@@ -98,7 +98,7 @@ pub struct CryptoKey {
9898     /// where all related cryptographic operations are performed. Only applicable 
9999     /// if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] have a 
100100     /// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of 
101-      /// [EXTERNAL_VPC][CryptoKeyVersion .ProtectionLevel.EXTERNAL_VPC], with the 
101+      /// [EXTERNAL_VPC][google.cloud.kms.v1 .ProtectionLevel.EXTERNAL_VPC], with the 
102102     /// resource name in the format `projects/*/locations/*/ekmConnections/*`. 
103103     /// Note, this list is non-exhaustive and may apply to additional 
104104     /// [ProtectionLevels][google.cloud.kms.v1.ProtectionLevel] in the future. 
@@ -478,6 +478,7 @@ pub mod crypto_key_version {
478478     /// The suffix following `HMAC_` corresponds to the hash algorithm being used 
479479     /// (eg. SHA256). 
480480     /// 
481+      /// 
481482     /// For more information, see \[Key purposes and algorithms\] 
482483     /// (<https://cloud.google.com/kms/docs/algorithms>). 
483484     #[ derive(  
@@ -572,6 +573,12 @@ pub mod crypto_key_version {
572573         HmacSha224  = 36 , 
573574        /// Algorithm representing symmetric encryption by an external key manager. 
574575         ExternalSymmetricEncryption  = 18 , 
576+         /// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at 
577+          /// security level 3. Randomized version. 
578+          PqSignMlDsa65  = 56 , 
579+         /// The post-quantum stateless hash-based digital signature algorithm, at 
580+          /// security level 1. Randomized version. 
581+          PqSignSlhDsaSha2128s  = 57 , 
575582    } 
576583    impl  CryptoKeyVersionAlgorithm  { 
577584        /// String value of the enum field names used in the ProtoBuf definition. 
@@ -616,6 +623,8 @@ pub mod crypto_key_version {
616623                Self :: HmacSha512  => "HMAC_SHA512" , 
617624                Self :: HmacSha224  => "HMAC_SHA224" , 
618625                Self :: ExternalSymmetricEncryption  => "EXTERNAL_SYMMETRIC_ENCRYPTION" , 
626+                 Self :: PqSignMlDsa65  => "PQ_SIGN_ML_DSA_65" , 
627+                 Self :: PqSignSlhDsaSha2128s  => "PQ_SIGN_SLH_DSA_SHA2_128S" , 
619628            } 
620629        } 
621630        /// Creates an enum from field names used in the ProtoBuf definition. 
@@ -659,6 +668,8 @@ pub mod crypto_key_version {
659668                "EXTERNAL_SYMMETRIC_ENCRYPTION"  => { 
660669                    Some ( Self :: ExternalSymmetricEncryption ) 
661670                } 
671+                 "PQ_SIGN_ML_DSA_65"  => Some ( Self :: PqSignMlDsa65 ) , 
672+                 "PQ_SIGN_SLH_DSA_SHA2_128S"  => Some ( Self :: PqSignSlhDsaSha2128s ) , 
662673                _ => None , 
663674            } 
664675        } 
@@ -822,6 +833,29 @@ pub mod crypto_key_version {
822833        } 
823834    } 
824835} 
836+ /// Data with integrity verification field. 
837+ #[ derive( Clone ,  PartialEq ,  :: prost:: Message ) ]  
838+ pub  struct  ChecksummedData  { 
839+     /// Raw Data. 
840+      #[ prost( bytes = "bytes" ,  tag = "3" ) ]  
841+     pub  data :  :: prost:: bytes:: Bytes , 
842+     /// Integrity verification field. A CRC32C 
843+      /// checksum of the returned 
844+      /// [ChecksummedData.data][google.cloud.kms.v1.ChecksummedData.data]. An 
845+      /// integrity check of 
846+      /// [ChecksummedData.data][google.cloud.kms.v1.ChecksummedData.data] can be 
847+      /// performed by computing the CRC32C checksum of 
848+      /// [ChecksummedData.data][google.cloud.kms.v1.ChecksummedData.data] and 
849+      /// comparing your results to this field. Discard the response in case of 
850+      /// non-matching checksum values, and perform a limited number of retries. A 
851+      /// persistent mismatch may indicate an issue in your computation of the CRC32C 
852+      /// checksum. Note: This field is defined as int64 for reasons of compatibility 
853+      /// across different languages. However, it is a non-negative integer, which 
854+      /// will never exceed `2^32-1`, and can be safely downconverted to uint32 in 
855+      /// languages that support this type. 
856+      #[ prost( message,  optional,  tag = "2" ) ]  
857+     pub  crc32c_checksum :  :: core:: option:: Option < i64 > , 
858+ } 
825859/// The public keys for a given 
826860/// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via 
827861/// [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. 
