Decrypts ciphertext into plaintext.-Key Management Service(KMS)-阿里云帮助中心

Calls the Decrypt operation to decrypt ciphertext into plaintext.

Operation description

After you call the Encrypt or GenerateDataKey operation to generate ciphertext, you can use Decrypt to decrypt the ciphertext.

For more information about key specifications and encryption modes, see Key management types and key specifications.

Usage notes

All request parameters are encoded with Protocol Buffers. The resulting request body cannot exceed 3 MB. If the data volume exceeds 3 MB, the server rejects the request and returns HTTP status code 413.

For a single encrypt or decrypt call, keep the data within the following limits:

Key type	Recommended maximum data volume
Symmetric key	6 KB
Asymmetric key	1 KB

If your data exceeds these limits, use envelope encryption instead. For more information, see Envelope encryption.

Note

The larger the data volume in a single call, the higher the risk of network transmission failure, the longer the transmission takes, and the longer the KMS instance needs to complete data encryption or decryption.

Request parameters

Name	Type	Required	Example	Description
KeyId	string	Yes	key-hzz62f1cb66fa42qo****	The globally unique identifier of the key. You can also specify a key alias for this parameter.
Algorithm	string	No	AES_GCM	The decryption algorithm. Important The value must be the same as the algorithm used for encryption.
Iv	bytes	No	Binary data	The initialization vector. This parameter is required only if the decryption algorithm (Algorithm parameter) is AES_GCM, AES_CBC, or SM4_GCM. If the decryption algorithm (Algorithm) is AES_CBC, the Iv length is 16 bytes. If the decryption algorithm (Algorithm) is AES_GCM or SM4_GCM, the Iv length is 12 bytes. Important The value must be the same as the initialization vector used for encryption.
CiphertextBlob	bytes	Yes	Binary data	The ciphertext to decrypt. Note If the ECIES algorithm is used, the ciphertext format follows the SEC 1: Elliptic Curve Cryptography, Version 2.0 standard.
Aad	bytes	No	Binary data	The additional authenticated data. The length cannot exceed 8,192 bytes. This parameter is required only if the decryption algorithm (Algorithm) is AES_GCM or SM4_GCM and the additional authenticated data (Aad) is specified during encryption. Important The value must be the same as the additional authenticated data used for encryption.
PaddingMode	string	No	PKCS7_PADDING	The padding mode. This parameter is required only if the encryption algorithm is AES_CBC or AES_ECB. Important The value must be the same as the padding mode used for encryption. Valid values: PKCS7_PADDING (default): PKCS#7 padding. The plaintext length does not need to be a multiple of the block size (K bytes) of the block cipher algorithm. If the input plaintext length is L bytes, the system pads K - (L mod K) bytes, and the value of each padded byte is K - (L mod K). NO_PADDING: No padding is applied to the plaintext. The plaintext length must be an integer multiple of the block size of the block cipher algorithm.

Response data

Name	Type	Example	Description
Plaintext	bytes	Binary data	The decrypted plaintext.
KeyId	string	key-hzz62f1cb66fa42qo****	The globally unique identifier of the key. If a key alias is used as the KeyId parameter in the request, the globally unique identifier of the key that corresponds to the alias is returned in the response.
Algorithm	string	AES_GCM	The decryption algorithm.
PaddingMode	string	PKCS7_PADDING	The padding mode.
RequestId	string	475f1620-b9d3-4d35-b5c6-3fbdd941423d	The ID of the request. Alibaba Cloud generates a unique ID for each request. You can use the request ID to troubleshoot issues.

Error codes

HTTP status code

Error code

Error message

Description

500

InternalFailure

Internal Failure.

Possible causes:

The ciphertext data does not meet the requirements.
For example, when you use RSA decryption (RSAES_OAEP_SHA_256), the digest algorithm used when the public key encrypts the plaintext is SHA-1, or the ciphertext data length is not a multiple of 16 bytes (the AES algorithm block size) when you use AES_ECB decryption.
The key specified in the request parameters is not the key used for encryption.

If the preceding causes are ruled out, contact technical support.

For more information about error codes, see Common error codes.