huaweicloud-encryption-sdk-python 1.2.1__py3-none-any.whl

huaweicloud_encryptionsdk/meterialmanager/cache_crypto_meterial_manager.py

@@ -0,0 +1,221 @@
+import struct
+import base64
+import logging
+from typing import Dict, List, Optional
+
+from huaweicloud_encryptionsdk.meterialmanager.crypto_meterial_manager import CryptoMaterialManager
+from huaweicloud_encryptionsdk.meterialmanager.default_crypto_meterials_manager import DefaultCryptoMaterialsManager
+from huaweicloud_encryptionsdk.cache.data_key_cache import DataKeyCache, UsageStatus
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.key_capsule import KeyCapsule
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.common.constants import NUM_1
+from huaweicloud_encryptionsdk.common.crypto_factory import CryptoFactory
+from huaweicloud_encryptionsdk.common.utils import serialize_context
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+
+logger = logging.getLogger(__name__)
+
+
+class CacheCryptoMaterialsManager(CryptoMaterialManager):
+
+    CACHE_ID_ALGORITHM_SHA = "SHA-256"
+    CACHE_ID_ALGORITHM_SM3 = "SM3"
+    DEFAULT_MESSAGE_LIMIT = 0x7FFFFFFF
+    DEFAULT_BYTE_LIMIT = 0x7FFFFFFFFFFFFFFF
+
+    def __init__(self, cache: DataKeyCache, huawei_config):
+        self._cache = cache
+        self._max_byte_limit = self.DEFAULT_BYTE_LIMIT
+        self._max_message_limit = self.DEFAULT_MESSAGE_LIMIT
+        self._huawei_config = huawei_config
+        self._crypto_material_manager = DefaultCryptoMaterialsManager(huawei_config)
+
+    @property
+    def max_byte_limit(self) -> int:
+        return self._max_byte_limit
+
+    def set_survival_time(self, survival_time: int) -> "CacheCryptoMaterialsManager":
+        if survival_time <= 0:
+            raise HuaweicloudException(ErrorMessage.CACHE_PARAM_LESS_THAN_ZERO.message)
+        self._cache.set_survival_time(survival_time)
+        return self
+
+    def set_max_message_limit(self, max_message_limit: int) -> "CacheCryptoMaterialsManager":
+        if max_message_limit <= 0:
+            raise HuaweicloudException(ErrorMessage.CACHE_PARAM_LESS_THAN_ZERO.message)
+        self._max_message_limit = max_message_limit
+        return self
+
+    def set_max_byte_limit(self, max_byte_limit: int) -> "CacheCryptoMaterialsManager":
+        if max_byte_limit <= 0:
+            raise HuaweicloudException(ErrorMessage.CACHE_PARAM_LESS_THAN_ZERO.message)
+        self._max_byte_limit = max_byte_limit
+        return self
+
+    def get_materials_for_encrypt(self, keyring, data_key_materials: DataKeyMaterials, plain_text_length: int) -> DataKeyMaterials:
+        cache_id = self._get_cache_id(data_key_materials)
+        usage_status = UsageStatus(plain_text_length, NUM_1)
+        entry_for_encrypt = self._cache.get_entry_for_encrypt(cache_id, usage_status)
+        if entry_for_encrypt is not None:
+            usage_status_new = entry_for_encrypt.get_usage_status()
+            if self._check_exceed_limit(usage_status_new):
+                logger.info("get encrypt dataKeyMaterials from cache success, cacheId %s", cache_id)
+                return entry_for_encrypt.get_data_key_materials()
+            logger.info("dataKeyMaterials of cacheId %s exceed message limit, generate data key again", cache_id)
+            entry_for_encrypt.invalidate()
+        logger.info("dataKeyMaterials of cacheId %s not exists or expired, generate data key again", cache_id)
+        self._crypto_material_manager.get_materials_for_encrypt(keyring, data_key_materials, plain_text_length)
+        self._cache.put_entry_for_encrypt(cache_id, data_key_materials, usage_status)
+        return data_key_materials
+
+    def get_materials_for_decrypt(self, keyring, cipher_text: bytes) -> DataKeyMaterials:
+        from huaweicloud_encryptionsdk.handler.default_serialize_handler import DefaultSerializeHandler
+        data_materials = DefaultSerializeHandler().deserialize(cipher_text)
+        headers = data_materials.headers
