__name__)
+
+
+def _extract_ec_point_from_der(der_bytes: bytes) -> tuple:
+    idx = der_bytes.find(b'\x03')
+    if idx < 0:
+        raise ValueError("Invalid EC public key DER: BIT STRING not found")
+    pos = idx + 1
+    if der_bytes[pos] == 0x81:
+        content_start = pos + 2
+    elif der_bytes[pos] == 0x82:
+        content_start = pos + 3
+    else:
+        content_start = pos + 1
+    content_start += 1
+    if der_bytes[content_start] != 0x04:
+        raise ValueError("Invalid EC public key DER: uncompressed point not found")
+    coord_len = (len(der_bytes) - content_start - 1) // 2
+    x = int.from_bytes(der_bytes[content_start + 1:content_start + 1 + coord_len], 'big')
+    y = int.from_bytes(der_bytes[content_start + 1 + coord_len:content_start + 1 + 2 * coord_len], 'big')
+    return x, y
+
+
+def _extract_ec_private_from_der(der_bytes: bytes) -> int:
+    from cryptography.hazmat.primitives.serialization import load_der_private_key
+    pri_key = load_der_private_key(der_bytes, password=None)
+    return pri_key.private_numbers().private_value
+
+
+class RawSM2Keyring(RawKeyring):
+
+    def real_encrypt(self, key_bytes: bytes, ciphertext_data_keys: list, data_key_materials: DataKeyMaterials):
+        try:
+            from gmssl import sm2
+            try:
+                x, y = _extract_ec_point_from_der(key_bytes)
+                public_key_hex = "04" + format(x, '064x') + format(y, '064x')
+            except Exception:
+                public_key_hex = key_bytes.hex()
+            sm2_crypt = sm2.CryptSM2(public_key=public_key_hex, private_key="")
+            encrypted = sm2_crypt.encrypt(data_key_materials.plaintext_data_key)
+            ciphertext_data_keys.append(CiphertextDataKey(data_key=encrypted))
+        except Exception as e:
+            raise EncryptException(ErrorMessage.ENCRYPT_EXCEPTION.message, e)
+
+    def real_decrypt(self, key_bytes: bytes, ciphertext_data_key: CiphertextDataKey, data_key_materials: DataKeyMaterials) -> bool:
+        try:
+            from gmssl import sm2
+            try:
+                d = _extract_ec_private_from_der(key_bytes)
+                private_key_hex = format(d, '064x')
+            except Exception:
+                private_key_hex = key_bytes.hex()
+            sm2_crypt = sm2.CryptSM2(public_key="", private_key=private_key_hex)
+            decrypted = sm2_crypt.decrypt(ciphertext_data_key.data_key)
+            algo_name = data_key_materials.crypto_algorithm.get_algorithm_name() if data_key_materials.crypto_algorithm else "SM4"
+            data_key_materials.plaintext_data_key = byte_to_secret_key(decrypted, algo_name)
+            return True
+        except Exception:
+            logger.warning("one master key may be not match when decrypt data key in RawSM2Keyring")
+        return False
+
+    def get_encrypt_secret_key(self) -> list[bytes]:
+        return self.public_key
+
+    def get_decrypt_secret_key(self) -> list[bytes]:
+        return self.private_key

