This commit adds support for migrating keys to minkms via the kes migrate command. Migrating all keys
of a KES backend to a MinKMS server can be done as following:
kes migrate --from src-config.yml --server 127.0.0.1:7373 --enclave minio --api-key k1:...
Currently, this implementation has the following limitations:
The HMAC key is not migrated. This requires support from MinKMS. However, HMAC keys are not used for S3 object encryption and have been added to KES recently.
Ciphertexts produced by KES cannot be decrypted auto. because they lack the key version prefix (e.g. 'v1:'). Future KES servers may use ciphertexts with key versions and MinKMS may accept a ciphertext without one.
This commit adds support for migrating keys to minkms via the
kes migratecommand. Migrating all keys of a KES backend to a MinKMS server can be done as following:Currently, this implementation has the following limitations: