Method: cryptoKeyVersions.asymmetricDecrypt

Full name: projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricDecrypt

Decrypts data that was encrypted with a public key retrieved from cryptoKeyVersions.getPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.

HTTP request

POST https://cloudkms.googleapis.com/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricDecrypt

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. The resource name of the CryptoKeyVersion to use for decryption.

Authorization requires the following IAM permission on the specified resource name:

  • cloudkms.cryptoKeyVersions.useToDecrypt

Request body

The request body contains data with the following structure:

JSON representation 
{
  "ciphertext": string,
  "ciphertextCrc32c": string
}
Fields
ciphertext

string (bytes format)

Required. The data encrypted with the named CryptoKeyVersion's public key using OAEP.

A base64-encoded string.
ciphertextCrc32c

string (Int64Value format)

Optional. An optional CRC32C checksum of the AsymmetricDecryptRequest.ciphertext. If specified, KeyManagementService will verify the integrity of the received AsymmetricDecryptRequest.ciphertext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricDecryptRequest.ciphertext) is equal to AsymmetricDecryptRequest.ciphertext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.

Response body

If successful, the response body contains data with the following structure:

Response message for KeyManagementService.AsymmetricDecrypt.

JSON representation 
{
  "plaintext": string,
  "plaintextCrc32c": string,
  "verifiedCiphertextCrc32c": boolean,
  "protectionLevel": enum (ProtectionLevel)
}
Fields
plaintext

string (bytes format)

The decrypted data originally encrypted with the matching public key.

A base64-encoded string.
plaintextCrc32c

string (Int64Value format)

Integrity verification field. A CRC32C checksum of the returned AsymmetricDecryptResponse.plaintext. An integrity check of AsymmetricDecryptResponse.plaintext can be performed by computing the CRC32C checksum of AsymmetricDecryptResponse.plaintext and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
verifiedCiphertextCrc32c

boolean

Integrity verification field. A flag indicating whether AsymmetricDecryptRequest.ciphertext_crc32c was received by KeyManagementService and used for the integrity verification of the ciphertext. A false value of this field indicates either that AsymmetricDecryptRequest.ciphertext_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricDecryptRequest.ciphertext_crc32c but this field is still false, discard the response and perform a limited number of retries.
protectionLevel

enum (ProtectionLevel)

The ProtectionLevel of the CryptoKeyVersion used in decryption.

Authorization Scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloudkms
  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.