+        cache_id = self._get_cache_id_from_headers(
+            headers.algorithm, headers.encryption_context,
+            headers.ciphertext_data_keys, headers.key_capsule,
+        )
+        entry_for_decrypt = self._cache.get_entry_for_decrypt(cache_id)
+        if entry_for_decrypt is not None:
+            logger.info("get decrypt dataKeyMaterials from cache success, cacheId %s", cache_id)
+            return entry_for_decrypt.get_data_key_materials()
+        logger.info("dataKeyMaterials of cacheId %s not exists or expired, Re-decrypt the dataKey", cache_id)
+        data_key_materials = DataKeyMaterials()
+        data_key_materials.ciphertext_data_keys = headers.ciphertext_data_keys
+        data_key_materials.crypto_algorithm = headers.algorithm
+        data_key_materials.encryption_contexts = headers.encryption_context
+        if headers.key_capsule is not None:
+            data_key_materials.key_capsule = headers.key_capsule
+        data_key_materials = keyring.decrypt_data_key(data_key_materials)
+        self._cache.put_entry_for_decrypt(cache_id, data_key_materials)
+        return data_key_materials
+
+    def get_materials_for_stream_decrypt(self, keyring, input_stream) -> DataKeyMaterials:
+        from huaweicloud_encryptionsdk.handler.default_serialize_handler import DefaultSerializeHandler
+        length_byte = input_stream.read(2)
+        if len(length_byte) != 2:
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        length = struct.unpack(">h", length_byte)[0]
+        bytes_data = input_stream.read(length)
+        if len(bytes_data) != length:
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        data_materials = DefaultSerializeHandler().deserialize(bytes_data)
+        cache_id = self._get_cache_id_from_headers(
+            data_materials.headers.algorithm,
+            data_materials.headers.encryption_context,
+            data_materials.headers.ciphertext_data_keys,
+            data_materials.headers.key_capsule,
+        )
+        entry_for_decrypt = self._cache.get_entry_for_decrypt(cache_id)
+        if entry_for_decrypt is not None:
+            logger.info("get decrypt dataKeyMaterials from cache success, cacheId %s", cache_id)
+            return entry_for_decrypt.get_data_key_materials()
+        logger.info("dataKeyMaterials of cacheId %s not exists or expired, Re-decrypt the dataKey", cache_id)
+        data_key_materials = DataKeyMaterials()
+        data_key_materials.ciphertext_data_keys = data_materials.headers.ciphertext_data_keys
+        data_key_materials.crypto_algorithm = data_materials.headers.algorithm
+        data_key_materials.encryption_contexts = data_materials.headers.encryption_context
+        if data_materials.headers.key_capsule is not None:
+            data_key_materials.key_capsule = data_materials.headers.key_capsule
+        keyring.decrypt_data_key(data_key_materials)
+        self._cache.put_entry_for_decrypt(cache_id, data_key_materials)
+        return data_key_materials
+
+    def _get_cache_id(self, data_key_materials: DataKeyMaterials) -> str:
+        try:
+            algorithm = data_key_materials.crypto_algorithm
+            if algorithm in (CryptoAlgorithm.SM4_128_GCM_NOPADDING, CryptoAlgorithm.SM4_128_CBC_PADDING):
+                digest = CryptoFactory.get_message_digest(self.CACHE_ID_ALGORITHM_SM3)
+            else:
+                digest = CryptoFactory.get_message_digest(self.CACHE_ID_ALGORITHM_SHA)
+            self._digest_algorithm(algorithm, digest)
+            bytes_ctx = serialize_context(data_key_materials.encryption_contexts)
+            self._digest_context(digest, bytes_ctx)
+            self._digest_key_capsule_from_config(digest, self._huawei_config, data_key_materials)
+            return base64.b64encode(digest.digest()).decode("utf-8")
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.MESSAGE_DIGEST_ERROR.message, e)
+
+    def _get_cache_id_from_headers(self, algorithm, encryption_context, ciphertext_data_keys, key_capsule) -> str:
