Decrypt
Updated at:
Decrypts ciphertext into plaintext.
Usage notes
Call this operation after using Encrypt or GenerateDataKey to generate ciphertext. For key specifications and encryption modes, see Key types and specifications.
Request body size limit
All request parameters are encoded using Protocol Buffers. The encoded request body must not exceed 3 MB. If it does, the server returns HTTP 413.
To reduce the risk of network failures and long transmission times, keep data within these limits per operation:
Symmetric keys: 6 KB
Asymmetric keys: 1 KB
If your data exceeds these limits, use envelope encryption instead.
Large payloads increase the risk of network failures, extend transmission time, and slow down KMS processing.
Request parameters
| Parameter | Type | Required | Example | Description |
|---|---|---|---|---|
| KeyId | string | Yes | key-hzz62f1cb66fa42qo**** | The globally unique ID of the key. Accepts an alias bound to the key. |
| Algorithm | string | No | AES_GCM | The decryption algorithm. Must match the algorithm used during encryption. |
| Iv | bytes | No | Binary data | The initialization vector (IV). Required when Algorithm is AES_GCM or AES_CBC. Must match the IV used during encryption. Valid lengths: 16 bytes for AES_CBC, 12 bytes for AES_GCM. |
| CiphertextBlob | bytes | Yes | Binary data | The ciphertext to decrypt. When using the Elliptic Curve Integrated Encryption Scheme (ECIES) algorithm, the ciphertext format must conform to SEC 1: Elliptic Curve Cryptography, Version 2.0 standards. |
| Aad | bytes | No | Binary data | The authentication data. Up to 8,192 bytes. Required when Algorithm is AES_GCM or SM4_GCM and AAD was specified during encryption. Must match the AAD value used during encryption. |
| PaddingMode | string | No | PKCS7_PADDING | The padding mode. Required when Algorithm is AES_CBC or AES_ECB. Must match the padding mode used during encryption. Valid values: PKCS7_PADDING (default), NO_PADDING. |
PaddingMode values
| Value | Description |
|---|---|
PKCS7_PADDING | PKCS#7 padding. The plaintext length does not need to be a multiple of the cipher block size. If the input is L bytes, the system appends K-(L mod K) bytes of padding, where K is the block size. |
NO_PADDING | No padding. The plaintext length must be an integer multiple of the cipher block size. |
Response parameters
| Parameter | Type | Example | Description |
|---|---|---|---|
| Plaintext | bytes | Binary data | The decrypted plaintext. |
| KeyId | string | key-hzz62f1cb66fa42qo**** | The globally unique ID of the key. If you specified an alias, returns the ID of the key the alias is bound to. |
| Algorithm | string | AES_GCM | The decryption algorithm. |
| PaddingMode | string | PKCS7_PADDING | The padding mode. |
| RequestId | string | 475f1620-b9d3-4d35-b5c6-3fbdd941423d | The request ID. Use this to locate and troubleshoot issues. |
Error codes
| HTTP status code | Error code | Error message | Description |
|---|---|---|---|
| 500 | InternalFailure | Internal Failure. | Possible causes: (1) The ciphertext does not meet algorithm requirements — for example, during RSA decryption (RSAES_OAEP_SHA_256), the digest algorithm SHA-1 is used when a public key is used to encrypt plaintext, or the AES_ECB ciphertext length not being a multiple of 16 bytes. (2) The key specified in the request was not used for encryption. If neither cause applies, . |
For all error codes, see Service error codes.
Is this page helpful?