[ Web Proxy ]
URL:
Viewing: https://developers.google.com/workspace/cse/reference/resource-key-hash [Back]  [Original]
Resource key hash  |  Google Workspace  |  Google for Developers Skip to main content
Google Workspace [Google Workspace]
Home All products Resources
Search:
Overview Explorer Guides Support
Google Workspace [Google Workspace]
Send feedback

Resource key hash Stay organized with collections Save and categorize content based on your preferences.

The resource key hash is a mechanism allowing Google to verify the integrity of the wrapped encryption keys without having access to the keys.

Generating the resource key hash requires access to the unwrapped key including the DEK, the resource_name and the perimeter_id specified during the key wrapping operation.

We use the cryptographic function HMAC-SHA256 with unwrapped_dek as a key and the concatenation of metadata as data ("ResourceKeyDigest:", resource_name, ":", perimeter_id). The resource_name and perimeter_id should be UTF-8 encoded strings.

For example, when resource_name = "my_resource", perimeter_id = "my_perimeter" and unwrapped_dek = 0xf00d, the resource key hash is:

echo -n "ResourceKeyDigest:my_resource:my_perimeter" | openssl sha256 -mac HMAC -macopt hexkey:f00d -binary
Send feedback

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-01-27 UTC.

Need to tell us more? [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-01-27 UTC."],[],["The core mechanism is generating a resource key hash to verify wrapped encryption key integrity. This involves using HMAC-SHA256 with the unwrapped DEK as the key and a specific concatenation of metadata as data. The metadata consists of \"ResourceKeyDigest:\", the UTF-8 encoded `resource_name`, \":\", and the UTF-8 encoded `perimeter_id`. An example shows generating the hash using `openssl` with a sample `resource_name`, `perimeter_id`, and `unwrapped_dek`.\n"]]
Web Proxy Viewer  |  New URL  |  Original Page