Skip to content
Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.
Branch: master
Clone or download
przydatek Merge pull request #231 from mark-buer:android-23-AES256_GCM_HKDF_4KB…
…-round-trip-failure

PiperOrigin-RevId: 258959551
Latest commit 2695839 Jul 19, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
apps Remove Apache 2.0 comments from build files. Jul 11, 2019
cc Initialize some uninitialized variables. Jul 16, 2019
cmake Run the unit tests with cmake under kokoro. Jun 17, 2019
docs Add beginner-friendly explanation of AEADs to PRIMITIVES docs. Jul 11, 2019
examples Fixed a typo. Jul 19, 2019
go Add UNKNOWN_KEYMATERIAL to the things which count as secret in golang. Jul 19, 2019
java Merge pull request #231 from mark-buer:android-23-AES256_GCM_HKDF_4KB… Jul 19, 2019
javascript Remove Apache 2.0 comments from build files. Jul 11, 2019
kokoro Adding missing license. Jul 5, 2019
maven Move KMS deps out of com.google.crypto.tink:tink Maven package. Jun 1, 2019
objc Remove Apache 2.0 comments from build files. Jul 11, 2019
proto Remove Apache 2.0 comments from build files. Jul 11, 2019
python Use Abseil test library for compatibility. Jul 19, 2019
testdata Remove Apache 2.0 comments from build files. Jul 11, 2019
third_party Remove Apache 2.0 comments from build files. Jul 11, 2019
tools Fix a typo. Jul 16, 2019
.bazelrc Fix broken build on macOS. May 2, 2019
.gitignore Fixing macOS build. Sep 25, 2017
BUILD.bazel Remove Apache 2.0 comments from build files. Jul 11, 2019
CMakeLists.txt Simplify CMake dependencies for the example project. May 2, 2019
LICENSE Merge "Preparing for open source: adding license." Mar 23, 2017
README.md Updating contributors' list. Jul 8, 2019
WORKSPACE Upgrade protobuf to 3.8.0. Fix several issues caused by the upgrade. Jun 27, 2019
__init__.py Adding Python/CLIF base. Jul 9, 2019
go.mod Adding support for go modules. Jun 11, 2019
go.sum Adding support for go modules. Jun 11, 2019
tink_version.bzl Bumping up the version to 1.3.0-rc1 Jun 28, 2019
tink_version.cmake Bumping up the version to 1.3.0-rc1 Jun 28, 2019

README.md

Tink

A multi-language, cross-platform library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.

Ubuntu macOS
Kokoro Ubuntu Kokoro macOS

Index

  1. Introduction
  2. Getting started
  3. Current status
  4. Learn more
  5. Contact and mailing list
  6. Maintainers

Introduction

Using crypto in your application shouldn't have to feel like juggling chainsaws in the dark. Tink is a crypto library written by a group of cryptographers and security engineers at Google. It was born out of our extensive experience working with Google's product teams, fixing weaknesses in implementations, and providing simple APIs that can be used safely without needing a crypto background.

Tink provides secure APIs that are easy to use correctly and hard(er) to misuse. It reduces common crypto pitfalls with user-centered design, careful implementation and code reviews, and extensive testing. At Google, Tink is already being used to secure data of many products such as AdMob, Google Pay, Google Assistant, Firebase, the Android Search App, etc.

To get a quick overview of Tink design please take a look at slides from a talk about Tink presented at Real World Crypto 2019.

Getting started

TIP The easiest way to get started with Tink is to install Bazel, then build, run and play with the hello world examples.

Tink performs cryptographic tasks via so-called primitives, each of which is defined via a corresponding interface that specifies the functionality of the primitive. For example, symmetric key encryption is offered via an AEAD-primitive (Authenticated Encryption with Associated Data), that supports two operations:

  • encrypt(plaintext, associated_data), which encrypts the given plaintext (using associated_data as additional AEAD-input) and returns the resulting ciphertext
  • decrypt(ciphertext, associated_data), which decrypts the given ciphertext (using associated_data as additional AEAD-input) and returns the resulting plaintext

Before implementations of primitives can be used, they must be registered at runtime with Tink, so that Tink "knows" the desired implementations. Here's how you can register all implementations of all primitives in Tink:

    import com.google.crypto.tink.config.TinkConfig;

    TinkConfig.register();

After implementations of primitives have been registered, the basic use of Tink proceeds in three steps:

  1. Load or generate the cryptographic key material (a Keyset in Tink terms).
  2. Use the key material to get an instance of the chosen primitive.
  3. Use that primitive to accomplish the cryptographic task.

Here is how these steps would look like when encrypting or decrypting with an AEAD primitive in Java:

    import com.google.crypto.tink.Aead;
    import com.google.crypto.tink.KeysetHandle;
    import com.google.crypto.tink.aead.AeadKeyTemplates;

    // 1. Generate the key material.
    KeysetHandle keysetHandle = KeysetHandle.generateNew(
        AeadKeyTemplates.AES128_GCM);

    // 2. Get the primitive.
    Aead aead = keysetHandle.getPrimitive(Aead.class);

    // 3. Use the primitive.
    byte[] ciphertext = aead.encrypt(plaintext, associatedData);

Current status

  • Java and Android, C++, Obj-C, and Go are field tested and ready for production. The latest version is 1.3.0-rc1, released on 2019-07-01.

  • Tink for Python and JavaScript are in active development.

Learn more

Community-driven ports

Out of the box Tink supports a wide range of languages, but it still doesn't support every language. Fortunately, some users like Tink so much that they've ported it to their favorite languages! Below you can find notable ports.

WARNING While we usually review these ports, until further notice, we do not maintain them and have no plan to support them in the foreseeable future.

Contact and mailing list

If you want to contribute, please read CONTRIBUTING and send us pull requests. You can also report bugs or file feature requests.

If you'd like to talk to the developers or get notified about major product updates, you may want to subscribe to our mailing list. To join, simply send an empty email to tink-users+subscribe@googlegroups.com.

Maintainers

Tink is maintained by (A-Z):

  • Haris Andrianakis
  • Daniel Bleichenbacher
  • Thai Duong
  • Thomas Holenstein
  • Charles Lee
  • Quan Nguyen
  • Bartosz Przydatek
  • Enzo Puig
  • Veronika Slívová
  • Jürg Wullschleger
You can’t perform that action at this time.