+        try:
+            if algorithm in (CryptoAlgorithm.SM4_128_GCM_NOPADDING, CryptoAlgorithm.SM4_128_CBC_PADDING):
+                digest = CryptoFactory.get_message_digest(self.CACHE_ID_ALGORITHM_SM3)
+            else:
+                digest = CryptoFactory.get_message_digest(self.CACHE_ID_ALGORITHM_SHA)
+            self._digest_algorithm(algorithm, digest)
+            bytes_ctx = serialize_context(encryption_context)
+            self._digest_context(digest, bytes_ctx)
+            self._digest_ciphertext_data_keys(digest, ciphertext_data_keys)
+            self._digest_key_capsule(digest, key_capsule)
+            return base64.b64encode(digest.digest()).decode("utf-8")
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.MESSAGE_DIGEST_ERROR.message, e)
+
+    @staticmethod
+    def _digest_context(digest, bytes_ctx: bytes) -> None:
+        if len(bytes_ctx) == 0:
+            digest.update(b'\x00')
+        else:
+            digest.update(bytes_ctx)
+
+    @staticmethod
+    def _digest_algorithm(algorithm, digest) -> None:
+        if algorithm is None:
+            digest.update(b'\x00')
+        else:
+            digest.update(b'\x01')
+            digest.update(algorithm.key_spec.encode("utf-8"))
+
+    def _check_exceed_limit(self, usage_status: UsageStatus) -> bool:
+        return (usage_status.bytes_encrypt_count <= self._max_byte_limit
+                and usage_status.message_encrypt_count <= self._max_message_limit)
+
+    @staticmethod
+    def _digest_ciphertext_data_keys(digest, ciphertext_data_keys) -> None:
+        if ciphertext_data_keys is None:
+            digest.update(b'\x00')
+        else:
+            digest.update(b'\x01')
+            digest.update(bytes([len(ciphertext_data_keys)]))
+            sorted_keys = sorted(ciphertext_data_keys, key=lambda k: k.data_key if hasattr(k, 'data_key') else b'')
+            for cdk in sorted_keys:
+                if hasattr(cdk, 'to_byte_array'):
+                    digest.update(cdk.to_byte_array())
+                elif hasattr(cdk, 'data_key'):
+                    digest.update(cdk.data_key)
+
+    @staticmethod
+    def _digest_key_capsule(digest, key_capsule: Optional[KeyCapsule]) -> None:
+        if key_capsule is None:
+            digest.update(b'\x00')
+        else:
+            digest.update(b'\x01')
+            if key_capsule.key_id is not None:
+                digest.update(key_capsule.key_id.encode("utf-8"))
+            if key_capsule.datakey_capsule is not None:
+                digest.update(key_capsule.datakey_capsule.encode("utf-8"))
+            digest.update(bytes([key_capsule.access_point_type]))
+
+    @staticmethod
+    def _digest_key_capsule_from_config(digest, huawei_config, data_key_materials: DataKeyMaterials) -> None:
+        key_capsule_config = huawei_config.key_capsule_config if huawei_config else None
+        if key_capsule_config is None:
+            digest.update(b'\x00')
+        else:
+            digest.update(b'\x01')
+            from huaweicloud_encryptionsdk.common.utils import get_capsule_kms_config
+            kms_config = get_capsule_kms_config(huawei_config.kms_config_list, key_capsule_config)
+            if kms_config and kms_config.key_id:
+                digest.update(kms_config.key_id.encode("utf-8"))
+            if data_key_materials.key_policy or data_key_materials.policy_id:
+                if data_key_materials.key_policy:
+                    digest.update(data_key_materials.key_policy.encode("utf-8"))
+                elif data_key_materials.policy_id:
+                    digest.update(data_key_materials.policy_id.encode("utf-8"))
+            else:
+                if key_capsule_config.default_key_policy:
+                    digest.update(key_capsule_config.default_key_policy.encode("utf-8"))
+                elif key_capsule_config.default_policy_id:
+                    digest.update(key_capsule_config.default_policy_id.encode("utf-8"))

