Add IBM Key Protect (IBM Cloud KMS) wrapper

README.md

@@ -43,6 +43,7 @@ as they may have been used for past encryption operations.
   * * Azure KeyVault (uses envelopes)
   * * GCP CKMS (uses envelopes)
   * * Huawei Cloud KMS (uses envelopes)
+  * * IBM Key Protect (uses envelopes)
   * * OCI KMS (uses envelopes)
   * * Tencent Cloud KMS (uses envelopes)
   * * Vault Transit mount

const.go

@@ -14,6 +14,7 @@ const (
 	WrapperTypeGcpCkms         WrapperType = "gcpckms"
 	WrapperTypeHsmAuto         WrapperType = "hsm-auto"
 	WrapperTypeHuaweiCloudKms  WrapperType = "huaweicloudkms"
+	WrapperTypeIbmKp           WrapperType = "ibmkeyprotect"
 	WrapperTypeOciKms          WrapperType = "ocikms"
 	WrapperTypePkcs11          WrapperType = "pkcs11"
 	WrapperTypePooled          WrapperType = "pooled"

wrappers/ibmkp/go.mod

@@ -0,0 +1,28 @@
+module github.com/hashicorp/go-kms-wrapping/wrappers/ibmkp/v2
+
+go 1.17
+
+require (
+	github.com/IBM/keyprotect-go-client v0.7.0
+	github.com/hashicorp/go-hclog v1.1.0
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.0
+	github.com/stretchr/testify v1.7.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fatih/color v1.13.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
+	github.com/hashicorp/go-uuid v1.0.2 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/mattn/go-colorable v0.1.12 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.8.1 // indirect
+	github.com/stretchr/objx v0.1.0 // indirect
+	golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+)

wrappers/ibmkp/go.sum

@@ -0,0 +1,82 @@
+github.com/IBM/keyprotect-go-client v0.7.0 h1:JstSHD14Lp6ihwQseyPuGcs1AjOBjAmcisP0dTBA6A0=
+github.com/IBM/keyprotect-go-client v0.7.0/go.mod h1:SVr2ylV/fhSQPDiUjWirN9fsyWFCNNbt8GIT8hPJVjE=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
+github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-hclog v1.1.0 h1:QsGcniKx5/LuX2eYoeL+Np3UKYPNaN7YKpTh29h8rbw=
+github.com/hashicorp/go-hclog v1.1.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
+github.com/hashicorp/go-retryablehttp v0.6.2/go.mod h1:gEx6HMUGxYYhJScX7W1Il64m6cc2C1mDaW3NQ9sY1FY=
+github.com/hashicorp/go-retryablehttp v0.7.0 h1:eu1EI/mbirUgP5C8hVsTNaGZreBDlYiwC1FZWkvQPQ4=
+github.com/hashicorp/go-retryablehttp v0.7.0/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.1 h1:geMPLpDpQOgVyCg5z5GoRwLHepNdb71NXb67XFkP+Eg=
+github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
+github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9 h1:nhht2DYV/Sn3qOayu8lM+cU1ii9sTLUeBQwQQfUHtrs=
+golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/h2non/gock.v1 v1.0.15 h1:SzLqcIlb/fDfg7UvukMpNcWsu7sI5tWwL+KCATZqks0=
+gopkg.in/h2non/gock.v1 v1.0.15/go.mod h1:sX4zAkdYX1TRGJ2JY156cFspQn4yRWn6p9EMdODlynE=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

