Scenario

Encrypt or decrypt data not larger than 4 KB, such as passwords, certificates, and phone numbers, by using a tool on the console or calling an API. This section describes how to call a KMS API and use a CMK to encrypt or decrypt data.

Involved APIs

Procedure

1. Create a CMK.
   • API information

     URI format: POST /v1.0/{project_id}/kms/create-key

     For details, see "Creating a Key".

     

     Default Master Keys are created by services integrated with KMS. Names of Default Master Keys end with /default. Do not end your CMK names with /default.

   • Example request

     POST: https://{endpoint}/v1.0/53d1aefc533f4ce9a59c26b01667cbcf/kms/create-key

     Obtain {endpoint} from Regions and Endpoints.

     Body:

     {
         "key_alias": "test"
     }

   • Example response

     {
         "key_info": {
             "key_id": "bb6a3d22-dc93-47ac-b5bd-88df7ad35f1e",
             "domain_id": "b168fe00ff56492495a7d22974df2d0b"
         }
     }

2. Create a DEK.
   • API information

     URI format: POST /v1.0/{project_id}/kms/create-datakey

     For details, see "Creating a DEK".

   • Example request

     POST https://{endpoint}/v1.0/53d1aefc533f4ce9a59c26b01667cbcf/kms/create-datakey

     Obtain {endpoint} from Regions and Endpoints.

     Body:

     {
         "key_id": "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
         "datakey_length": "512"
     }

   • Example response

     {
         "key_id": "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
         "plain_text": "8151014275E426C72EE7D44267EF11590DCE0089E19863BA8CC832187B156A72A5A17F17B5EF0D525872C59ECEB72948AF85E18427F8BE0D46545C979306C08D",
         "cipher_text": "020098009EEAFCE122CAA5927D2E020086F9548BA1675FDB022E4ECC01B96F2189CF4B85E78357E73E1CEB518DAF7A4960E7C7DE8885ED3FB2F1471ABF400119CC1B20BD3C4A9B80AF590EFD0AEDABFDBB0E2B689DA7B6C9E7D3C5645FCD9274802586BE63779471F9156F2CDF07CD8412FFBE9230643034363662302D653732372D346439632D623335642D6638346262343734613337660000000045B05321483BD9F9561865EE7DFE9BE267A42EB104E98C16589CE46940B18E52"
     }

3. Encrypt data.
   • API information

     URI format: POST /v1.0/{project_id}/kms/encrypt-data

     For details, see Encrypting Data.

   • Example request

     POST https://{endpoint}/v1.0/53d1aefc533f4ce9a59c26b01667cbcf/kms/encrypt-data

     Obtain {endpoint} from Regions and Endpoints.

     Body:

     {
         "key_id": "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
         "plain_text": "12345678"
     }

   • Example response

     {     "key_id": "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
          "cipher_text": "AgDoAG7EsEc2OHpQxz4gDFDH54CqwaelpTdEl+RFPjbKn5klPTvOywYIeZX60kPbFsYOpXJwkL32HUM50MY22Eb1fOSpZK7WJpYjx66EWOkJvO+Ey3r1dLdNAjrZrYzQlxRwNS05CaNKoX5rr3NoDnmv+UNobaiS25muLLiqOt6UrStaWow9AUyOHSzl+BrX2Vu0whv74djK+3COO6cXT2CBO6WajTJsOgYdxMfv24KWSKw0TqvHe8XDKASQGKdgfI74hzI1YWJlNjlmLWFlMTAtNDRjZC1iYzg3LTFiZGExZGUzYjdkNwAAAACdcfNpLXwDUPH3023MvZK8RPHe129k6VdNIi3zNb0eFQ==" 
     }

4. Decrypt data.
   • API information

     URI format: POST /v1.0/{project_id}/kms/decrypt-data

     For details, see Decrypting Data.

   • Example request

     POST https://{endpoint}/v1.0/53d1aefc533f4ce9a59c26b01667cbcf/kms/decrypt-data

     Obtain {endpoint} from Regions and Endpoints.

     Body:

     {      "cipher_text": "AgDoAG7EsEc2OHpQxz4gDFDH54CqwaelpTdEl+RFPjbKn5klPTvOywYIeZX60kPbFsYOpXJwkL32HUM50MY22Eb1fOSpZK7WJpYjx66EWOkJvO+Ey3r1dLdNAjrZrYzQlxRwNS05CaNKoX5rr3NoDnmv+UNobaiS25muLLiqOt6UrStaWow9AUyOHSzl+BrX2Vu0whv74djK+3COO6cXT2CBO6WajTJsOgYdxMfv24KWSKw0TqvHe8XDKASQGKdgfI74hzI1YWJlNjlmLWFlMTAtNDRjZC1iYzg3LTFiZGExZGUzYjdkNwAAAACdcfNpLXwDUPH3023MvZK8RPHe129k6VdNIi3zNb0eFQ=="
      }

   • Example response

     {   
         "key_id": "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
          "plain_text": "12345678"
      }