Full name: projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.rawEncrypt
Encrypts data using portable cryptographic primitives. Most users should choose cryptoKeys.encrypt
and cryptoKeys.decrypt
rather than their raw counterparts. The CryptoKey.purpose
must be RAW_ENCRYPT_DECRYPT
.
HTTP request
The URLs use gRPC Transcoding syntax.
Path parameters
name
string
Required. The resource name of the CryptoKeyVersion
to use for encryption.
Authorization requires the following IAM
permission on the specified resource name
:
-
cloudkms.cryptoKeyVersions.useToEncrypt
Request body
The request body contains data with the following structure:
JSON representation |
---|
{ "plaintext" : string , "additionalAuthenticatedData" : string , "plaintextCrc32c" : string , "additionalAuthenticatedDataCrc32c" : string , "initializationVector" : string , "initializationVectorCrc32c" : string } |
Fields | |
---|---|
plaintext
|
Required. The data to encrypt. Must be no larger than 64KiB. The maximum size depends on the key version's A base64-encoded string. |
additionalAuthenticatedData
|
Optional. Optional data that, if specified, must also be provided during decryption through This field may only be used in conjunction with an The maximum size depends on the key version's A base64-encoded string. |
plaintextCrc32c
|
Optional. An optional CRC32C checksum of the |
additionalAuthenticatedDataCrc32c
|
Optional. An optional CRC32C checksum of the |
initializationVector
|
Optional. A customer-supplied initialization vector that will be used for encryption. If it is not provided for AES-CBC and AES-CTR, one will be generated. It will be returned in A base64-encoded string. |
initializationVectorCrc32c
|
Optional. An optional CRC32C checksum of the |
Response body
Response message for KeyManagementService.RawEncrypt
.
If successful, the response body contains data with the following structure:
JSON representation |
---|
{
"ciphertext"
:
string
,
"initializationVector"
:
string
,
"tagLength"
:
integer
,
"ciphertextCrc32c"
:
string
,
"initializationVectorCrc32c"
:
string
,
"verifiedPlaintextCrc32c"
:
boolean
,
"verifiedAdditionalAuthenticatedDataCrc32c"
:
boolean
,
"verifiedInitializationVectorCrc32c"
:
boolean
,
"name"
:
string
,
"protectionLevel"
:
enum (
|
Fields | |
---|---|
ciphertext
|
The encrypted data. In the case of AES-GCM, the authentication tag is the A base64-encoded string. |
initializationVector
|
The initialization vector (IV) generated by the service during encryption. This value must be stored and provided in A base64-encoded string. |
tagLength
|
The length of the authentication tag that is appended to the end of the ciphertext. |
ciphertextCrc32c
|
Integrity verification field. A CRC32C checksum of the returned |
initializationVectorCrc32c
|
Integrity verification field. A CRC32C checksum of the returned |
verifiedPlaintextCrc32c
|
Integrity verification field. A flag indicating whether |
verifiedAdditionalAuthenticatedDataCrc32c
|
Integrity verification field. A flag indicating whether |
verifiedInitializationVectorCrc32c
|
Integrity verification field. A flag indicating whether |
name
|
The resource name of the |
protectionLevel
|
The |
Authorization scopes
Requires one of the following OAuth scopes:
-
https://www.googleapis.com/auth/cloudkms
-
https://www.googleapis.com/auth/cloud-platform
For more information, see the Authentication Overview .