wrappers/ibmkp/ibmkp.go

@@ -0,0 +1,251 @@
+package ibmkp
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"os"
+	"sync/atomic"
+
+	kp "github.com/IBM/keyprotect-go-client"
+	"github.com/hashicorp/go-hclog"
+	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
+)
+
+// These constants contain the accepted env vars
+const (
+	EnvIbmApiKey       = "IBMCLOUD_API_KEY"
+	EnvIbmKpEndpoint   = "IBMCLOUD_KP_ENDPOINT"
+	EnvIbmKpInstanceId = "IBMCLOUD_KP_INSTANCE_ID"
+	EnvIbmKpKeyId      = "IBMCLOUD_KP_KEY_ID"
+)
+
+// Wrapper represents credentials and Key information for the KMS Key used to
+// encryption and decryption
+type Wrapper struct {
+	apiKey     string
+	endpoint   string
+	instanceId string
+	keyId      string
+
+	keyNotRequired bool
+
+	currentkeyId *atomic.Value
+
+	client *kp.Client
+
+	logger hclog.Logger
+}
+
+// Ensure that we are implementing Wrapper
+var _ wrapping.Wrapper = (*Wrapper)(nil)
+
+// NewWrapper creates a new IBMKP wrapper with the provided options
+func NewWrapper() *Wrapper {
+	k := &Wrapper{
+		currentkeyId: new(atomic.Value),
+	}
+	k.currentkeyId.Store("")
+	return k
+}
+
+// SetConfig sets the fields on the Wrapper object based on
+// values from the config parameter.
+//
+// Order of precedence IBM Key Protect values:
+// * Environment variable
+// * Passed in config map
+func (k *Wrapper) SetConfig(_ context.Context, opt ...wrapping.Option) (*wrapping.WrapperConfig, error) {
+	opts, err := getOpts(opt...)
+	if err != nil {
+		return nil, err
+	}
+
+	k.keyNotRequired = opts.withKeyNotRequired
+	k.logger = opts.withLogger
+
+	// Check and set API Key
+	switch {
+	case os.Getenv(EnvIbmApiKey) != "" && !opts.withDisallowEnvVars:
+		k.apiKey = os.Getenv(EnvIbmApiKey)
+	case opts.withApiKey != "":
+		k.apiKey = opts.withApiKey
+	case k.keyNotRequired:
+		// key not required to set config
+	default:
+		return nil, fmt.Errorf("'api_key' was not found in env or config for IBM Key Protect wrapper configuration")
+	}
+
+	// Check and set Endpoint
+	switch {
+	case os.Getenv(EnvIbmKpEndpoint) != "" && !opts.withDisallowEnvVars:
+		k.endpoint = os.Getenv(EnvIbmKpEndpoint)
+	case opts.withEndpoint != "":
+		k.endpoint = opts.withEndpoint
+	default:
+		k.endpoint = kp.DefaultBaseURL
+	}
+
+	// Check and set instanceId
+	switch {
+	case os.Getenv(EnvIbmKpInstanceId) != "" && !opts.withDisallowEnvVars:
+		k.instanceId = os.Getenv(EnvIbmKpInstanceId)
+	case opts.withInstanceId != "":
+		k.instanceId = opts.withInstanceId
+	case k.keyNotRequired:
+		// key not required to set config
+	default:
+		return nil, fmt.Errorf("'instance_id' was not found in env or config for IBM Key Protect wrapper configuration")
+	}
+
+	// Check and set keyId
+	switch {
+	case os.Getenv(EnvIbmKpKeyId) != "" && !opts.withDisallowEnvVars:
+		k.keyId = os.Getenv(EnvIbmKpKeyId)
+	case opts.WithKeyId != "":
+		k.keyId = opts.WithKeyId
+	default:
+		return nil, fmt.Errorf("'key_id' was not found in env or config for IBM Key Protect wrapper configuration")
+	}
+
+	// Check and set k.client
+	if k.client == nil {
+		client, err := k.GetIbmKpClient()
+		if err != nil {
+			return nil, fmt.Errorf("error initializing IBM Key Protect wrapping client: %w", err)
+		}
+
+		if !k.keyNotRequired {
+			// Test the client connection using provided key ID
+			key, err := client.GetKeyMetadata(context.Background(), k.keyId)
+			if err != nil {
+				return nil, fmt.Errorf("error fetching IBM Key Protect wrapping key information: %w", err)
+			}
