add kms's symmetric_crypto_service for nbs

28 files changed, 1431 insertions, 0 deletions

diff --git a/.mapping.json b/.mapping.json
index d6c61d206e..6d5b3c8002 100644
--- a/.mapping.json
+++ b/.mapping.json
@@ -10848,6 +10848,24 @@
   "ydb/public/api/client/yc_private/iam/CMakeLists.linux-x86_64.txt":"",
   "ydb/public/api/client/yc_private/iam/CMakeLists.txt":"",
   "ydb/public/api/client/yc_private/iam/CMakeLists.windows-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/CMakeLists.darwin-arm64.txt":"",
+  "ydb/public/api/client/yc_private/kms/CMakeLists.darwin-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/CMakeLists.linux-aarch64.txt":"",
+  "ydb/public/api/client/yc_private/kms/CMakeLists.linux-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/CMakeLists.txt":"",
+  "ydb/public/api/client/yc_private/kms/CMakeLists.windows-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-arm64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-aarch64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.windows-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-arm64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-aarch64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-x86_64.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.txt":"",
+  "ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.windows-x86_64.txt":"",
   "ydb/public/api/client/yc_private/operation/CMakeLists.darwin-arm64.txt":"",
   "ydb/public/api/client/yc_private/operation/CMakeLists.darwin-x86_64.txt":"",
   "ydb/public/api/client/yc_private/operation/CMakeLists.linux-aarch64.txt":"",
diff --git a/ydb/public/api/client/yc_private/CMakeLists.txt b/ydb/public/api/client/yc_private/CMakeLists.txt
index 7adf2d27b6..7869b2eaa9 100644
--- a/ydb/public/api/client/yc_private/CMakeLists.txt
+++ b/ydb/public/api/client/yc_private/CMakeLists.txt
@@ -8,6 +8,7 @@
 
 add_subdirectory(compute)
 add_subdirectory(iam)
+add_subdirectory(kms)
 add_subdirectory(operation)
 add_subdirectory(resourcemanager)
 add_subdirectory(servicecontrol)
diff --git a/ydb/public/api/client/yc_private/kms/CMakeLists.darwin-arm64.txt b/ydb/public/api/client/yc_private/kms/CMakeLists.darwin-arm64.txt
new file mode 100644
index 0000000000..d358f81b11
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/CMakeLists.darwin-arm64.txt
@@ -0,0 +1,74 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+add_subdirectory(asymmetricencryption)
+add_subdirectory(asymmetricsignature)
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(client-yc_private-kms)
+set_property(TARGET client-yc_private-kms PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(client-yc_private-kms PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  yc_private-kms-asymmetricencryption
+  yc_private-kms-asymmetricsignature
+  contrib-libs-protobuf
+)
+target_proto_messages(client-yc_private-kms PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_key.proto
+)
+target_proto_addincls(client-yc_private-kms
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(client-yc_private-kms
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(client-yc_private-kms
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/CMakeLists.darwin-x86_64.txt b/ydb/public/api/client/yc_private/kms/CMakeLists.darwin-x86_64.txt
new file mode 100644
index 0000000000..d358f81b11
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/CMakeLists.darwin-x86_64.txt
@@ -0,0 +1,74 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+add_subdirectory(asymmetricencryption)
+add_subdirectory(asymmetricsignature)
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(client-yc_private-kms)
+set_property(TARGET client-yc_private-kms PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(client-yc_private-kms PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  yc_private-kms-asymmetricencryption
+  yc_private-kms-asymmetricsignature
+  contrib-libs-protobuf
+)
+target_proto_messages(client-yc_private-kms PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_key.proto
+)
+target_proto_addincls(client-yc_private-kms
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(client-yc_private-kms
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(client-yc_private-kms
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/CMakeLists.linux-aarch64.txt b/ydb/public/api/client/yc_private/kms/CMakeLists.linux-aarch64.txt
new file mode 100644
index 0000000000..cc5fd5548e
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/CMakeLists.linux-aarch64.txt
@@ -0,0 +1,75 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+add_subdirectory(asymmetricencryption)
+add_subdirectory(asymmetricsignature)
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(client-yc_private-kms)
+set_property(TARGET client-yc_private-kms PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(client-yc_private-kms PUBLIC
+  contrib-libs-linux-headers
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  yc_private-kms-asymmetricencryption
+  yc_private-kms-asymmetricsignature
+  contrib-libs-protobuf
+)
+target_proto_messages(client-yc_private-kms PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_key.proto
+)
+target_proto_addincls(client-yc_private-kms
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(client-yc_private-kms
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(client-yc_private-kms
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/CMakeLists.linux-x86_64.txt b/ydb/public/api/client/yc_private/kms/CMakeLists.linux-x86_64.txt
new file mode 100644
index 0000000000..cc5fd5548e
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/CMakeLists.linux-x86_64.txt
@@ -0,0 +1,75 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+add_subdirectory(asymmetricencryption)
+add_subdirectory(asymmetricsignature)
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(client-yc_private-kms)
+set_property(TARGET client-yc_private-kms PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(client-yc_private-kms PUBLIC
+  contrib-libs-linux-headers
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  yc_private-kms-asymmetricencryption
+  yc_private-kms-asymmetricsignature
+  contrib-libs-protobuf
+)
+target_proto_messages(client-yc_private-kms PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_key.proto
