ContainerKekKeyringWireRecord
A container KEK keyring: every predecessor KEK of a container, sealed under the KEK of one epoch.
Shape
object
6 fields
containerIdstringrequiredcontainerKeyEpochIdstringrequiredContainer KEK epoch whose key seals the keyring.
ivstringrequired- at most 16 characters
Base64 AES-GCM initialization vector.
sealedstringrequired- at most 5,592,352 characters
Base64 ciphertext; its length is an exact function of the epoch number.
sealingSuitestringrequiredCipher suite used to seal the keyring.
versionnumberrequired- always
1
- always
Other fields are allowed.