huaweicloud_encryptionsdk/keyrings/rawkeyring/raw_sm4_cbc_keyring.py

@@ -0,0 +1,66 @@
+import os
+import logging
+
+from huaweicloud_encryptionsdk.common.utils import serialize_context, byte_to_secret_key
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_keyring import RawKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+
+logger = logging.getLogger(__name__)
+
+SM4_CBC_IV_LEN = 16
+
+
+class RawSM4CBCKeyring(RawKeyring):
+
+    def real_encrypt(self, key_bytes: bytes, ciphertext_data_keys: list, data_key_materials: DataKeyMaterials):
+        try:
+            iv = os.urandom(SM4_CBC_IV_LEN)
+            from gmssl.sm4 import CryptSM4, SM4_ENCRYPT
+            original_data_key = data_key_materials.plaintext_data_key
+            padded = self._pkcs7_pad(original_data_key, 16)
+            crypt_sm4 = CryptSM4()
+            crypt_sm4.set_key(key_bytes, SM4_ENCRYPT)
+            encrypted = crypt_sm4.crypt_cbc(iv, padded)
+            message = iv + encrypted
+            ciphertext_data_keys.append(CiphertextDataKey(data_key=message))
+        except Exception as e:
+            raise EncryptException(ErrorMessage.ENCRYPT_EXCEPTION.message, e)
+
+    def real_decrypt(self, key_bytes: bytes, ciphertext_data_key: CiphertextDataKey, data_key_materials: DataKeyMaterials) -> bool:
+        try:
+            data_key = ciphertext_data_key.data_key
+            algo = data_key_materials.crypto_algorithm
+            if algo is not None and len(data_key) < SM4_CBC_IV_LEN:
+                raise ValueError("data key too short")
+            iv = data_key[:SM4_CBC_IV_LEN]
+            ct = data_key[SM4_CBC_IV_LEN:]
+            from gmssl.sm4 import CryptSM4, SM4_DECRYPT
+            crypt_sm4 = CryptSM4()
+            crypt_sm4.set_key(key_bytes, SM4_DECRYPT)
+            decrypted = crypt_sm4.crypt_cbc(iv, ct)
+            decrypted = self._pkcs7_unpad(decrypted)
+            algo_name = data_key_materials.crypto_algorithm.get_algorithm_name() if data_key_materials.crypto_algorithm else "SM4"
+            data_key_materials.plaintext_data_key = byte_to_secret_key(decrypted, algo_name)
+            return True
+        except Exception:
+            logger.warning("one master key may be not match when decrypt data key in RawSM4CBCKeyring")
+        return False
+
+    def get_encrypt_secret_key(self) -> list[bytes]:
+        return self.symmetric_key
+
+    def get_decrypt_secret_key(self) -> list[bytes]:
+        return self.symmetric_key
+
+    @staticmethod
+    def _pkcs7_pad(data, block_size):
+        pad_len = block_size - (len(data) % block_size)
+        return data + bytes([pad_len] * pad_len)
+
+    @staticmethod
+    def _pkcs7_unpad(data):
+        pad_len = data[-1]
+        return data[:-pad_len]

huaweicloud_encryptionsdk/keyrings/rawkeyring/raw_sm4_keyring.py

@@ -0,0 +1,70 @@
+import os
+import logging
+
+from huaweicloud_encryptionsdk.common.utils import serialize_context, byte_to_secret_key
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.rawkeyring.raw_keyring import RawKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+
+logger = logging.getLogger(__name__)
+
+SM4_GCM_IV_LEN = 12
+SM4_GCM_TAG_LEN = 16
+
+
+class RawSM4Keyring(RawKeyring):
+
+    def real_encrypt(self, key_bytes: bytes, ciphertext_data_keys: list, data_key_materials: DataKeyMaterials):
+        try:
+            iv = os.urandom(SM4_GCM_IV_LEN)
+            from cryptography.hazmat.primitives.ciphers import Cipher as _Cipher, algorithms as _algs, modes as _modes
+
+            sm4_alg = _algs.SM4(key_bytes)
+            gcm = _modes.GCM(iv)
+            cipher = _Cipher(sm4_alg, gcm)
+            encryptor = cipher.encryptor()
+            aad = serialize_context(data_key_materials.encryption_contexts)
+            if aad:
+                encryptor.authenticate_additional_data(aad)
+            original_data_key = data_key_materials.plaintext_data_key
+            encrypted = encryptor.update(original_data_key) + encryptor.finalize()
+            encrypted_with_tag = encrypted + encryptor.tag
+            message = iv + encrypted_with_tag
+            ciphertext_data_keys.append(CiphertextDataKey(data_key=message))
+        except Exception as e:
+            raise EncryptException(ErrorMessage.ENCRYPT_EXCEPTION.message, e)
+
+    def real_decrypt(self, key_bytes: bytes, ciphertext_data_key: CiphertextDataKey, data_key_materials: DataKeyMaterials) -> bool:
+        try:
+            data_key = ciphertext_data_key.data_key
+            algo = data_key_materials.crypto_algorithm
+            if algo is not None and len(data_key) < SM4_GCM_IV_LEN + SM4_GCM_TAG_LEN:
+                raise ValueError("data key too short")
+            iv = data_key[:SM4_GCM_IV_LEN]
+            tag = data_key[-SM4_GCM_TAG_LEN:]
+            ct = data_key[SM4_GCM_IV_LEN:-SM4_GCM_TAG_LEN]
+
+            from cryptography.hazmat.primitives.ciphers import Cipher as _Cipher, algorithms as _algs, modes as _modes
+
+            sm4_alg = _algs.SM4(key_bytes)
+            gcm = _modes.GCM(iv, tag, min_tag_length=SM4_GCM_TAG_LEN)
+            cipher = _Cipher(sm4_alg, gcm)
+            decryptor = cipher.decryptor()
+            aad = serialize_context(data_key_materials.encryption_contexts)
+            if aad:
+                decryptor.authenticate_additional_data(aad)
+            decrypted = decryptor.update(ct) + decryptor.finalize()
+            algo_name = data_key_materials.crypto_algorithm.get_algorithm_name() if data_key_materials.crypto_algorithm else "SM4"
+            data_key_materials.plaintext_data_key = byte_to_secret_key(decrypted, algo_name)
+            return True
+        except Exception:
+            logger.warning("one master key may be not match when decrypt data key in RawSM4Keyring")
+        return False
+
+    def get_encrypt_secret_key(self) -> list[bytes]:
+        return self.symmetric_key
+
+    def get_decrypt_secret_key(self) -> list[bytes]:
+        return self.symmetric_key