+)
+target_proto_addincls(client-yc_private-kms
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(client-yc_private-kms
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(client-yc_private-kms
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/CMakeLists.txt b/ydb/public/api/client/yc_private/kms/CMakeLists.txt
new file mode 100644
index 0000000000..d863ebd180
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/CMakeLists.txt
@@ -0,0 +1,19 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+if (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND NOT HAVE_CUDA)
+  include(CMakeLists.linux-x86_64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" AND NOT HAVE_CUDA)
+  include(CMakeLists.linux-aarch64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
+  include(CMakeLists.darwin-x86_64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
+  include(CMakeLists.darwin-arm64.txt)
+elseif (WIN32 AND CMAKE_SYSTEM_PROCESSOR STREQUAL "AMD64" AND NOT HAVE_CUDA)
+  include(CMakeLists.windows-x86_64.txt)
+endif()
diff --git a/ydb/public/api/client/yc_private/kms/CMakeLists.windows-x86_64.txt b/ydb/public/api/client/yc_private/kms/CMakeLists.windows-x86_64.txt
new file mode 100644
index 0000000000..d358f81b11
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/CMakeLists.windows-x86_64.txt
@@ -0,0 +1,74 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+add_subdirectory(asymmetricencryption)
+add_subdirectory(asymmetricsignature)
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(client-yc_private-kms)
+set_property(TARGET client-yc_private-kms PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(client-yc_private-kms PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  yc_private-kms-asymmetricencryption
+  yc_private-kms-asymmetricsignature
+  contrib-libs-protobuf
+)
+target_proto_messages(client-yc_private-kms PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/symmetric_key.proto
+)
+target_proto_addincls(client-yc_private-kms
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(client-yc_private-kms
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(client-yc_private-kms
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-arm64.txt b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-arm64.txt
new file mode 100644
index 0000000000..1c930dcaa7
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-arm64.txt
@@ -0,0 +1,57 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricencryption)
+set_property(TARGET yc_private-kms-asymmetricencryption PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricencryption PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricencryption PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricencryption
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricencryption
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricencryption
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-x86_64.txt b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-x86_64.txt
new file mode 100644
index 0000000000..1c930dcaa7
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.darwin-x86_64.txt
@@ -0,0 +1,57 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricencryption)
+set_property(TARGET yc_private-kms-asymmetricencryption PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricencryption PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricencryption PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricencryption
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricencryption
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricencryption
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-aarch64.txt b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-aarch64.txt
new file mode 100644
index 0000000000..eaed0d19a4
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-aarch64.txt
@@ -0,0 +1,58 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricencryption)
+set_property(TARGET yc_private-kms-asymmetricencryption PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricencryption PUBLIC
+  contrib-libs-linux-headers
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricencryption PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricencryption
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricencryption
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricencryption
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-x86_64.txt b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-x86_64.txt
new file mode 100644
index 0000000000..eaed0d19a4
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.linux-x86_64.txt
@@ -0,0 +1,58 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricencryption)
+set_property(TARGET yc_private-kms-asymmetricencryption PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricencryption PUBLIC
+  contrib-libs-linux-headers
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricencryption PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricencryption
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricencryption
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricencryption
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.txt b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.txt
new file mode 100644
index 0000000000..d863ebd180
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.txt
@@ -0,0 +1,19 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+if (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND NOT HAVE_CUDA)
+  include(CMakeLists.linux-x86_64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" AND NOT HAVE_CUDA)
+  include(CMakeLists.linux-aarch64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
+  include(CMakeLists.darwin-x86_64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
+  include(CMakeLists.darwin-arm64.txt)
+elseif (WIN32 AND CMAKE_SYSTEM_PROCESSOR STREQUAL "AMD64" AND NOT HAVE_CUDA)
+  include(CMakeLists.windows-x86_64.txt)
+endif()
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.windows-x86_64.txt b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.windows-x86_64.txt
new file mode 100644
index 0000000000..1c930dcaa7
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/CMakeLists.windows-x86_64.txt
@@ -0,0 +1,57 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricencryption)
