Google Tink: Safe High-Level Crypto

Tink is an open-source cryptographic library developed by Google's cryptography team, designed to provide safe and easy-to-use cryptography. The primary motivation is preventing the common cryptographic misuse patterns that occur even among experienced developers using lower-level libraries. Tink's API is designed so that the correct operation is the path of least resistance, making it difficult to accidentally create insecure configurations.

Tink organizes keys into keysets rather than exposing individual key objects. Applications work with keyset handles, not raw key bytes. This abstraction prevents accidental key exposure, enables seamless key rotation, and allows keys to be stored in remote Key Management Systems without the application ever seeing the key material directly. The keyset concept is central to Tink's safe design.

The AEAD (Authenticated Encryption with Associated Data) interface in Tink provides encrypt and decrypt operations. AeadFactory.getPrimitive(keyset) returns an Aead object; calling aead.encrypt(plaintext, associatedData) returns ciphertext. Tink automatically selects the encryption algorithm based on the keyset (e.g., AES-256-GCM) and generates a random nonce. The interface hides all algorithm details, nonce management, and format encoding.

Tink's MAC interface provides compute and verify operations for message authentication codes. MacFactory.getPrimitive(keyset) returns a Mac object. mac.computeMac(data) returns the authentication tag; mac.verifyMac(tag, data) verifies it, throwing a security exception if verification fails. The default algorithm is HMAC-SHA256. The interface prevents common mistakes like comparing MACs with regular string equality instead of constant-time comparison.

Tink provides separate PublicKeySign and PublicKeyVerify interfaces for digital signatures. The sign and verify objects are derived from different keyset handles (private and public respectively), preventing accidental use of a private key for verification or vice versa. Tink's Ed25519 and ECDSA P-256 implementations are the defaults, with deterministic ECDSA available to avoid randomness vulnerabilities.

Tink's HybridEncrypt and HybridDecrypt interfaces implement ECIES (Elliptic Curve Integrated Encryption Scheme). Hybrid encryption combines asymmetric key exchange with symmetric encryption: the sender generates an ephemeral key, performs ECDH with the recipient's public key, derives a symmetric key, and encrypts with AEAD. This allows encrypting large messages using asymmetric keys without the overhead of pure asymmetric encryption.

Key rotation in Tink is safe and backward-compatible. To rotate: generate a new key and add it to the keyset, mark the new key as primary (future encryptions use it), keep old keys in the keyset for decryption of existing ciphertexts. Old ciphertexts continue to decrypt because non-primary keys remain available for decryption. Once all old ciphertexts have been re-encrypted or expired, delete old keys from the keyset.

Tink keysets are serialized as JSON or binary Protocol Buffer format. The JSON format is human-readable and useful for debugging. Binary format is more compact for production. Serialized keysets containing private keys must be encrypted before storage. Tink supports storing encrypted keysets using standard symmetric AEAD encryption, or delegating storage to a KMS.

Tink integrates with major KMS providers: AWS KMS, Google Cloud KMS, and HashiCorp Vault. Instead of encrypting keysets with a local AEAD key, Tink wraps the keyset encryption key using the KMS. The actual keyset encryption uses a locally generated Data Encryption Key (DEK), and the DEK is encrypted by the KMS Key Encryption Key (KEK). This follows the envelope encryption pattern used by cloud providers.

Standard AEAD requires loading the entire message into memory for encryption and decryption. Tink's Streaming AEAD interface encrypts large files in segments, allowing streaming encryption and decryption without buffering the complete plaintext. Each segment is independently authenticated, and the ordering and completeness of segments is verified during decryption. This is essential for encrypting backups, videos, and other large files.

Tink is available for Java, Python, Go, and C++ with idiomatic APIs for each language. Cross-language interoperability is guaranteed: a file encrypted with Tink in Python can be decrypted with Tink in Java. This makes Tink suitable for systems with multiple services in different languages that need to exchange encrypted data. Tink also integrates with protocol buffers for type-safe keyset configuration.

During Tink key rotation, what happens to ciphertexts encrypted with the old (non-primary) key?

Tink recap: keyset-based abstraction prevents raw key exposure, AEAD interface hides nonce management and algorithm selection, MAC interface uses constant-time verification internally, digital signature and hybrid encryption interfaces prevent interface misuse, key rotation is backward-compatible (old keys decrypt until removed), KMS integration follows envelope encryption pattern, streaming AEAD handles large files, and cross-language interoperability is guaranteed.