Retrieve a public key

This page shows you how to retrieve the public key portion of an enabled asymmetric key version.

The format of the public key depends on whether it is a post-quantum computing (PQC) or conventional algorithm:

• For non-PQC algorithms, the default format of the public key is the Privacy-enhanced Electronic Mail (PEM) format. You can also retrieve non-PQC public keys in the Distinguished Encoding Rules (DER) format. For more information, see the RFC 7468, particularly the sections "General Considerations" and "Textual Encoding of Subject Public Key Info".

• For PQC algorithms standardized by NIST, you can retrieve the public key in the format identified in the NIST PCQ standards for that algorithm. For more information, see FIPS-203, FIPS-204, and FIPS-205. The PEM and DER formats are only supported for ML-DSA keys.

• For X-Wing, you can retrieve the public key in the raw bytes format specified by the X-Wing standard. PEM and DER formats are not supported for these keys.

Required roles

To get the permissions that you need to retrieve a public key, ask your administrator to grant you the Cloud KMS CryptoKey Public Key Viewer (roles/cloudkms.publicKeyViewer) IAM role on your key or a parent resource. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to retrieve a public key. To see the exact permissions that are required, expand the Required permissions section:

You might also be able to get these permissions with custom roles or other predefined roles.

Retrieve a public key

You can specify the format in which you want to retrieve the public key. If the format is specified, the key will be returned in the specified format in the public_key field of the response. Otherwise, it is returned in the pem field of the response.

To download the public key for an enabled asymmetric key version:

KEY_RING-KEY_NAME-KEY_VERSION.pub

gcloud kms keys versions get-public-key KEY_VERSION \
    --key KEY_NAME \
    --keyring KEY_RING \
    --location LOCATION \
    --public-key-format PUBLIC_KEY_FORMAT \
    --output-file OUTPUT_FILE_PATH

using Google.Cloud.Kms.V1;

public class GetPublicKeySample
{
    public PublicKey GetPublicKey(string projectId = "my-project", string locationId = "us-east1", string keyRingId = "my-key-ring", string keyId = "my-key", string keyVersionId = "123")
    {
        // Create the client.
        KeyManagementServiceClient client = KeyManagementServiceClient.Create();

        // Build the key version name.
        CryptoKeyVersionName keyVersionName = new CryptoKeyVersionName(projectId, locationId, keyRingId, keyId, keyVersionId);

        // Call the API.
        PublicKey result = client.GetPublicKey(keyVersionName);

        // Return the ciphertext.
        return result;
    }
}

import (
	"context"
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"hash/crc32"
	"io"

	kms "cloud.google.com/go/kms/apiv1"
	"cloud.google.com/go/kms/apiv1/kmspb"
)

// getPublicKey retrieves the public key from an asymmetric key pair on
// Cloud KMS.
func getPublicKey(