tencent cloud

Key Management Service

DocumentaçãoKey Management Service

Encryption and Decryption

Download
Modo Foco
Tamanho da Fonte
Última atualização: 2026-07-30 16:45:13
Traduzido por IA

Overview

The online encryption and decryption feature operation is divided into two APIs, as follows:
API Name
API Description
Description
Encrypt
Encrypting
The KeyId and Plaintext parameters are required for this API operation. For details, see the Encrypt API documentation.
Decrypt
Performs decryption.
The CiphertextBlob parameter is required for this API operation. For details, see the Decrypt API documentation.

Encrypting

You can use the Encrypt API to encrypt user data. The maximum data size for encryption is 4 KB of any data. This method is suitable for encrypting database passwords, RSA keys, or other small sensitive information. For encrypting application data, it is recommended to use the DEK generated by the GenerateDataKey API to perform local encryption and decryption operations.
The examples in this document use the Tencent Cloud command-line tool TCCLI. Subsequently, you can make calls using any supported programming language.

Examples

Encryption Examples

When calling the encryption API using TCCLI, you must Base64-encode the plaintext data. This example uses the text "This example is used for testing".

Inputs

tccli kms Encrypt --KeyId 6xxxxxx-xxxx-xxxx-xxxx-5xxxxxxxxx5 --Plaintext "VGhpcyBleGFtcGxlIGlzIHVzZWQgZm9yIHRlc3Rpbmc="

Output

Upon successful execution, the ciphertext and the CMK ID used to encrypt the plaintext are returned in the response data. The ciphertext is used for subsequent decryption operations.
{
    "KeyId": "6xxxxxx-xxxx-xxxx-xxxx-5xxxxxxxxx5",
    "RequestId": "23781471-c213-44c5-92a4-731b882e25b5",
    "CiphertextBlob": "Rrnqz5fthTxcSdCYIw5pBoEWLvrdqYNZ0oXKOmvYx/1Oo2R+DqEFPjjfVA1n1RE8PmVITaxuJwu9ZANK9uK3WA==-k-fKVP3WIlGpg8m9LMW4jEkQ==-k-mFM/5PEiMJsKC6fagEOfdlocOyC+a1n8PqaTOlBLT+rqjyKLVHUVtqamMQ3ERsYIe0wYoAMszR/FBrCJZ3a3B7f+8Xg="
}

Decryption Examples

Now, we will decrypt the encrypted data. In the example procedure, the CMK used is the one created above.

Inputs

tccli kms Decrypt --CiphertextBlob "Rrnqz5fthTxcSdCYIw5pBoEWLvrdqYNZ0oXKOmvYx/1Oo2R+DqEFPjjfVA1n1RE8PmVITaxuJwu9ZANK9uK3WA==-k-fKVP3WIlGpg8m9LMW4jEkQ==-k-mFM/5PEiMJsKC6fagEOfdlocOyC+a1n8PqaTOlBLT+rqjyKLVHUVtqamMQ3ERsYIe0wYoAMszR/FBrCJZ3a3B7f+8Xg="

Output

Upon successful execution, the Base64-encoded plaintext and the CMK ID used to encrypt it are returned in the response data. Subsequently, you need to perform an additional Base64 decoding operation to obtain the plaintext.
{
    "Plaintext": "VGhpcyBleGFtcGxlIGlzIHVzZWQgZm9yIHRlc3Rpbmc=",
    "KeyId": "6xxxxxx-xxxx-xxxx-xxxx-5xxxxxxxxx5",
    "RequestId": "bcce3fae-1794-4136-a486-d42780c10702"
}

Próximo: Política de privacidade

Ajuda e Suporte

Esta página foi útil?

comentários