go get -u github.com/nsmithuk/local-kms cd $GOPATH/src/github.com/nsmithuk/local-kms go install

$GOPATH/bin/local-kms 

aws kms create-key --endpoint=http://localhost:4599 and awslocal kms create-key

awslocal kms create-key

awslocal kms Dncrypt \ --key-id 0579fe9c-129b-490a-adb0-42589ac4a017 \ --plaintext "My Test String"

awslocal kms decrypt \ --ciphertext-blob fileb://encrypted.dat

awslocal kms generate-data-key \ --key-id 0579fe9c-129b-490a-adb0-42589ac4a017 \ --key-spec AES_128

key_id=${1} wrappingAlg=${2:-RSAES_OAEP_SHA_1} expirationModel=${3:-KEY_MATERIAL_DOES_NOT_EXPIRE} validToInput=${4} if [ "$wrappingAlg" == "RSAES_PKCS1_V1_5" ]; then echo "RSAES_PKCS1_V1_5 is nto supported by this script. Please use RSAES_OAEP_SHA_[1|256]." exit 1 fi if [ -z "$key_id" ]; then echo "" echo "Creating new External key" key_id=$(awslocal kms create-key --origin EXTERNAL | jq -r '.KeyMetadata.KeyId') fi echo "" echo "Getting Parameters For Import" importParams=$(awslocal kms get-parameters-for-import --key-id $key_id --wrapping-algorithm $wrappingAlg --wrapping-key-spec RSA_2048) pubKeyBinFile=$(mktemp) echo $importParams | jq -r '.PublicKey' | base64 --decode > $pubKeyBinFile importTokenBinFile=$(mktemp) echo $importParams | jq -r '.ImportToken' | base64 --decode > $importTokenBinFile keyMaterial="KeyMaterial-${key_id}.txt" if [ -f "$keyMaterial" ]; then echo "" echo "Found existing key material" else echo "" echo "Generating key material" keyMaterialTmp=$(mktemp) openssl rand -out $keyMaterialTmp 32 # If you want to re-import key material then you'll need to save # this file and use it for any subsequent calls to Local KMS mv $keyMaterialTmp $keyMaterial fi echo "" echo "Encrypting key material using public key" encryptedKeyMaterial=$(mktemp) openssl pkeyutl \ -in $keyMaterial \ -out $encryptedKeyMaterial \ -inkey $pubKeyBinFile \ -keyform DER \ -pubin -encrypt \ -pkeyopt rsa_padding_mode:oaep \ -pkeyopt rsa_oaep_md:sha$(echo "$wrappingAlg" | sed -r 's/.*_([0-9]+)$/\1/') validTo= if [ -n "$validToInput" ]; then validTo=" --valid-to $validToInput" fi echo "" echo "Import key material for key_id $key_id" awslocal kms import-key-material --key-id $key_id \ --expiration-model KEY_MATERIAL_DOES_NOT_EXPIRE \ --import-token fileb://$importTokenBinFile \ --encrypted-key-material fileb://$encryptedKeyMaterial \ $validTo echo "" echo "Cleaning up" rm -f $pubKeyBinFile rm -f $importTokenBinFile rm -f $encryptedKeyMaterial echo "" echo "Describing new state" awslocal kms describe-key --key-id $key_id

http -v --json POST http://localhost:4599/ \ X-Amz-Target:TrentService.CreateKey POST / HTTP/1.1 Accept: application/json, */* Accept-Encoding: gzip, deflate Connection: keep-alive Content-Length: 0 Content-Type: application/json Host: localhost:4599 User-Agent: HTTPie/1.0.2 X-Amz-Target: TrentService.CreateKey HTTP/1.1 200 OK Content-Length: 329 Content-Type: application/x-amz-json-1.1 Date: Thu, 24 Oct 2019 11:17:30 GMT { "KeyMetadata": { "AWSAccountId": "111122223333", "Arn": "arn:aws:kms:eu-west-2:111122223333:key/f154ba79-0b7d-4f19-9983-309f706ebc83", "CreationDate": 1571915850, "Description": "", "Enabled": true, "KeyId": "f154ba79-0b7d-4f19-9983-309f706ebc83", "KeyManager": "CUSTOMER", "KeyState": "Enabled", "KeyUsage": "ENCRYPT_DECRYPT", "Origin": "AWS_KMS" } }

http -v --json POST http://localhost:4599/ \ X-Amz-Target:TrentService.Encrypt \ KeyId=f154ba79-0b7d-4f19-9983-309f706ebc83 \ Plaintext='SGVsbG8=' POST / HTTP/1.1 Accept: application/json, */* Accept-Encoding: gzip, deflate Connection: keep-alive Content-Length: 74 Content-Type: application/json Host: localhost:4599 User-Agent: HTTPie/1.0.2 X-Amz-Target: TrentService.Encrypt { "KeyId": "f154ba79-0b7d-4f19-9983-309f706ebc83", "Plaintext": "SGVsbG8=" } HTTP/1.1 200 OK Content-Length: 259 Content-Type: application/x-amz-json-1.1 Date: Thu, 24 Oct 2019 11:18:36 GMT { "CiphertextBlob": "S2Fybjphd3M6a21zOmV1LXdlc3QtMjoxMTExMjIyMjMzMzM6a2V5L2YxNTRiYTc5LTBiN2QtNGYxOS05OTgzLTMwOWY3MDZlYmM4MwAAAABjIzzp52djy/L4prvuGoG+jZ6OJzgQGi6n2CRO5dmfJHw=", "KeyId": "arn:aws:kms:eu-west-2:111122223333:key/f154ba79-0b7d-4f19-9983-309f706ebc83" }

http -v --json POST http://localhost:4599/ \ X-Amz-Target:TrentService.Decrypt \ CiphertextBlob='S2Fybjphd3M6a21zOmV1LXdlc3QtMjoxMTExMjIyMjMzMzM6a2V5L2YxNTRiYTc5LTBiN2QtNGYxOS05OTgzLTMwOWY3MDZlYmM4MwAAAABjIzzp52djy/L4prvuGoG+jZ6OJzgQGi6n2CRO5dmfJHw=' POST / HTTP/1.1 Accept: application/json, */* Accept-Encoding: gzip, deflate Connection: keep-alive Content-Length: 174 Content-Type: application/json Host: localhost:4599 User-Agent: HTTPie/1.0.2 X-Amz-Target: TrentService.Decrypt { "CiphertextBlob": "S2Fybjphd3M6a21zOmV1LXdlc3QtMjoxMTExMjIyMjMzMzM6a2V5L2YxNTRiYTc5LTBiN2QtNGYxOS05OTgzLTMwOWY3MDZlYmM4MwAAAABjIzzp52djy/L4prvuGoG+jZ6OJzgQGi6n2CRO5dmfJHw=" } HTTP/1.1 200 OK Content-Length: 110 Content-Type: application/x-amz-json-1.1 Date: Thu, 24 Oct 2019 11:20:17 GMT { "KeyId": "arn:aws:kms:eu-west-2:111122223333:key/f154ba79-0b7d-4f19-9983-309f706ebc83", "Plaintext": "SGVsbG8=" }

function rsakey(){ local bits=$1 if ! [[ "$bits" =~ ^(2048|3072|4096)$ ]]; then echo "RSA keysize must be one of : 2048 3072 4096" return fi keyId=$(uuidgen | tr '[:upper:]' '[:lower:]') echo " Keys:  Asymmetric:  Rsa:  - Metadata:  KeyId: ${keyId}  KeyUsage: SIGN_VERIFY # or ENCRYPT_DECRYPT  Description: RSA key with ${bits} bits  PrivateKeyPem: | $(openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:${bits} -pkeyopt rsa_keygen_pubexp:65537 | sed 's/^/ /') " }

rsakey 2048 rsakey 3072 rsakey 4096

function ecckey(){ local curve=$1 if ! [[ "$curve" =~ ^(secp256r1|secp384r1|secp521r1)$ ]]; then echo "Curve must be one of: secp256r1 secp384r1 secp521r1" return fi keyId=$(uuidgen | tr '[:upper:]' '[:lower:]') echo " Keys:  Asymmetric:  Ecc:  - Metadata:  KeyId: ${keyId}  KeyUsage: SIGN_VERIFY  Description: ECC key with curve ${curve}  PrivateKeyPem: | $(openssl ecparam -name ${curve} -genkey -noout | sed 's/^/ /') " }

ecckey secp256r1 ecckey secp384r1 ecckey secp521r1