Method: cryptoKeyVersions.rawEncrypt

Full name: projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.rawEncrypt

Encrypts data using portable cryptographic primitives. Most users should choose cryptoKeys.encrypt and cryptoKeys.decrypt rather than their raw counterparts. The CryptoKey.purpose must be RAW_ENCRYPT_DECRYPT.

HTTP request

POST https://cloudkms.googleapis.com/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:rawEncrypt

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. The resource name of the CryptoKeyVersion to use for encryption.

Authorization requires the following IAM permission on the specified resource name:

  • cloudkms.cryptoKeyVersions.useToEncrypt

Request body

The request body contains data with the following structure:

JSON representation 
{
  "plaintext": string,
  "additionalAuthenticatedData": string,
  "plaintextCrc32c": string,
  "additionalAuthenticatedDataCrc32c": string,
  "initializationVector": string,
  "initializationVectorCrc32c": string
}
Fields
plaintext

string (bytes format)

Required. The data to encrypt. Must be no larger than 64KiB.

The maximum size depends on the key version's protectionLevel. For SOFTWARE keys, the plaintext must be no larger than 64KiB. For HSM keys, the combined length of the plaintext and additionalAuthenticatedData fields must be no larger than 8KiB.

A base64-encoded string.
additionalAuthenticatedData

string (bytes format)

Optional. Optional data that, if specified, must also be provided during decryption through RawDecryptRequest.additional_authenticated_data.

This field may only be used in conjunction with an algorithm that accepts additional authenticated data (for example, AES-GCM).

The maximum size depends on the key version's protectionLevel. For SOFTWARE keys, the plaintext must be no larger than 64KiB. For HSM keys, the combined length of the plaintext and additionalAuthenticatedData fields must be no larger than 8KiB.

A base64-encoded string.
plaintextCrc32c

string (Int64Value format)

Optional. An optional CRC32C checksum of the RawEncryptRequest.plaintext. If specified, KeyManagementService will verify the integrity of the received plaintext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(plaintext) is equal to plaintextCrc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
additionalAuthenticatedDataCrc32c

string (Int64Value format)

Optional. An optional CRC32C checksum of the RawEncryptRequest.additional_authenticated_data. If specified, KeyManagementService will verify the integrity of the received additionalAuthenticatedData using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(additionalAuthenticatedData) is equal to additionalAuthenticatedDataCrc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
initializationVector

string (bytes format)

Optional. A customer-supplied initialization vector that will be used for encryption. If it is not provided for AES-CBC and AES-CTR, one will be generated. It will be returned in RawEncryptResponse.initialization_vector.

A base64-encoded string.
initializationVectorCrc32c

string (Int64Value format)

Optional. An optional CRC32C checksum of the RawEncryptRequest.initialization_vector. If specified, KeyManagementService will verify the integrity of the received initializationVector using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(initializationVector) is equal to initializationVectorCrc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.

Response body

Response message for KeyManagementService.RawEncrypt.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "ciphertext": string,
  "initializationVector": string,
  "tagLength": integer,
  "ciphertextCrc32c": string,
  "initializationVectorCrc32c": string,
  "verifiedPlaintextCrc32c": boolean,
  "verifiedAdditionalAuthenticatedDataCrc32c": boolean,
  "verifiedInitializationVectorCrc32c": boolean,
  "name": string,
  "protectionLevel": enum (ProtectionLevel)
}
Fields
ciphertext

string (bytes format)

The encrypted data. In the case of AES-GCM, the authentication tag is the tagLength bytes at the end of this field.

A base64-encoded string.
initializationVector

string (bytes format)

The initialization vector (IV) generated by the service during encryption. This value must be stored and provided in RawDecryptRequest.initialization_vector at decryption time.

A base64-encoded string.
tagLength

integer

The length of the authentication tag that is appended to the end of the ciphertext.
ciphertextCrc32c

string (Int64Value format)

Integrity verification field. A CRC32C checksum of the returned RawEncryptResponse.ciphertext. An integrity check of ciphertext can be performed by computing the CRC32C checksum of ciphertext and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
initializationVectorCrc32c

string (Int64Value format)

Integrity verification field. A CRC32C checksum of the returned RawEncryptResponse.initialization_vector. An integrity check of initializationVector can be performed by computing the CRC32C checksum of initializationVector and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
verifiedPlaintextCrc32c

boolean

Integrity verification field. A flag indicating whether RawEncryptRequest.plaintext_crc32c was received by KeyManagementService and used for the integrity verification of the plaintext. A false value of this field indicates either that RawEncryptRequest.plaintext_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set RawEncryptRequest.plaintext_crc32c but this field is still false, discard the response and perform a limited number of retries.
verifiedAdditionalAuthenticatedDataCrc32c

boolean

Integrity verification field. A flag indicating whether RawEncryptRequest.additional_authenticated_data_crc32c was received by KeyManagementService and used for the integrity verification of additionalAuthenticatedData. A false value of this field indicates either that // RawEncryptRequest.additional_authenticated_data_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set RawEncryptRequest.additional_authenticated_data_crc32c but this field is still false, discard the response and perform a limited number of retries.
verifiedInitializationVectorCrc32c

boolean

Integrity verification field. A flag indicating whether RawEncryptRequest.initialization_vector_crc32c was received by KeyManagementService and used for the integrity verification of initializationVector. A false value of this field indicates either that RawEncryptRequest.initialization_vector_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set RawEncryptRequest.initialization_vector_crc32c but this field is still false, discard the response and perform a limited number of retries.
name

string

The resource name of the CryptoKeyVersion used in encryption. Check this field to verify that the intended resource was used for encryption.
protectionLevel

enum (ProtectionLevel)

The ProtectionLevel of the CryptoKeyVersion used in encryption.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloudkms
  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.