huaweicloud_encryptionsdk/meterialmanager/crypto_meterial_manager.py

@@ -0,0 +1,19 @@
+from abc import ABC, abstractmethod
+from typing import Optional
+
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+
+class CryptoMaterialManager(ABC):
+
+    @abstractmethod
+    def get_materials_for_encrypt(self, keyring, data_key_materials: DataKeyMaterials, plain_text_length: int) -> DataKeyMaterials:
+        pass
+
+    @abstractmethod
+    def get_materials_for_decrypt(self, keyring, cipher_text: bytes) -> DataKeyMaterials:
+        pass
+
+    @abstractmethod
+    def get_materials_for_stream_decrypt(self, keyring, input_stream) -> DataKeyMaterials:
+        pass

huaweicloud_encryptionsdk/meterialmanager/data_key_generate.py

@@ -0,0 +1,10 @@
+from abc import ABC, abstractmethod
+
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+
+class DataKeyGenerate(ABC):
+
+    @abstractmethod
+    def data_key_generate(self, huawei_config, data_key_materials: DataKeyMaterials) -> None:
+        pass

huaweicloud_encryptionsdk/meterialmanager/data_key_generate_factory.py

@@ -0,0 +1,20 @@
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.meterialmanager.data_key_generate import DataKeyGenerate
+from huaweicloud_encryptionsdk.meterialmanager.local_data_key_generate import LocalDataKeyGenerate
+from huaweicloud_encryptionsdk.meterialmanager.kms_data_key_generate import KmsDataKeyGenerate
+from huaweicloud_encryptionsdk.meterialmanager.key_capsule_data_key_generate import KeyCapsuleDataKeyGenerate
+from huaweicloud_encryptionsdk.model.enums.data_key_generate_type import DataKeyGenerateType
+
+
+class DataKeyGenerateFactory:
+
+    @staticmethod
+    def get_data_key_generate(data_key_generate_type: DataKeyGenerateType) -> DataKeyGenerate:
+        if data_key_generate_type == DataKeyGenerateType.LOCAL_GENERATE:
+            return LocalDataKeyGenerate()
+        elif data_key_generate_type == DataKeyGenerateType.KMS_GENERATE:
+            return KmsDataKeyGenerate()
+        elif data_key_generate_type == DataKeyGenerateType.KEY_CAPSULE_GENERATE:
+            return KeyCapsuleDataKeyGenerate()
+        else:
+            raise HuaweicloudException(ErrorMessage.DATA_KEY_GENERATE_EXCEPTION.message)

