skills.rest
yuezhen-huang
yuezhen-huangCOMMUNITY
Explore all skills by this author →
GitHub

kms-knowledge

Guides integration of ByteDance KMS SDKs for data encryption and sensitive configuration management.

Updated Apr 30, 2026
Search Tags:#golang#encryption#kms#key management#sdk integration#sensitive data#bytedance
One-click install
npx skills add https://github.com/yuezhen-huang/my-bytedance-skillhub --skill kms-knowledge-yuezhen-huang
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kms-knowledge
Source: https://github.com/yuezhen-huang/my-bytedance-skillhub/tree/main/kms-knowledge
Command: npx skills add https://github.com/yuezhen-huang/my-bytedance-skillhub --skill kms-knowledge-yuezhen-huang

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It helps engineers correctly integrate ByteDance's internal KMS key management platform to encrypt sensitive data at rest (phone numbers, ID numbers, amounts) and host sensitive configurations like database passwords and API keys, avoiding misconfigured SDK versions, authentication failures, and insecure ciphertext storage. ## Core Features & Use Cases - SDK Integration Guidance: Covers V1 (Wrapper) and V2 (DKMS) SDKs across Golang, Python, Java, C++, and NodeJS, including installation sources, version selection, and identity authentication via doas or TCE service authentication. - Platform Operations: Walks through service registration, data key creation and sharing, sensitive configuration hosting, and permission requests on the KMS platform. - Best Practices: Explains base64 encoding of ciphertext before persistence, singleton DKMS client usage, SQL decryption functions (KMSDecryptExt) in QueryEditor/Dorado, and GORM integration via dkms-gorm. - Use Case: A backend engineer needs to encrypt user phone numbers before writing them to RDS. Use this Skill to pick the right SDK version, initialize a singleton DKMS client, encrypt fields with a named data key, and store base64-encoded ciphertext. ## Quick Start Ask the AI how to encrypt a sensitive database field using the Golang KMS SDK and have it produce the client initialization and encrypt/decrypt code.

Frequently Asked Questions about kms-knowledge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I encrypt sensitive data with the ByteDance KMS Golang SDK?▼

Use the kms-v2-sdk-golang DKMS client initialized as a singleton, then call Encrypt with your data key name and plaintext bytes. Encode the returned ciphertext with base64 before persisting it, since the SDK does not perform base64 encoding itself.

What is the difference between KMS V1 Wrapper SDK and V2 DKMS SDK?▼

The V1 Wrapper SDK automatically routes to KMS V1 or V2 based on TCC configuration for the service PSM, keeping V1 interfaces. The V2 DKMS SDK natively supports GDPR/ZTI token authentication and zero-trust certificate authentication, but drops some deprecated V1 interfaces.

How do I authenticate KMS SDK locally and on TCE?▼

For local testing, use the doas tool, for example doas -p p.s.m go run main.go. For deployed services, enable service authentication in the TCE service cluster configuration under advanced settings.

How do I decrypt KMS-encrypted columns in SQL queries?▼

Use SELECT KMSDecryptExt(column, encrypting_psm) in QueryEditor or Dorado, or kms_try_decrypt to return the original value on failure. If execution fails, prepend set tqs.query.engine.type=hive or sparkCli.

Why should KMS ciphertext be base64 encoded before storage?▼

The DKMS SDK returns ciphertext as raw bytes and does not perform base64 encoding. Directly casting bytes to string can corrupt data, so base64 encoding is recommended before persisting ciphertext to disk or databases.

Can multiple services share the same KMS data key?▼

Yes. On the KMS platform, select the key under the service's data keys, click share key, and choose a sharing type such as public platform decryption permission. Alternatively, users can request access through the platform's permission ticket workflow.

Related Skills

Explore More Software Engineering Skills→
rizaldiemrizaldiem

aws-sdk-java-v2-kms

Automate AWS KMS key management and encryption with the AWS SDK for Java 2.x.

Community
Advanced
cipherstashcipherstash
156

stash-supabase

Integrate CipherStash field-level encryption with Supabase using the @cipherstash/stack/supabase wrapper.

Official
Advanced
tylern91tylern91

aws-secrets-manager

Store and rotate secrets in AWS Secrets Manager with Lambda.

Community
Advanced
cipherstashcipherstash
156

stash-drizzle

Integrate CipherStash field-level encryption with Drizzle ORM for TypeScript applications.

Official
Advanced