+set_property(TARGET yc_private-kms-asymmetricencryption PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricencryption PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricencryption PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricencryption
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricencryption
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricencryption
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto b/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
new file mode 100644
index 0000000000..1ac799d4b5
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto
@@ -0,0 +1,39 @@
+syntax = "proto3";
+
+package yandex.cloud.priv.kms.v1.asymmetricencryption;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/ydb-platform/ydb/cloud/bitbucket/private-api/yandex/cloud/priv/kms/v1/asymmetricencryption;kms";
+option java_outer_classname = "PAEK";
+
+enum AsymmetricEncryptionAlgorithm {
+  ASYMMETRIC_ENCRYPTION_ALGORITHM_UNSPECIFIED = 0;
+  RSA_2048_ENC_OAEP_SHA_256 = 1;
+  RSA_3072_ENC_OAEP_SHA_256 = 2;
+  RSA_4096_ENC_OAEP_SHA_256 = 3;
+
+  // Leaving space for new algorithms
+  RSA_2048_ENC_OAEP_SHA_256_HSM = 65;
+  RSA_3072_ENC_OAEP_SHA_256_HSM = 66;
+  RSA_4096_ENC_OAEP_SHA_256_HSM = 67;
+}
+
+message AsymmetricEncryptionKey {
+  enum Status {
+    STATUS_UNSPECIFIED = 0;
+    CREATING = 1;
+    ACTIVE = 2;
+    INACTIVE = 3;
+    DELETED = 4;
+  }
+  string id = 1;
+  string folder_id = 2;
+  google.protobuf.Timestamp created_at = 3;
+  string name = 4;
+  string description = 5;
+  map<string, string> labels = 6;
+  Status status = 7;
+  AsymmetricEncryptionAlgorithm encryption_algorithm = 8;
+  bool deletion_protection = 9;
+}
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricencryption/ya.make b/ydb/public/api/client/yc_private/kms/asymmetricencryption/ya.make
new file mode 100644
index 0000000000..f1d078cd20
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricencryption/ya.make
@@ -0,0 +1,10 @@
+PROTO_LIBRARY()
+
+EXCLUDE_TAGS(GO_PROTO)
+
+GRPC()
+SRCS(
+    asymmetric_encryption_key.proto
+)
+
+END()
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-arm64.txt b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-arm64.txt
new file mode 100644
index 0000000000..2d51592240
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-arm64.txt
@@ -0,0 +1,57 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricsignature)
+set_property(TARGET yc_private-kms-asymmetricsignature PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricsignature PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricsignature PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricsignature
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricsignature
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricsignature
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-x86_64.txt b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-x86_64.txt
new file mode 100644
index 0000000000..2d51592240
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.darwin-x86_64.txt
@@ -0,0 +1,57 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricsignature)
+set_property(TARGET yc_private-kms-asymmetricsignature PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricsignature PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricsignature PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricsignature
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricsignature
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricsignature
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-aarch64.txt b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-aarch64.txt
new file mode 100644
index 0000000000..d32b93b44e
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-aarch64.txt
@@ -0,0 +1,58 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricsignature)
+set_property(TARGET yc_private-kms-asymmetricsignature PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricsignature PUBLIC
+  contrib-libs-linux-headers
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricsignature PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricsignature
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricsignature
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricsignature
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-x86_64.txt b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-x86_64.txt
new file mode 100644
index 0000000000..d32b93b44e
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.linux-x86_64.txt
@@ -0,0 +1,58 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricsignature)
+set_property(TARGET yc_private-kms-asymmetricsignature PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricsignature PUBLIC
+  contrib-libs-linux-headers
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricsignature PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricsignature
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricsignature
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricsignature
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.txt b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.txt
new file mode 100644
index 0000000000..d863ebd180
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.txt
@@ -0,0 +1,19 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+if (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND NOT HAVE_CUDA)
+  include(CMakeLists.linux-x86_64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" AND NOT HAVE_CUDA)
+  include(CMakeLists.linux-aarch64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
+  include(CMakeLists.darwin-x86_64.txt)
+elseif (CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
+  include(CMakeLists.darwin-arm64.txt)
+elseif (WIN32 AND CMAKE_SYSTEM_PROCESSOR STREQUAL "AMD64" AND NOT HAVE_CUDA)
+  include(CMakeLists.windows-x86_64.txt)
+endif()
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.windows-x86_64.txt b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.windows-x86_64.txt
new file mode 100644
index 0000000000..2d51592240
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/CMakeLists.windows-x86_64.txt
@@ -0,0 +1,57 @@
+
+# This file was generated by the build system used internally in the Yandex monorepo.
