- NAME
-
- gcloud kms raw-decrypt - decrypt a ciphertext file using a raw key
- SYNOPSIS
-
-
gcloud kms raw-decrypt--ciphertext-file=CIPHERTEXT_FILE--plaintext-file=PLAINTEXT_FILE--version=VERSION[--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE] [--initialization-vector-file=INITIALIZATION_VECTOR_FILE] [--key=KEY] [--keyring=KEYRING] [--location=LOCATION] [--skip-integrity-verification] [GCLOUD_WIDE_FLAG …]
-
- DESCRIPTION
-
gcloud kms raw-decryptdecrypts the given ciphertext file using the given CryptoKey containing a raw key and writes the result to the named plaintext file. The ciphertext file must not be larger than 64KiB.The supported algorithms are:
AES-128-GCM,AES-256-GCM,AES-128-CBC,AES-256-CBC,AES-128-CTR,and AES-256-CTR.AES-GCMprovides authentication which means that it accepts additional authenticated data (AAD). So, the flag--additional-authenticated-data-fileis only valid withAES-128-GCMandAES-256-GCMalgorithms. If AAD is provided during encryption, it must be provided during decryption too. The file must not be larger than 64KiB.If
--plaintext-fileor--additional-authenticated-data-fileor--initialization-vector-fileis set to '-', that file is read from stdin. Similarly, if--ciphertext-fileis set to '-', the ciphertext is written to stdout.By default, the command performs integrity verification on data sent to and received from Cloud KMS. Use
--skip-integrity-verificationto disable integrity verification. - EXAMPLES
-
The following command reads and decrypts the file
path/to/input/ciphertext. The file will be decrypted using the CryptoKeyKEYNAMEcontaining a raw key, from the KeyRingKEYRINGin thegloballocation. It uses the additional authenticated data filepath/to/input/aad(only valid with theAES-GCMalgorithms) and the initialization vector filepath/to/input/iv. The resulting plaintext will be written topath/to/output/plaintext.gcloud kms raw-decrypt --key=KEYNAME --keyring=KEYRING --location=global --ciphertext-file=path/to/input/ciphertext --additional-authenticated-data-file=path/to/input/aad --initialization-vector-file=path/to/input/iv --plaintext-file=path/to/output/plaintext - REQUIRED FLAGS
-
--ciphertext-file=CIPHERTEXT_FILE- File path of the ciphertext file to decrypt.
--plaintext-file=PLAINTEXT_FILE- File path of the plaintext file to store the decrypted data.
--version=VERSION- Version to use for decryption.
- OPTIONAL FLAGS
-
--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE- File path to the optional file containing the additional authenticated data.
--initialization-vector-file=INITIALIZATION_VECTOR_FILE- File path to the optional file containing the initialization vector for decryption.
--key=KEY- The (raw) key to use for decryption.
--keyring=KEYRING- Key ring of the key.
--location=LOCATION- Location of the keyring.
--skip-integrity-verification- Skip integrity verification on request and response API fields.
- GCLOUD WIDE FLAGS
-
These flags are available to all commands:
--access-token-file,--account,--billing-project,--configuration,--flags-file,--flatten,--format,--help,--impersonate-service-account,--log-http,--project,--quiet,--trace-token,--user-output-enabled,--verbosity.Run
$ gcloud helpfor details. - NOTES
-
These variants are also available:
gcloud alpha kms raw-decryptgcloud beta kms raw-decrypt
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-02-06 UTC.