CREATE CLIENT MASTER KEY

-- (1) Use the key management tool gs_ktool to create a key. The tool returns the ID of the newly generated key.
[cmd] gs_ktool -g

-- (2) Use a privileged account to create a common user named alice.
openGauss=# CREATE USER alice PASSWORD '********';
-- (3) Use the account of common user alice to connect to the encrypted database and execute the syntax.
gsql -p 57101 postgres -U alice -r -C
gsql((GaussDB Kernel VxxxRxxxCxx build f521c606) compiled at 2021-09-16 14:55:22 commit 2935 last mr 6385 release)
Non-SSL connection (SSL connection is recommended when requiring high-security)
Type "help" for help.

openGauss=>

-- Create a CMK object.
openGauss=> CREATE CLIENT MASTER KEY alice_cmk WITH ( KEY_STORE = gs_ktool , KEY_PATH = "gs_ktool/1" , ALGORITHM = AES_256_CBC);

/* 
 * (1) Log in to the Huawei Cloud official website (https://www.huaweicloud.com), choose Console > Service List > Data Encryption Workshop > Key Management Service, and create a key.
 *     KMS is a key management service provided by Huawei Cloud. You can also use APIs to manage keys. For details, see the following public document of Huawei Cloud:
 *    (https://support.huaweicloud.com/dew_faq/dew_01_0053.html)
 */

/* 
 * (2) Establish a connection to the database server and execute the syntax. In the URL, set enable_ce to 1.
 *      Note: The code in this section is used as an example. Consider using the minimum code to implement the most basic functions.
 */
import java.sql.*;

public class CrtCmkTest {
    public static void main(String[] args) {
        String driver = "org.postgresql.Driver";
        try {
            Class.forName(driver);
        } catch (Exception e) {
            e.printStackTrace();
            return;
        }

        /* Information used to establish a connection to the database server */
        String dbUrl = "jdbc:postgresql://localhost:19900/postgres?enable_ce=1";
        String dbUser = "alice";
        String dbPassword = "********";

       /* 
        * Used to access the identity authentication information of Huawei Cloud KMS and KMS project information
        * Note: All parameters in this part can be found on the Console > My Credential page of the Huawei Cloud official website.
        */
        String iamUser = "alice_for_kms";
        String iamPassword = "********";
        String kmsDomain = "hw00000000";
        String kmsProjectName = "cn-east-3";
        String kmsProjectId = "00000000000000000000000000000000";

        /* SQL statement for creating a CMK object */
        String sql = "CREATE CLIENT MASTER KEY alice_cmk WITH ( " + 
         "KEY_STORE = huawei_kms, KEY_PATH = \"00000000-0000-0000-0000-000000000000\" , ALGORITHM = AES_256);";

        try {
            Connection conn = DriverManager.getConnection(dbUrl, dbUser, dbPassword);
            conn.setClientInfo("iamUser", iamUser);
            conn.setClientInfo("iamPassword", iamPassword);
            conn.setClientInfo("kmsDomain", kmsDomain);
            conn.setClientInfo("kmsProjectName", kmsProjectName);
            conn.setClientInfo("kmsProjectId", kmsProjectId );
            Statement stmt = conn.createStatement();
            System.out.println("results: " + stmt.executeUpdate(sql));
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}