+# Only simple modifications are allowed (adding source-files to targets, adding simple properties
+# like target_include_directories). These modifications will be ported to original
+# ya.make files by maintainers. Any complex modifications which can't be ported back to the
+# original buildsystem will not be accepted.
+
+
+get_built_tool_path(
+  TOOL_grpc_cpp_bin
+  TOOL_grpc_cpp_dependency
+  contrib/tools/protoc/plugins/grpc_cpp
+  grpc_cpp
+)
+get_built_tool_path(
+  TOOL_protoc_bin
+  TOOL_protoc_dependency
+  contrib/tools/protoc/bin
+  protoc
+)
+get_built_tool_path(
+  TOOL_cpp_styleguide_bin
+  TOOL_cpp_styleguide_dependency
+  contrib/tools/protoc/plugins/cpp_styleguide
+  cpp_styleguide
+)
+
+add_library(yc_private-kms-asymmetricsignature)
+set_property(TARGET yc_private-kms-asymmetricsignature PROPERTY
+  PROTOC_EXTRA_OUTS .grpc.pb.cc .grpc.pb.h
+)
+target_link_libraries(yc_private-kms-asymmetricsignature PUBLIC
+  contrib-libs-cxxsupp
+  yutil
+  contrib-libs-grpc
+  contrib-libs-protobuf
+)
+target_proto_messages(yc_private-kms-asymmetricsignature PRIVATE
+  ${CMAKE_SOURCE_DIR}/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
+)
+target_proto_addincls(yc_private-kms-asymmetricsignature
+  ./
+  ${CMAKE_SOURCE_DIR}/
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+  ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
+)
+target_proto_outs(yc_private-kms-asymmetricsignature
+  --cpp_out=${CMAKE_BINARY_DIR}/
+  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
+)
+target_proto_plugin(yc_private-kms-asymmetricsignature
+  grpc_cpp
+  grpc_cpp
+)
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto b/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
new file mode 100644
index 0000000000..9d21746955
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto
@@ -0,0 +1,60 @@
+syntax = "proto3";
+
+package yandex.cloud.priv.kms.v1.asymmetricsignature;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/ydb-platform/ydb/cloud/bitbucket/private-api/yandex/cloud/priv/kms/v1/asymmetricsignature;kms";
+option java_outer_classname = "PASK";
+
+enum AsymmetricSignatureAlgorithm {
+  ASYMMETRIC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0;
+  RSA_2048_SIGN_PSS_SHA_256 = 1;
+  RSA_2048_SIGN_PSS_SHA_384 = 2;
+  RSA_2048_SIGN_PSS_SHA_512 = 3;
+  RSA_3072_SIGN_PSS_SHA_256 = 4;
+  RSA_3072_SIGN_PSS_SHA_384 = 5;
+  RSA_3072_SIGN_PSS_SHA_512 = 6;
+  RSA_4096_SIGN_PSS_SHA_256 = 7;
+  RSA_4096_SIGN_PSS_SHA_384 = 8;
+  RSA_4096_SIGN_PSS_SHA_512 = 9;
+  ECDSA_NIST_P256_SHA_256 = 10;
+  ECDSA_NIST_P384_SHA_384 = 11;
+  ECDSA_NIST_P521_SHA_512 = 12;
+  ECDSA_SECP256_K1_SHA_256 = 13;
+
+  // Leaving space for new algorithms
+  // Some algorithms are commented out because HSM does not support it yet
+//  RSA_2048_SIGN_PSS_SHA_256_HSM = 65;
+//  RSA_2048_SIGN_PSS_SHA_384_HSM = 66;
+//  RSA_2048_SIGN_PSS_SHA_512_HSM = 67;
+//  RSA_3072_SIGN_PSS_SHA_256_HSM = 68;
+//  RSA_3072_SIGN_PSS_SHA_384_HSM = 69;
+//  RSA_3072_SIGN_PSS_SHA_512_HSM = 70;
+//  RSA_4096_SIGN_PSS_SHA_256_HSM = 71;
+//  RSA_4096_SIGN_PSS_SHA_384_HSM = 72;
+//  RSA_4096_SIGN_PSS_SHA_512_HSM = 73;
+  ECDSA_NIST_P256_SHA_256_HSM = 74;
+  ECDSA_NIST_P384_SHA_384_HSM = 75;
+//  ECDSA_NIST_P521_SHA_512_HSM = 76;
+//  ECDSA_SECP256_K1_SHA_256_HSM = 77;
+}
+
+message AsymmetricSignatureKey {
+  enum Status {
+    STATUS_UNSPECIFIED = 0;
+    CREATING = 1;
+    ACTIVE = 2;
+    INACTIVE = 3;
+    DELETED = 4;
+  }
+  string id = 1;
+  string folder_id = 2;
+  google.protobuf.Timestamp created_at = 3;
+  string name = 4;
+  string description = 5;
+  map<string, string> labels = 6;
+  Status status = 7;
+  AsymmetricSignatureAlgorithm signature_algorithm = 8;
+  bool deletion_protection = 9;
+}
diff --git a/ydb/public/api/client/yc_private/kms/asymmetricsignature/ya.make b/ydb/public/api/client/yc_private/kms/asymmetricsignature/ya.make
new file mode 100644
index 0000000000..4cdf288730
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/asymmetricsignature/ya.make
@@ -0,0 +1,10 @@
+PROTO_LIBRARY()
+
+EXCLUDE_TAGS(GO_PROTO)
+
+GRPC()
+SRCS(
+    asymmetric_signature_key.proto
+)
+
+END()
diff --git a/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto b/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
new file mode 100644
index 0000000000..7d9de3592c
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/symmetric_crypto_service.proto
@@ -0,0 +1,209 @@
+syntax = "proto3";
+
+package yandex.cloud.priv.kms.v1;
+
+import "ydb/public/api/client/yc_private/kms/symmetric_key.proto";
+import "ydb/public/api/client/yc_private/kms/asymmetricencryption/asymmetric_encryption_key.proto";
+import "ydb/public/api/client/yc_private/kms/asymmetricsignature/asymmetric_signature_key.proto";
+
+option go_package = "github.com/ydb-platform/ydb/cloud/bitbucket/private-api/yandex/cloud/priv/kms/v1;kms";
+option java_outer_classname = "PSCS";
+
+// --- data plane for KMS symmetric cryptography operations
+
+service SymmetricCryptoService {
+
+  rpc Encrypt (SymmetricEncryptRequest) returns (SymmetricEncryptResponse);
+
+  rpc Decrypt (SymmetricDecryptRequest) returns (SymmetricDecryptResponse);
+
+  rpc BatchEncrypt (SymmetricBatchEncryptRequest) returns (SymmetricBatchEncryptResponse);
+
+  rpc BatchDecrypt (SymmetricBatchDecryptRequest) returns (SymmetricBatchDecryptResponse);
+
+  rpc ReEncrypt (SymmetricReEncryptRequest) returns (SymmetricReEncryptResponse);
+
+  rpc GenerateDataKey (GenerateDataKeyRequest) returns (GenerateDataKeyResponse);
+
+  rpc GenerateRandom (GenerateRandomRequest) returns (GenerateRandomResponse);
+
+  rpc GenerateAsymmetricDataKey (GenerateAsymmetricDataKeyRequest) returns (GenerateAsymmetricDataKeyResponse);
+
+}
+
+message SymmetricEncryptRequest {
+  string key_id = 1;
+  // Version ID, defaults to primary version if not given
+  string version_id = 2;
+  // Additional authenticated data, optional
+  bytes aad_context = 3;
+  // Plaintext to be encrypted
+  bytes plaintext = 4;
+}
+
+message SymmetricEncryptResponse {
+  string key_id = 1;
+  string version_id = 2; // version was used for encryption
+  bytes ciphertext = 3; // encrypted text
+}
+
+message SymmetricDecryptRequest {
+  string key_id = 1;
+  // Additional authenticated data, same as in corresponding EncryptRequest
+  bytes aad_context = 2;
+  // Encrypted text to be decrypted
+  bytes ciphertext = 3;
+}
+
+message SymmetricDecryptResponse {
+  string key_id = 1;
+  string version_id = 2; // version was used for decryption
