tencent cloud

Key Management Service

DokumentasiKey Management Service

Asymmetric Data Encryption and Decryption

Download
Mode fokus
Ukuran font
Terakhir diperbarui: 2026-07-30 16:52:53
Diterjemahkan oleh AI

Operation Process

When you need to transmit sensitive information, such as exchanging keys, you must encrypt the sensitive data. From the perspective of the information recipient, you need to perform the following operations using an asymmetric encryption and decryption scheme:
1. To create an asymmetric encryption key in KMS, see Create a Master Key for details.
2. To obtain the public key in KMS, see Obtain the Public Key of an Asymmetric Key for details.
3. The information recipient distributes the public key to the information sender.
4. The information sender encrypts the sensitive data locally using the obtained public key and then sends the ciphertext to the information recipient.
5. After obtaining the ciphertext, the information recipient calls the decryption feature of KMS to decrypt the ciphertext. For API details, see Asymmetric Key Sm2 Decryption and Asymmetric Key RSA Decryption. For the TCCLI method, see Asymmetric Key Decryption.
During the transmission of sensitive data, ciphertext is used. The only key capable of decrypting this ciphertext is hosted and protected in KMS. No one, including Tencent Cloud, can obtain your key. This significantly enhances the security of encrypted sensitive data transmission.

Operation Steps

RSA Example

1. Create an asymmetric encryption key.
Request:
tccli kms CreateKey --Alias test --KeyUsage ASYMMETRIC_DECRYPT_RSA_2048
Returned results:
{
  "Response": {
      "KeyId": "22d79428-61d9-11ea-a3c8-525400******",
      "Alias": "test",
      "CreateTime": 1583739580,
      "Description": "",
      "KeyState": "Enabled",
      "KeyUsage": "ASYMMETRIC_DECRYPT_RSA_2048",
      "RequestId": "0e3c62db-a408-406a-af27-dd5ced******"
  }
}
2. Download the public key.
Request:
tccli kms GetPublicKey  --KeyId 22d79428-61d9-11ea-a3c8-525400******
Returned results:
{
"Response": {
    "RequestId": "408fa858-cd6d-4011-b8a0-653805******",
    "KeyId": "22d79428-61d9-11ea-a3c8-525400******",
    "PublicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzQk7x7ladgVFEEGYDbeUc5aO9TfiDplIO4WovBOVpIFoDS31n46YiCGiqj67qmYslZ2KMGCd3Nt+a+jdzwFiTx3O87wdKWcF2vHL9Ja+95VuCmKYeK1uhPyqqj4t9Ch/cyvxb0xaLBzztTQ9dXCxDhwj08b24T+/FYB9a4icuqQypCvjY1X9j8ivAsPEdHZoc9Di7JXBTZdVeZC1igCVgl6mwzdHTJCRydE2976zyjC7l6QsRT6pRsMF3696N07WnaKgGv3K/Zr/6RbxebLqtmNypNERIR7jTCt9L+fgYOX7anmuF5v7z0GfFsen9Tqb1LsZuQR0vgqCauOj************",
    "PublicKeyPem": "-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzQk7x7ladgVFEEGYDbeU\\nc5aO9TfiDplIO4WovBOVpIFoDS31n46YiCGiqj67qmYslZ2KMGCd3Nt+a+jdzwFi\\nTx3O87wdKWcF2vHL9Ja+95VuCmKYeK1uhPyqqj4t9Ch/cyvxb0xaLBzztTQ9dXCx\\nDhwj08b24T+/FYB9a4icuqQypCvjY1X9j8ivAsPEdHZoc9Di7JXBTZdVeZC1igCV\\ngl6mwzdHTJCRydE2976zyjC7l6QsRT6pRsMF3696N07WnaKgGv3K/Zr/6RbxebLq\\ntmNypNERIR7jTCt9L+fgYOX7anmuF5v7z0GfFsen9Tqb1LsZuQR0************\\n1QIDAQAB\\n-----END PUBLIC KEY-----\\n"
}
}
3. Encrypt using the public key.
3.1 Save the public key PublicKey to the file public_key.base64 and perform base64 decoding. Save to file:
echo "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzQk7x7ladgVFEEGYDbeUc5aO9TfiDplIO4WovBOVpIFoDS31n46YiCGiqj67qmYslZ2KMGCd3Nt+a+jdzwFiTx3O87wdKWcF2vHL9Ja+95VuCmKYeK1uhPyqqj4t9Ch/cyvxb0xaLBzztTQ9dXCxDhwj08b24T+/FYB9a4icuqQypCvjY1X9j8ivAsPEdHZoc9Di7JXBTZdVeZC1igCVgl6mwzdHTJCRydE2976zyjC7l6QsRT6pRsMF3696N07WnaKgGv3K/Zr/6RbxebLqtmNypNERIR7jTCt9L+fgYOX7anmuF5v7z0GfFsen9Tqb1LsZuQR0vgqCauOj************" > public_key.base64
Perform base64 decoding to obtain the actual content of the public key:
openssl enc -d -base64 -A -in public_key.base64 -out public_key.bin
3.2 Create a test plaintext file.
  echo "test" > test_rsa.txt
3.3 Use OPENSSL to encrypt the content of the test_rsa.txt file with the public key.
  openssl pkeyutl -in test_rsa.txt -out encrypted.bin -inkey public_key.bin -keyform DER -pubin -encrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256
3.4 Encode the public-key-encrypted data using base64 for easier transmission.
  openssl enc -e -base64 -A -in encrypted.bin -out encrypted.base64
4. Decrypt using the private key via KMS.
Use the ciphertext from the base64-encoded encrypted.base64 file as the Ciphertext parameter for AsymmetricRsaDecrypt to perform private key decryption. Request:
tccli kms AsymmetricRsaDecrypt --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm RSAES_OAEP_SHA_256 --Ciphertext "DEb/JBmuhVkYS34r0pR7Gv1WTc4khkxqf7S1WIr7/GXsAs/tfP/v/2+1SwsIG7BqW7kUZqr38/FGkaIEqYeewot37t3+Jx0t5w7/yXkUnyUfyfPpXlHXf94g3wFOjijEWWsjWWzaXTkTr8uWOfRBenq+bcaY783FIy03XjJW/Y0wKWjD3tULvKndCJO/3bkb65kn1Fbsfm20xrUUwqV/p2DVLXBdG1ymr0DjsbG7R0tb3ytc2LmH33YPAQE32eP27ciKzSml+w2tdUM3dw3nEZcTGMs1wFDGk0O1WB052jZ7TitUD9zCftFv2dKlZD3LRx1+vHqpNVgPhLmL******=="
Returned results:
{
"Response": {
 "RequestId": "6758cbf5-5e21-4c37-a2cf-8d47f5******",
 "KeyId": "22d79428-61d9-11ea-a3c8-525400******",
 "Plaintext": "dGVzdAo="
}
}
Note:
The process for using SM2 asymmetric keys for encryption and decryption is similar. For details on the private key decryption API, see Asymmetric Key SM2 Decryption.
Topik selanjutnya: Kebijakan Privasi

Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan