Overview
The online encryption and decryption feature operation is divided into two APIs, as follows:
|
| | The KeyId and Plaintext parameters are required for this API operation. For details, see the Encrypt API documentation. |
| | The CiphertextBlob parameter is required for this API operation. For details, see the Decrypt API documentation. |
Encrypting
You can use the Encrypt API to encrypt user data. The maximum data size for encryption is 4 KB of any data. This method is suitable for encrypting database passwords, RSA keys, or other small sensitive information. For encrypting application data, it is recommended to use the DEK generated by the GenerateDataKey API to perform local encryption and decryption operations. The examples in this document use the Tencent Cloud command-line tool TCCLI. Subsequently, you can make calls using any supported programming language. Examples
Encryption Examples
When calling the encryption API using TCCLI, you must Base64-encode the plaintext data. This example uses the text "This example is used for testing".
Inputs
tccli kms Encrypt --KeyId 6xxxxxx-xxxx-xxxx-xxxx-5xxxxxxxxx5 --Plaintext "VGhpcyBleGFtcGxlIGlzIHVzZWQgZm9yIHRlc3Rpbmc="
Output
Upon successful execution, the ciphertext and the CMK ID used to encrypt the plaintext are returned in the response data. The ciphertext is used for subsequent decryption operations.
{
"KeyId": "6xxxxxx-xxxx-xxxx-xxxx-5xxxxxxxxx5",
"RequestId": "23781471-c213-44c5-92a4-731b882e25b5",
"CiphertextBlob": "Rrnqz5fthTxcSdCYIw5pBoEWLvrdqYNZ0oXKOmvYx/1Oo2R+DqEFPjjfVA1n1RE8PmVITaxuJwu9ZANK9uK3WA==-k-fKVP3WIlGpg8m9LMW4jEkQ==-k-mFM/5PEiMJsKC6fagEOfdlocOyC+a1n8PqaTOlBLT+rqjyKLVHUVtqamMQ3ERsYIe0wYoAMszR/FBrCJZ3a3B7f+8Xg="
}
Decryption Examples
Now, we will decrypt the encrypted data. In the example procedure, the CMK used is the one created above.
Inputs
tccli kms Decrypt --CiphertextBlob "Rrnqz5fthTxcSdCYIw5pBoEWLvrdqYNZ0oXKOmvYx/1Oo2R+DqEFPjjfVA1n1RE8PmVITaxuJwu9ZANK9uK3WA==-k-fKVP3WIlGpg8m9LMW4jEkQ==-k-mFM/5PEiMJsKC6fagEOfdlocOyC+a1n8PqaTOlBLT+rqjyKLVHUVtqamMQ3ERsYIe0wYoAMszR/FBrCJZ3a3B7f+8Xg="
Output
Upon successful execution, the Base64-encoded plaintext and the CMK ID used to encrypt it are returned in the response data. Subsequently, you need to perform an additional Base64 decoding operation to obtain the plaintext.
{
"Plaintext": "VGhpcyBleGFtcGxlIGlzIHVzZWQgZm9yIHRlc3Rpbmc=",
"KeyId": "6xxxxxx-xxxx-xxxx-xxxx-5xxxxxxxxx5",
"RequestId": "bcce3fae-1794-4136-a486-d42780c10702"
}