+  bytes plaintext = 3; // decrypted text
+}
+
+message SymmetricBatchEncryptRequest {
+  string key_id = 1;
+  // Items to encrypt
+  repeated Item items = 2;
+
+  message Item {
+      // Version ID, defaults to primary version if not given
+      string version_id = 1;
+      // Additional authenticated data, optional
+      bytes aad_context = 2;
+      // Plaintext to be encrypted
+      bytes plaintext = 3;
+  }
+}
+
+message SymmetricBatchEncryptResponse {
+  string key_id = 1;
+  repeated Item items = 2; // encrypted items
+
+  message Item {
+    oneof data {
+      Success success = 1;
+      Failure failure = 2;
+    }
+  }
+
+  message Success {
+    string version_id = 1; // version used for encryption
+    bytes ciphertext = 2; // encrypted text
+  }
+
+  message Failure {
+    string error_message = 1; // error message
+  }
+}
+
+message SymmetricBatchDecryptRequest {
+  string key_id = 1;
+  // Items to decrypt
+  repeated Item items = 2;
+
+  message Item {
+    // Additional authenticated data, same as in corresponding EncryptRequest
+    bytes aad_context = 1;
+    // Encrypted text to be decrypted
+    bytes ciphertext = 2;
+  }
+}
+
+message SymmetricBatchDecryptResponse {
+  string key_id = 1;
+  repeated Item items = 2; // decrypted items
+
+  message Item {
+    oneof data {
+      Success success = 1;
+      Failure failure = 2;
+    }
+  }
+
+  message Success {
+    string version_id = 1; // version used for decryption
+    bytes plaintext = 2; // decrypted text
+  }
+
+  message Failure {
+    string error_message = 1; // error message
+  }
+}
+
+message GenerateDataKeyRequest {
+  string key_id = 1;
+  // Version ID, defaults to primary version if not given
+  string version_id = 2;
+  // Additional authenticated data to be used by encryption algorithm (optional)
+  bytes aad_context = 3;
+  // Encryption algorithm create data key for
+  SymmetricAlgorithm data_key_spec = 4;
+  // Plaintext for data key won't be returned if this parameter is true
+  bool skip_plaintext = 5;
+}
+
+message GenerateDataKeyResponse {
+  string key_id = 1;
+  string version_id = 2; // key version used for encryption of data key, optional
+  bytes data_key_plaintext = 3;  // data key in plaintext
+  bytes data_key_ciphertext = 4; // ciphered data key
+}
+
+message SymmetricReEncryptRequest {
+  // Target key id
+  string key_id = 1;
+  // Target key version id, optional, defaults to primary
+  string version_id = 2;
+  // Target additional authenticated data, optional
+  bytes aad_context = 3;
+  // Source key id, may be equal to target key id
+  string source_key_id = 4;
+  // Source add-context, may differ from target add-context
+  bytes source_aad_context = 5;
+  // Encrypted text to re-encrypt
+  bytes ciphertext = 6;
+}
+
+message SymmetricReEncryptResponse {
+  string key_id = 1; // target key id
+  string version_id = 2; // target key version id used for encryption
+  string source_key_id = 3; // source key id
+  string source_version_id = 4; // source key version used for decryption
+  bytes ciphertext = 5; // re-encrypted text
+}
+
+message GenerateRandomRequest {
+  // The folder id to identify and charge customer
+  string folder_id = 1;
+  // The size of the generated random bytes.