huaweicloud_encryptionsdk/meterialmanager/default_crypto_meterials_manager.py

@@ -0,0 +1,71 @@
+import struct
+from typing import Optional
+
+from huaweicloud_encryptionsdk.meterialmanager.crypto_meterial_manager import CryptoMaterialManager
+from huaweicloud_encryptionsdk.meterialmanager.data_key_generate_factory import DataKeyGenerateFactory
+from huaweicloud_encryptionsdk.model.enums.data_key_generate_type import DataKeyGenerateType
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+
+
+class DefaultCryptoMaterialsManager(CryptoMaterialManager):
+
+    def __init__(self, huawei_config=None):
+        self._huawei_config = huawei_config
+
+    def get_materials_for_encrypt(self, keyring, data_key_materials: DataKeyMaterials, plain_text_length: int) -> DataKeyMaterials:
+        from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_key_capsule_keyring import KMSKeyCapsuleKeyring
+        from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+        if isinstance(keyring, KMSKeyCapsuleKeyring):
+            data_key_generate = DataKeyGenerateFactory.get_data_key_generate(DataKeyGenerateType.KEY_CAPSULE_GENERATE)
+            if hasattr(keyring, 'set_huawei_config'):
+                keyring.set_huawei_config(self._huawei_config)
+        elif isinstance(keyring, KMSKeyring):
+            data_key_generate = DataKeyGenerateFactory.get_data_key_generate(DataKeyGenerateType.KMS_GENERATE)
+            if hasattr(keyring, 'set_huawei_config'):
+                keyring.set_huawei_config(self._huawei_config)
+        else:
+            data_key_generate = DataKeyGenerateFactory.get_data_key_generate(DataKeyGenerateType.LOCAL_GENERATE)
+        data_key_generate.data_key_generate(self._huawei_config, data_key_materials)
+        return keyring.encrypt_data_key(data_key_materials)
+
+    def get_materials_for_decrypt(self, keyring, cipher_text: bytes) -> DataKeyMaterials:
+        from huaweicloud_encryptionsdk.handler.default_serialize_handler import DefaultSerializeHandler
+        data_key_materials = DataKeyMaterials()
+        data_materials = DefaultSerializeHandler().deserialize(cipher_text)
+        data_key_materials.ciphertext_data_keys = data_materials.headers.ciphertext_data_keys
+        data_key_materials.crypto_algorithm = data_materials.headers.algorithm
+        data_key_materials.encryption_contexts = data_materials.headers.encryption_context
+        if data_materials.headers.key_capsule is not None:
+            data_key_materials.key_capsule = data_materials.headers.key_capsule
+        from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_key_capsule_keyring import KMSKeyCapsuleKeyring
+        from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+        if isinstance(keyring, KMSKeyCapsuleKeyring) and hasattr(keyring, 'set_huawei_config'):
+            keyring.set_huawei_config(self._huawei_config)
+        elif isinstance(keyring, KMSKeyring) and hasattr(keyring, 'set_huawei_config'):
+            keyring.set_huawei_config(self._huawei_config)
+        return keyring.decrypt_data_key(data_key_materials)
+
+    def get_materials_for_stream_decrypt(self, keyring, input_stream) -> DataKeyMaterials:
+        from huaweicloud_encryptionsdk.handler.default_serialize_handler import DefaultSerializeHandler
+        length_byte = input_stream.read(2)
+        if len(length_byte) != 2:
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        length = struct.unpack(">h", length_byte)[0]
+        bytes_data = input_stream.read(length)
+        if len(bytes_data) != length:
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        data_materials = DefaultSerializeHandler().deserialize(bytes_data)
+        data_key_materials = DataKeyMaterials()
+        data_key_materials.ciphertext_data_keys = data_materials.headers.ciphertext_data_keys
+        data_key_materials.crypto_algorithm = data_materials.headers.algorithm
+        data_key_materials.encryption_contexts = data_materials.headers.encryption_context
+        if data_materials.headers.key_capsule is not None:
+            data_key_materials.key_capsule = data_materials.headers.key_capsule
+        from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_key_capsule_keyring import KMSKeyCapsuleKeyring
+        from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+        if isinstance(keyring, KMSKeyCapsuleKeyring) and hasattr(keyring, 'set_huawei_config'):
+            keyring.set_huawei_config(self._huawei_config)
+        elif isinstance(keyring, KMSKeyring) and hasattr(keyring, 'set_huawei_config'):
+            keyring.set_huawei_config(self._huawei_config)
+        return keyring.decrypt_data_key(data_key_materials)

huaweicloud_encryptionsdk/meterialmanager/key_capsule_data_key_generate.py

@@ -0,0 +1,63 @@
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.meterialmanager.data_key_generate import DataKeyGenerate
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.model.key_capsule import KeyCapsule
+from huaweicloud_encryptionsdk.common.utils import is_empty, hex_to_bytes, get_capsule_kms_config
+
+
+class KeyCapsuleDataKeyGenerate(DataKeyGenerate):
+
+    def data_key_generate(self, huawei_config, data_key_materials) -> None:
+        kms_config = get_capsule_kms_config(huawei_config.kms_config_list, huawei_config.key_capsule_config)
+        response = self._create_key_capsule_by_kms(data_key_materials, huawei_config.key_capsule_config, huawei_config, kms_config)
+        key_capsule = self._parse_key_capsule(response, huawei_config.key_capsule_config)
+        plaintext_data_key = self._parse_plaintext_data_key(response)
+        data_key_materials.key_capsule = key_capsule
+        data_key_materials.plaintext_data_key = plaintext_data_key
+
+    @staticmethod
+    def _create_key_capsule_by_kms(data_key_materials, config, huawei_config, kms_config):
+        try:
+            from huaweicloud_encryptionsdk.kms.kms_http_client import KmsHttpClient
+            from huaweicloud_encryptionsdk.kms.create_key_capsule_request import CreateKeyCapsuleRequest
+            client = KmsHttpClient(huawei_config.get_ak(), huawei_config.get_sk(), kms_config, huawei_config.security_token)
+            request = KeyCapsuleDataKeyGenerate._build_request_body(data_key_materials, config, huawei_config, kms_config)
+            return client.post("/kms/datakey-capsule/create", request)
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.KMS_CREATE_KEY_EXCEPTION.message, e)
+
+    @staticmethod
+    def _build_request_body(data_key_materials, config, huawei_config, kms_config):
+        crypto_algorithm = huawei_config.crypto_algorithm
+        if crypto_algorithm == CryptoAlgorithm.SM4_128_GCM_NOPADDING:
+            crypto_algorithm = CryptoAlgorithm.AES_128_GCM_NOPADDING
+        from huaweicloud_encryptionsdk.kms.create_key_capsule_request import CreateKeyCapsuleRequest
+        body = CreateKeyCapsuleRequest(
+            key_id=kms_config.key_id,
+            datakey_length=crypto_algorithm.datakey_length,
+        )
+        policy_id = data_key_materials.policy_id
+        key_policy = data_key_materials.key_policy
+        if policy_id is None and key_policy is None:
+            policy_id = config.default_policy_id if config else None
+            key_policy = config.default_key_policy if config else None
+        if key_policy:
+            body.key_policy = key_policy
+        elif policy_id:
+            body.policy_id = policy_id
+        return body
+
+    @staticmethod
+    def _parse_key_capsule(response, config):
+        return KeyCapsule(
+            key_id=response.get("key_id"),
+            datakey_capsule=response.get("datakey_capsule"),
+            access_point_type=config.access_point_config.type if config and config.access_point_config else 0,
+        )
+
+    @staticmethod
+    def _parse_plaintext_data_key(response):
+        try:
+            return hex_to_bytes(response.get("datakey", ""))
+        except Exception as e:
+            raise HuaweicloudException("Failed to parse plaintext data key", e)