huaweicloud_encryptionsdk/kms/create_key_capsule_request.py

@@ -0,0 +1,35 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class CreateKeyCapsuleRequest:
+    key_id: Optional[str] = None
+    datakey_length: int = 0
+    public_key: Optional[str] = None
+    policy_id: Optional[str] = None
+    key_policy: Optional[str] = None
+
+    def to_dict(self):
+        result = {}
+        if self.key_id is not None:
+            result["key_id"] = self.key_id
+        if self.datakey_length is not None:
+            result["datakey_length"] = self.datakey_length
+        if self.public_key is not None:
+            result["public_key"] = self.public_key
+        if self.policy_id is not None:
+            result["policy_id"] = self.policy_id
+        if self.key_policy is not None:
+            result["key_policy"] = self.key_policy
+        return result
+
+    @classmethod
+    def from_dict(cls, data):
+        return cls(
+            key_id=data.get("key_id"),
+            datakey_length=data.get("datakey_length", 0),
+            public_key=data.get("public_key"),
+            policy_id=data.get("policy_id"),
+            key_policy=data.get("key_policy"),
+        )

huaweicloud_encryptionsdk/kms/create_key_capsule_response.py

@@ -0,0 +1,19 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class CreateKeyCapsuleResponse:
+    key_id: Optional[str] = None
+    datakey_cipher: Optional[str] = None
+    datakey: Optional[str] = None
+    datakey_capsule: Optional[str] = None
+
+    @classmethod
+    def from_dict(cls, data):
+        return cls(
+            key_id=data.get("key_id"),
+            datakey_cipher=data.get("datakey_cipher"),
+            datakey=data.get("datakey"),
+            datakey_capsule=data.get("datakey_capsule"),
+        )

huaweicloud_encryptionsdk/kms/decrypt_key_capsule_request.py

@@ -0,0 +1,32 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class DecryptKeyCapsuleRequest:
+    key_id: Optional[str] = None
+    datakey_capsule: Optional[str] = None
+    attestation_document: Optional[object] = None
+
+    def to_dict(self):
+        result = {}
+        if self.key_id is not None:
+            result["key_id"] = self.key_id
+        if self.datakey_capsule is not None:
+            result["datakey_capsule"] = self.datakey_capsule
+        if self.attestation_document is not None:
+            if hasattr(self.attestation_document, 'to_dict'):
+                result["attestation_document"] = self.attestation_document.to_dict()
+            elif hasattr(self.attestation_document, '__dict__'):
+                result["attestation_document"] = self.attestation_document.__dict__
+            else:
+                result["attestation_document"] = self.attestation_document
+        return result
+
+    @classmethod
+    def from_dict(cls, data):
+        return cls(
+            key_id=data.get("key_id"),
+            datakey_capsule=data.get("datakey_capsule"),
+            attestation_document=data.get("attestation_document"),
+        )

huaweicloud_encryptionsdk/kms/decrypt_key_capsule_response.py

@@ -0,0 +1,19 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class DecryptKeyCapsuleResponse:
+    key_id: Optional[str] = None
+    datakey: Optional[str] = None
+    datakey_cipher: Optional[str] = None
+    instance_id: Optional[str] = None
+
+    @classmethod
+    def from_dict(cls, data):
+        return cls(
+            key_id=data.get("key_id"),
+            datakey=data.get("datakey"),
+            datakey_cipher=data.get("datakey_cipher"),
+            instance_id=data.get("instance_id"),
+        )