Master Key Types
Google Cloud Platform (GCP) offers 2048, 3072, and 4096 bit RSA asymmetric master keys. It is also one of the only Cloud Service Providers (CSPs) to offer 256 bit symmetric master keys.
GCP offers symmetric AES GCM and asymmetric RSA OAEP encryption methods.
Plaintext Size Limits
Google Cloud Platform offers a plaintext size limit of 64KB.
Bring Your Own Key (BYOK) Options
To utilize BYOK, the key being used on the cloud must first be imported the Cloud Service Provider, and to import the key, it must first be wrapped.Google Cloud Platform takes an AES-256 key that is wrapped by RSA 3072.
Cloud HSM Compliance
Each Cloud Service allows users to store keys in a cloud HSM, but the cloud HSM for each service has different compliancy certificates. All HSM keys on Google Cloud Platform are FIPS 140-2 level 3 compliant.
Google Cloud KMS Features
Google Cloud KMS can store keys in either an HSM or a software application. This key storage can be accessed by both the customer and the CSP. Google Cloud KMS is FIPS 140-2 Level 3 compliant if an HSM is used, and FIPS 140-2 Level 1 compliant if software keys are used. Google Cloud KMS supports symmetric and asymmetric keys. It also supports 256-bit Advanced Encryption Standard (AES-256) keys in Galois Counter Mode (GCM), padded with Cloud KMS-internal metadata and RSA keys of sizes 2048, 3072 and 4096.Google Cloud KMS is capable of key management, storage, auditing, encryption, encryption for Kubernetes, and both HSM and software key management.