huaweicloud_encryptionsdk/meterialmanager/kms_data_key_generate.py

@@ -0,0 +1,65 @@
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.meterialmanager.data_key_generate import DataKeyGenerate
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.common.utils import is_empty, hex_to_bytes
+
+
+class KmsDataKeyGenerate(DataKeyGenerate):
+
+    def data_key_generate(self, huawei_config, data_key_materials) -> None:
+        kms_config_list = huawei_config.kms_config_list
+        if is_empty(kms_config_list):
+            raise HuaweicloudException(ErrorMessage.CONFIG_NULL_ERROR.message)
+        for kms_config in kms_config_list:
+            response = self._create_data_key_by_kms(
+                kms_config.region, kms_config.key_id, kms_config.end_point,
+                huawei_config.ak, huawei_config.sk, kms_config.project_id,
+                huawei_config.crypto_algorithm,
+                huawei_config.security_token,
+            )
+            plaint_bytes = hex_to_bytes(response.get("plain_text", ""))
+            data_key_materials.plaintext_data_key = plaint_bytes
+            return
+
+    @staticmethod
+    def _create_data_key_by_kms(region_str, key_id, end_point, ak, sk, project_id, algorithm, security_token=None):
+        try:
+            from huaweicloudsdkcore.auth.credentials import BasicCredentials
+            from huaweicloudsdkkms.v2.region.kms_region import KmsRegion
+            from huaweicloudsdkkms.v2.kms_client import KmsClient
+            from huaweicloudsdkkms.v2.model.create_datakey_request import CreateDatakeyRequest
+            from huaweicloudsdkkms.v2.model.create_datakey_request_body import CreateDatakeyRequestBody
+
+            credentials = BasicCredentials(ak, sk, project_id)
+            if security_token:
+                credentials = credentials.with_security_token(security_token)
+            if end_point:
+                from huaweicloudsdkcore.region.region import Region
+                region = Region(region_str, end_point)
+            else:
+                region = KmsRegion.value_of(region_str)
+            client = (
+                KmsClient.new_builder()
+                .with_credentials(credentials)
+                .with_region(region)
+                .build()
+            )
+            request = CreateDatakeyRequest()
+            key_spec = algorithm.key_spec
+            if CryptoAlgorithm.SM4_128_GCM_NOPADDING.key_spec.lower() == key_spec.lower():
+                key_spec = CryptoAlgorithm.AES_128_GCM_NOPADDING.key_spec
+            body = CreateDatakeyRequestBody(
+                datakey_length=str(algorithm.key_len * 8),
+                key_id=key_id,
+                key_spec=key_spec,
+            )
+            request.body = body
+            response = client.create_datakey(request)
+            return {
+                "plain_text": response.plain_text,
+                "cipher_text": response.cipher_text,
+            }
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.KMS_CREATE_KEY_EXCEPTION.message, e)

