Tink setup

  • Tink can be built from source or installed using language-specific packages for C++, Go, Java, Objective-C, and Python.

  • Tink offers core libraries and extensions for cloud key management systems like AWS KMS and Google Cloud KMS.

  • After installation, users should choose a cryptographic primitive and establish a key management strategy.

  • Language-specific instructions and dependencies are detailed for building and using Tink in each supported language.

  • Tink supports various operating systems, compilers, and build systems for each language, ensuring flexibility for developers.

You can build Tink from source or use language-specific packages. The following instructions get you started.

After you've finished installing and setting up Tink, continue with the Next Steps at the end of this page.

C++

Set up Tink C++ and extensions

Go

Set up Tink Go and extensions

Java

Set up Tink Java and extensions

ObjC

See the HOWTO on GitHub

Python

The Tink Python library, tink-py, supports Python 3.9 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and ARM64) and Windows (x86-64). The latest release is 1.12.0. It can be installed locally using Pip or used with Bazel.

Tink Python provides integrations with AWS KMS, Google Cloud KMS and HashiCorp Vault.

Pip

You can install the Tink Python binary release for your system from PyPI, by running the following command:

pip3 install tink==1.12.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.12.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.12.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.12.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.12.0

If a binary package is not published for your environment, pip automatically resorts to building the project using the source distribution published to PyPI. If this is the case, you need Bazel or Bazelisk and the protobuf compiler installed to successfully build the project.

Bazel

For Tink Python 1.12 and later, Bazel users need to use MODULE.bazel:

bazel_dep(name = "tink_py")

archive_override(
    module_name = "tink_py",
    urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.12.0/tink-py-1.12.0.zip"],
    strip_prefix = "tink-py-1.12.0",
    sha256 = "5968d0ba84f1fc958f685cfdfc667bfb1d8414a22eaa6f502b290a23af2aba43",
)

We don't publish Tink Python in the Bazel Central Registry at the moment.

Next steps

Once you've finished setting up Tink, continue with the standard Tink usage steps:

  • Choose a primitive – Decide which primitive to use based on your use case
  • Manage keys – Protect your keys with your external KMS, generate keysets, and rotate your keys