+  int64 size = 2;
+}
+
+message GenerateRandomResponse {
+  bytes random = 1;
+}
+
+message GenerateAsymmetricDataKeyRequest {
+  enum KeyType {
+    KEY_TYPE_UNSPECIFIED = 0;
+    ENCRYPTION = 1;
+    SIGNATURE = 2;
+  }
+  string key_id = 1;
+  string version_id = 2;
+  bytes aad_context = 3;
+  KeyType key_type = 4;
+  oneof key_spec {
+    asymmetricencryption.AsymmetricEncryptionAlgorithm encryption_key_spec = 5;
+    asymmetricsignature.AsymmetricSignatureAlgorithm signature_key_spec = 6;
+  }
+  bool skip_plaintext = 7;
+}
+
+message GenerateAsymmetricDataKeyResponse {
+  string key_id = 1;
+  string version_id = 2; // key version used for encryption of data key, optional
+  bytes asymmetric_data_key_plaintext = 3;
+  bytes asymmetric_data_key_ciphertext = 4;
+}
diff --git a/ydb/public/api/client/yc_private/kms/symmetric_key.proto b/ydb/public/api/client/yc_private/kms/symmetric_key.proto
new file mode 100644
index 0000000000..2ac271d931
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/symmetric_key.proto
@@ -0,0 +1,63 @@
+syntax = "proto3";
+
+package yandex.cloud.priv.kms.v1;
+
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/duration.proto";
+
+option go_package = "github.com/ydb-platform/ydb/cloud/bitbucket/private-api/yandex/cloud/priv/kms/v1;kms";
+option java_outer_classname = "PSK";
+
+enum SymmetricAlgorithm {
+  SYMMETRIC_ALGORITHM_UNSPECIFIED = 0;
+  AES_128 = 1;
+  AES_192 = 2;
+  AES_256 = 3;
+  AES_256_HSM = 4;
+}
+
+message SymmetricKeyVersion {
+  enum Status {
+    STATUS_UNSPECIFIED = 0;
+    ACTIVE = 1;
+    SCHEDULED_FOR_DESTRUCTION = 2;
+    DESTROYED = 3;
+  }
+
+  string id = 1;
+  string key_id = 2;
+  Status status = 3;
+  SymmetricAlgorithm algorithm = 4;
+  google.protobuf.Timestamp created_at = 5;
+  bool primary = 6; // true for _primary_ version
+  google.protobuf.Timestamp destroy_at = 7; // optional
+  bool hosted_by_hsm = 8;
+}
+
+
+message SymmetricKey {
+  enum Status {
+    STATUS_UNSPECIFIED = 0;
+    CREATING = 1;
+    ACTIVE = 2;
+    INACTIVE = 3;
+    DELETED = 4;
+  }
+
+  string id = 1;
+  string folder_id = 2;
+  google.protobuf.Timestamp created_at = 3;
+  string name = 4;
+  string description = 5;
+  map<string, string> labels = 6;
+
+  Status status = 7;
+
+  SymmetricKeyVersion primary_version = 8;
+  SymmetricAlgorithm default_algorithm = 9;
+
+  google.protobuf.Timestamp rotated_at = 10;
+  google.protobuf.Duration rotation_period = 11;
+
+  bool deletion_protection = 12;
+}
diff --git a/ydb/public/api/client/yc_private/kms/ya.make b/ydb/public/api/client/yc_private/kms/ya.make
new file mode 100644
index 0000000000..3b27cea004
--- /dev/null
+++ b/ydb/public/api/client/yc_private/kms/ya.make
@@ -0,0 +1,17 @@
+PROTO_LIBRARY()
+
+EXCLUDE_TAGS(GO_PROTO)
+
+GRPC()
+SRCS(
+    symmetric_crypto_service.proto
+    symmetric_key.proto
+)
+
+PEERDIR(
+    ydb/public/api/client/yc_private/kms/asymmetricencryption
+    ydb/public/api/client/yc_private/kms/asymmetricsignature
+)
+
+END()
+
diff --git a/ydb/public/api/client/yc_private/ya.make b/ydb/public/api/client/yc_private/ya.make
index a6ec22fcac..1e72b29617 100644
--- a/ydb/public/api/client/yc_private/ya.make
+++ b/ydb/public/api/client/yc_private/ya.make
@@ -1,6 +1,7 @@
 RECURSE(
     compute
     iam
+    kms
     operation
     resourcemanager
     servicecontrol