huaweicloud_encryptionsdk/meterialmanager/local_data_key_generate.py

@@ -0,0 +1,13 @@
+import os
+
+from huaweicloud_encryptionsdk.meterialmanager.data_key_generate import DataKeyGenerate
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.common.constants import KEY_SPEC_DELIMITER
+
+
+class LocalDataKeyGenerate(DataKeyGenerate):
+
+    def data_key_generate(self, huawei_config, data_key_materials) -> None:
+        algorithm = huawei_config.crypto_algorithm
+        key_len = algorithm.key_len
+        data_key_materials.plaintext_data_key = os.urandom(key_len)

huaweicloud_encryptionsdk/model/access_point_config.py

@@ -0,0 +1,9 @@
+from dataclasses import dataclass
+from typing import Callable, Optional
+
+
+@dataclass
+class AccessPointConfig:
+    type: int = 0
+    encrypted_private_key: Optional[str] = None
+    private_key_decrypt_callback: Optional[Callable[[str], str]] = None

huaweicloud_encryptionsdk/model/cipher_body.py

@@ -0,0 +1,81 @@
+import struct
+
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+
+
+class CipherBody:
+
+    def __init__(self, iv=None, encrypted_content=None, encrypted_content_length=0, auth_tag=None):
+        self._iv = iv if iv is not None else b""
+        self._encrypted_content = encrypted_content if encrypted_content is not None else b""
+        self._encrypted_content_length = encrypted_content_length
+        self._auth_tag = auth_tag if auth_tag is not None else b""
+
+    @property
+    def iv(self):
+        return self._iv
+
+    @iv.setter
+    def iv(self, value):
+        self._iv = value
+
+    @property
+    def encrypted_content(self):
+        return self._encrypted_content
+
+    @encrypted_content.setter
+    def encrypted_content(self, value):
+        self._encrypted_content = value
+
+    @property
+    def encrypted_content_length(self):
+        return self._encrypted_content_length
+
+    @encrypted_content_length.setter
+    def encrypted_content_length(self, value):
+        self._encrypted_content_length = value
+
+    @property
+    def auth_tag(self):
+        return self._auth_tag
+
+    @auth_tag.setter
+    def auth_tag(self, value):
+        self._auth_tag = value
+
+    def get_total_length(self):
+        return len(self._iv) + len(self._encrypted_content) + 8 + len(self._auth_tag)
+
+    def to_byte_array(self):
+        total = self.get_total_length()
+        buf = bytearray(total)
+        offset = 0
+        buf[offset:offset + len(self._iv)] = self._iv
+        offset += len(self._iv)
+        encrypted_content_length_bytes = struct.pack(">q", self._encrypted_content_length)
+        buf[offset:offset + 8] = encrypted_content_length_bytes
+        offset += 8
+        buf[offset:offset + len(self._encrypted_content)] = self._encrypted_content
+        offset += len(self._encrypted_content)
+        buf[offset:offset + len(self._auth_tag)] = self._auth_tag
+        return bytes(buf)
+
+    def deserialize(self, data_stream, algorithm):
+        self._iv = data_stream.read(algorithm.iv_len)
+        if len(self._iv) != algorithm.iv_len:
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        encrypted_content_length_bytes = data_stream.read(8)
+        if len(encrypted_content_length_bytes) != 8:
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        self._encrypted_content_length = struct.unpack(">q", encrypted_content_length_bytes)[0]
+        self._encrypted_content = data_stream.read(int(self._encrypted_content_length))
+        if len(self._encrypted_content) != int(self._encrypted_content_length):
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        if algorithm != CryptoAlgorithm.SM4_128_CBC_PADDING:
+            self._auth_tag = data_stream.read(algorithm.tag_len)
+        else:
+            self._auth_tag = b""
+        if len(self._auth_tag) != (algorithm.tag_len if algorithm != CryptoAlgorithm.SM4_128_CBC_PADDING else 0):
+            raise HuaweicloudException(ErrorMessage.SOURCE_FILE_INVALID.message)
+        return self