+			if key == nil || key.ID == "" {
+				return nil, errors.New("no key information returned")
+			}
+			k.currentkeyId.Store(key.ID)
+		}
+
+		k.client = client
+	}
+
+	// Map that holds non-sensitive configuration info
+	wrapConfig := new(wrapping.WrapperConfig)
+	wrapConfig.Metadata = make(map[string]string)
+	wrapConfig.Metadata["endpoint"] = k.endpoint
+	wrapConfig.Metadata["instance_id"] = k.instanceId
+	wrapConfig.Metadata["key_id"] = k.keyId
+
+	return wrapConfig, nil
+}
+
+// Type returns the wrapping type for this particular Wrapper implementation
+func (k *Wrapper) Type(_ context.Context) (wrapping.WrapperType, error) {
+	return wrapping.WrapperTypeIbmKp, nil
+}
+
+// keyId returns the last known key id
+func (k *Wrapper) KeyId(_ context.Context) (string, error) {
+	return k.currentkeyId.Load().(string), nil
+}
+
+// Encrypt is used to encrypt the master key using the the AWS CMK.
+// This returns the ciphertext, and/or any errors from this
+// call. This should be called after the KMS client has been instantiated.
+func (k *Wrapper) Encrypt(ctx context.Context, plaintext []byte, opt ...wrapping.Option) (*wrapping.BlobInfo, error) {
+	if plaintext == nil {
+		return nil, fmt.Errorf("given plaintext for encryption is nil")
+	}
+
+	env, err := wrapping.EnvelopeEncrypt(plaintext, opt...)
+	if err != nil {
+		return nil, fmt.Errorf("error wrapping data: %w", err)
+	}
+
+	if k.client == nil {
+		return nil, fmt.Errorf("nil client")
+	}
+
+	envelopKeyBase64 := []byte(base64.StdEncoding.EncodeToString(env.Key))
+	ciphertext, err := k.client.Wrap(ctx, k.keyId, envelopKeyBase64, nil)
+	if err != nil {
+		return nil, fmt.Errorf("error encrypting data: %w", err)
+	}
+
+	k.currentkeyId.Store(k.keyId)
+
+	ret := &wrapping.BlobInfo{
+		Ciphertext: env.Ciphertext,
+		Iv:         env.Iv,
+		KeyInfo: &wrapping.KeyInfo{
+			KeyId:      k.keyId,
+			WrappedKey: ciphertext,
+		},
+	}
+
+	return ret, nil
+}
+
+// Decrypt is used to decrypt the ciphertext. This should be called after Init.
+func (k *Wrapper) Decrypt(ctx context.Context, in *wrapping.BlobInfo, opt ...wrapping.Option) ([]byte, error) {
+	if in == nil {
+		return nil, errors.New("given input for decryption is nil")
+	}
+
+	if in.KeyInfo == nil {
+		return nil, errors.New("key info is nil")
+	}
+
+	envelopKeyBase64, err := k.client.Unwrap(ctx, in.KeyInfo.KeyId, in.KeyInfo.WrappedKey, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	envelopKey, err := base64.StdEncoding.DecodeString(string(envelopKeyBase64))
+	if err != nil {
+		return nil, err
+	}
+
+	envInfo := &wrapping.EnvelopeInfo{
+		Key:        envelopKey,
+		Iv:         in.Iv,
+		Ciphertext: in.Ciphertext,
+	}
+
+	plaintext, err := wrapping.EnvelopeDecrypt(envInfo, opt...)
+	if err != nil {
+		return nil, fmt.Errorf("error decrypting data with envelope: %w", err)
+	}
+
+	return plaintext, nil
+}
+
+// Client returns the IBM KP client used by the wrapper.
+func (k *Wrapper) Client() *kp.Client {
+	return k.client
+}
+
+func (k *Wrapper) getConfigAPIKey() kp.ClientConfig {
+	return kp.ClientConfig{
+		BaseURL:    k.endpoint,
+		APIKey:     k.apiKey,
+		TokenURL:   kp.DefaultTokenURL,
+		InstanceID: k.instanceId,
+		Verbose:    kp.VerboseFailOnly,
+	}
+}
+
+// GetIbmKpClient returns an instance of the KMS client.
+func (k *Wrapper) GetIbmKpClient() (*kp.Client, error) {
+
+	options := k.getConfigAPIKey()
+	api, err := kp.New(options, kp.DefaultTransport())
+	if err != nil {
+		return nil, err
+	}
+
+	return api, nil
+
+}