@@ -849,8 +883,8 @@ pub struct PublicKey {
849883     /// mismatch may indicate an issue in your computation of the CRC32C checksum. 
850884     /// Note: This field is defined as int64 for reasons of compatibility across 
851885     /// different languages. However, it is a non-negative integer, which will 
852-      /// never exceed 2^32-1, and can be safely downconverted to uint32 in languages  
853-      /// that support this type. 
886+      /// never exceed ` 2^32-1` , and can be safely downconverted to uint32 in 
887+      /// languages  that support this type. 
854888     /// 
855889     /// NOTE: This field is in Beta. 
856890     #[ prost( message,  optional,  tag = "3" ) ]  
@@ -866,6 +900,78 @@ pub struct PublicKey {
866900     /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key. 
867901     #[ prost( enumeration = "ProtectionLevel" ,  tag = "5" ) ]  
868902    pub  protection_level :  i32 , 
903+     /// The [PublicKey][google.cloud.kms.v1.PublicKey] format specified by the 
904+      /// customer through the 
905+      /// [public_key_format][google.cloud.kms.v1.GetPublicKeyRequest.public_key_format] 
906+      /// field. 
907+      #[ prost( enumeration = "public_key::PublicKeyFormat" ,  tag = "7" ) ]  
908+     pub  public_key_format :  i32 , 
909+     /// This field contains the public key (with integrity verification), formatted 
910+      /// according to the 
911+      /// [public_key_format][google.cloud.kms.v1.PublicKey.public_key_format] field. 
912+      #[ prost( message,  optional,  tag = "8" ) ]  
913+     pub  public_key :  :: core:: option:: Option < ChecksummedData > , 
914+ } 
915+ /// Nested message and enum types in `PublicKey`. 
916+ pub  mod  public_key { 
917+     /// The supported [PublicKey][google.cloud.kms.v1.PublicKey] formats. 
918+      #[ derive(  
919+         Clone ,  
920+         Copy ,  
921+         Debug ,  
922+         PartialEq ,  
923+         Eq ,  
924+         Hash ,  
925+         PartialOrd ,  
926+         Ord ,  
927+         :: prost:: Enumeration  
928+     ) ]  
929+     #[ repr( i32 ) ]  
930+     pub  enum  PublicKeyFormat  { 
931+         /// If the 
932+          /// [public_key_format][google.cloud.kms.v1.GetPublicKeyRequest.public_key_format] 
933+          /// field is not specified: 
934+          /// - For PQC algorithms, an error will be returned. 
935+          /// - For non-PQC algorithms, the default format is PEM, and the field 
936+          ///    [pem][google.cloud.kms.v1.PublicKey.pem] will be populated. 
937+          /// 
938+          /// Otherwise, the public key will be exported through the 
939+          /// [public_key][google.cloud.kms.v1.PublicKey.public_key] field in the 
940+          /// requested format. 
941+          Unspecified  = 0 , 
942+         /// The returned public key will be encoded in PEM format. 
943+          /// See the [RFC7468](<https://tools.ietf.org/html/rfc7468>) sections for 
944+          /// [General Considerations](<https://tools.ietf.org/html/rfc7468#section-2>) 
945+          /// and \[Textual Encoding of Subject Public Key Info\] 
946+          /// (<https://tools.ietf.org/html/rfc7468#section-13>) for more information. 
947+          Pem  = 1 , 
948+         /// This is supported only for PQC algorithms. 
949+          /// The key material is returned in the format defined by NIST PQC 
950+          /// standards (FIPS 203, FIPS 204, and FIPS 205). 
951+          NistPqc  = 3 , 
952+     } 
953+     impl  PublicKeyFormat  { 
954+         /// String value of the enum field names used in the ProtoBuf definition. 
955+          /// 
956+          /// The values are not transformed in any way and thus are considered stable 
957+          /// (if the ProtoBuf definition does not change) and safe for programmatic use. 
958+          pub  fn  as_str_name ( & self )  -> & ' static  str  { 
959+             match  self  { 
960+                 Self :: Unspecified  => "PUBLIC_KEY_FORMAT_UNSPECIFIED" , 
961+                 Self :: Pem  => "PEM" , 
962+                 Self :: NistPqc  => "NIST_PQC" , 
963+             } 
964+         } 
965+         /// Creates an enum from field names used in the ProtoBuf definition. 
966+          pub  fn  from_str_name ( value :  & str )  -> :: core:: option:: Option < Self >  { 
967+             match  value { 
968+                 "PUBLIC_KEY_FORMAT_UNSPECIFIED"  => Some ( Self :: Unspecified ) , 
969+                 "PEM"  => Some ( Self :: Pem ) , 
970+                 "NIST_PQC"  => Some ( Self :: NistPqc ) , 
971+                 _ => None , 
972+             } 
973+         } 
974+     } 
869975} 
870976/// An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create 
871977/// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and 
@@ -1551,6 +1657,15 @@ pub struct GetPublicKeyRequest {
15511657     /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key to get. 
