- NAME
-
- gcloud kms raw-decrypt - decrypt a ciphertext file using a raw key
- SYNOPSIS
-
-
gcloud kms raw-decrypt
--ciphertext-file
=CIPHERTEXT_FILE
--plaintext-file
=PLAINTEXT_FILE
--version
=VERSION
[--additional-authenticated-data-file
=ADDITIONAL_AUTHENTICATED_DATA_FILE
] [--initialization-vector-file
=INITIALIZATION_VECTOR_FILE
] [--key
=KEY
] [--keyring
=KEYRING
] [--location
=LOCATION
] [--skip-integrity-verification
] [GCLOUD_WIDE_FLAG …
]
-
- DESCRIPTION
-
gcloud kms raw-decrypt
decrypts the given ciphertext file using the given CryptoKey containing a raw key and writes the result to the named plaintext file. The ciphertext file must not be larger than 64KiB.The supported algorithms are:
AES-128-GCM
,AES-256-GCM
,AES-128-CBC
,AES-256-CBC
,AES-128-CTR
,and AES-256-CTR
.AES-GCM
provides authentication which means that it accepts additional authenticated data (AAD). So, the flag--additional-authenticated-data-file
is only valid withAES-128-GCM
andAES-256-GCM
algorithms. If AAD is provided during encryption, it must be provided during decryption too. The file must not be larger than 64KiB.If
--plaintext-file
or--additional-authenticated-data-file
or--initialization-vector-file
is set to '-', that file is read from stdin. Similarly, if--ciphertext-file
is set to '-', the ciphertext is written to stdout.By default, the command performs integrity verification on data sent to and received from Cloud KMS. Use
--skip-integrity-verification
to disable integrity verification. - EXAMPLES
-
The following command reads and decrypts the file
path/to/input/ciphertext
. The file will be decrypted using the CryptoKeyKEYNAME
containing a raw key, from the KeyRingKEYRING
in theglobal
location. It uses the additional authenticated data filepath/to/input/aad
(only valid with theAES-GCM
algorithms) and the initialization vector filepath/to/input/iv
. The resulting plaintext will be written topath/to/output/plaintext
.gcloud kms raw-decrypt --key=KEYNAME --keyring=KEYRING --location=global --ciphertext-file=path/to/input/ciphertext --additional-authenticated-data-file=path/to/input/aad --initialization-vector-file=path/to/input/iv --plaintext-file=path/to/output/plaintext
- REQUIRED FLAGS
-
--ciphertext-file
=CIPHERTEXT_FILE
- File path of the ciphertext file to decrypt.
--plaintext-file
=PLAINTEXT_FILE
- File path of the plaintext file to store the decrypted data.
--version
=VERSION
- Version to use for decryption.
- OPTIONAL FLAGS
-
--additional-authenticated-data-file
=ADDITIONAL_AUTHENTICATED_DATA_FILE
- File path to the optional file containing the additional authenticated data.
--initialization-vector-file
=INITIALIZATION_VECTOR_FILE
- File path to the optional file containing the initialization vector for decryption.
--key
=KEY
- The (raw) key to use for decryption.
--keyring
=KEYRING
- Key ring of the key.
--location
=LOCATION
- Location of the keyring.
--skip-integrity-verification
- Skip integrity verification on request and response API fields.
- GCLOUD WIDE FLAGS
-
These flags are available to all commands:
--access-token-file
,--account
,--billing-project
,--configuration
,--flags-file
,--flatten
,--format
,--help
,--impersonate-service-account
,--log-http
,--project
,--quiet
,--trace-token
,--user-output-enabled
,--verbosity
.Run
$ gcloud help
for details. - NOTES
-
These variants are also available:
gcloud alpha kms raw-decrypt
gcloud beta kms raw-decrypt
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-02-06 UTC.
[{
"type": "thumb-down",
"id": "hardToUnderstand",
"label":"Hard to understand"
},{
"type": "thumb-down",
"id": "incorrectInformationOrSampleCode",
"label":"Incorrect information or sample code"
},{
"type": "thumb-down",
"id": "missingTheInformationSamplesINeed",
"label":"Missing the information/samples I need"
},{
"type": "thumb-down",
"id": "otherDown",
"label":"Other"
}]
[{
"type": "thumb-up",
"id": "easyToUnderstand",
"label":"Easy to understand"
},{
"type": "thumb-up",
"id": "solvedMyProblem",
"label":"Solved my problem"
},{
"type": "thumb-up",
"id": "otherUp",
"label":"Other"
}]
{
"lastModified": "Last updated 2024-02-06 UTC.",
"confidential": False
}