15521658     #[ prost( string,  tag = "1" ) ]  
15531659    pub  name :  :: prost:: alloc:: string:: String , 
1660+     /// Optional. The [PublicKey][google.cloud.kms.v1.PublicKey] format specified 
1661+      /// by the user. This field is required for PQC algorithms. If specified, the 
1662+      /// public key will be exported through the 
1663+      /// [public_key][google.cloud.kms.v1.PublicKey.public_key] field in the 
1664+      /// requested format. Otherwise, the [pem][google.cloud.kms.v1.PublicKey.pem] 
1665+      /// field will be populated for non-PQC algorithms, and an error will be 
1666+      /// returned for PQC algorithms. 
1667+      #[ prost( enumeration = "public_key::PublicKeyFormat" ,  tag = "2" ) ]  
1668+     pub  public_key_format :  i32 , 
15541669} 
15551670/// Request message for 
15561671/// [KeyManagementService.GetImportJob][google.cloud.kms.v1.KeyManagementService.GetImportJob]. 
@@ -1643,7 +1758,9 @@ pub struct ImportCryptoKeyVersionRequest {
16431758     /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], the 
16441759     /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] must be a child of 
16451760     /// [ImportCryptoKeyVersionRequest.parent][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.parent], 
1646-      /// have been previously created via [ImportCryptoKeyVersion][], and be in 
1761+      /// have been previously created via 
1762+      /// [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion], 
1763+      /// and be in 
16471764     /// [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED] 
16481765     /// or 
16491766     /// [IMPORT_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED] 
@@ -2303,7 +2420,8 @@ pub struct MacVerifyRequest {
23032420     /// checksum. [KeyManagementService][google.cloud.kms.v1.KeyManagementService] 
23042421     /// will report an error if the checksum verification fails. If you receive a 
23052422     /// checksum error, your client should verify that 
2306-      /// CRC32C([MacVerifyRequest.tag][]) is equal to 
2423+      /// CRC32C([MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]) is 
2424+      /// equal to 
23072425     /// [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], 
23082426     /// and if so, perform a limited number of retries. A persistent mismatch may 
23092427     /// indicate an issue in your computation of the CRC32C checksum. Note: This 
@@ -4066,7 +4184,7 @@ pub struct Certificate {
40664184/// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and 
40674185/// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a 
40684186/// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of 
4069- /// [EXTERNAL_VPC][CryptoKeyVersion .ProtectionLevel.EXTERNAL_VPC], as well as 
4187+ /// [EXTERNAL_VPC][google.cloud.kms.v1 .ProtectionLevel.EXTERNAL_VPC], as well as 
40704188/// performing cryptographic operations using keys created within the 
40714189/// [EkmConnection][google.cloud.kms.v1.EkmConnection]. 
40724190#[ derive( Clone ,  PartialEq ,  :: prost:: Message ) ]  
@@ -4169,6 +4287,7 @@ pub mod ekm_connection {
41694287        /// All [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this 
41704288         /// [EkmConnection][google.cloud.kms.v1.EkmConnection] use EKM-side key 
41714289         /// management operations initiated from Cloud KMS. This means that: 
4290+          /// 
41724291         /// * When a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] 
41734292         /// associated with this [EkmConnection][google.cloud.kms.v1.EkmConnection] 
41744293         /// is 
@@ -4177,7 +4296,8 @@ pub mod ekm_connection {
41774296         ///    external key material. 
41784297         /// * Destruction of external key material associated with this 
41794298         ///    [EkmConnection][google.cloud.kms.v1.EkmConnection] can be requested by 
4180-          ///    calling [DestroyCryptoKeyVersion][EkmService.DestroyCryptoKeyVersion]. 
4299+          ///    calling 
4300+          ///    [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion]. 
41814301         /// * Automatic rotation of key material is supported. 
41824302         CloudKms  = 2 , 
41834303    } 
@@ -4209,7 +4329,7 @@ pub mod ekm_connection {
42094329/// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and 
42104330/// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a 
42114331/// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of 
4212- /// [EXTERNAL_VPC][CryptoKeyVersion .ProtectionLevel.EXTERNAL_VPC] in a given 
4332+ /// [EXTERNAL_VPC][google.cloud.kms.v1 .ProtectionLevel.EXTERNAL_VPC] in a given 
42134333/// project and location. 
42144334#[ derive( Clone ,  PartialEq ,  :: prost:: Message ) ]  
42154335pub  struct  EkmConfig  { 
0 commit comments