Re-encryption

Function

This API is used to decrypt the ciphertext using the source key and then encrypt the ciphertext using the specified new key.

The DEK ciphertext encrypted by CreateDatakey, ** CreateDatakeyWithoutPlainText**, or EncryptDatakey can be re-encrypted into a new DEK ciphertext.

The ciphertext encrypted by EncryptData can be re-encrypted into a new ciphertext.

Note:

A DEK can only be re-encrypted into a DEK.

Calling Method

For details, see Calling APIs.

URI

POST /v1.0/{project_id}/kms/re-encrypt

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details, see Obtaining a Project ID. Constraints N/A Range The value returned by the IAM API is used, which contains 32 characters. Default Value N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API. The value of X-Subject-Token in the response header is the user token. Constraints N/A Range Obtain the value by calling the IAM API for obtaining the user token. Default Value N/A

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
source_key_id	No	String	Definition ID of the original key, which is used to decrypt the ciphertext. For asymmetric key encryption, source_key_id is mandatory. For symmetric key encryption, you are advised to set source_key_id. KMS uses the specified source_key_id for decryption. If this parameter is left blank, KMS attempts to obtain the key ID used for encryption from the ciphertext, and then use the key ID for decryption. Constraints N/A Range N/A Default Value N/A
source_additional_authenticated_data	No	String	Definition Additional information used during the encryption of the original ciphertext. If no AAD is specified during encryption, this parameter cannot be set. Otherwise, decryption fails. Constraints N/A Range N/A Default Value N/A
source_encryption_algorithm	No	String	Definition Encryption algorithm used during the encryption of the original ciphertext. Constraints Note: RSAES_OAEP_SHA_1 is no longer secure. Exercise caution. Range SYMMETRIC_DEFAULT RSAES_OAEP_SHA_1 RSAES_OAEP_SHA_256 SM2_ENCRYPT Default Value SYMMETRIC_DEFAULT
destination_key_id	Yes	String	Definition ID of the target key, which is used to encrypt the decrypted plaintext. Constraints The value must be a 36-byte ID. The value must match the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. Range N/A Default Value N/A
destination_additional_authenticated_data	No	String	Definition If a value is specified, the value is used as AAD during re-encryption. Constraints N/A Range N/A Default Value N/A
destination_encryption_algorithm	No	String	Definition Encryption algorithm used during re-encryption of the new ciphertext Constraints Note: RSAES_OAEP_SHA_1 is no longer secure. Exercise caution. Range SYMMETRIC_DEFAULT RSAES_OAEP_SHA_1 RSAES_OAEP_SHA_256 SM2_ENCRYPT Default Value SYMMETRIC_DEFAULT
datakey_cipher_length	No	String	Definition If the ciphertext is a DEK encrypted in CBC mode, datakey_cipher_length must be specified. This parameter indicates the number of bytes in the plaintext key material. Constraints N/A Range N/A Default Value N/A
cipher_text	Yes	String	Definition Ciphertext to be re-encrypted Constraints N/A Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
key_id	String	Definition Key ID used during the re-encryption Range N/A
source_key_id	String	Definition Key ID used during the encryption of the original ciphertext Range N/A
source_encryption_algorithm	String	Definition Encryption algorithm used during the encryption of the original ciphertext Range N/A
destination_encryption_algorithm	String	Definition Encryption algorithm used during the re-encryption Range N/A
cipher_text	String	Definition Ciphertext after re-encryption Range N/A

Example Requests

https://kms.cn-north-4.myhuaweicloud.com/v1.0/d4e559b49b3b403da5279723299ed4a6/kms/re-encrypt

{
  "source_key_id" : "054faae3-ffc2-4b23-8d94-c05bfc8f596a",
  "source_additional_authenticated_data" : "",
  "source_encryption_algorithm" : "SYMMETRIC_DEFAULT",
  "destination_key_id" : "8ad47b5b-037e-4ff9-bf04-6900e3213c17",
  "destination_additional_authenticated_data" : "123",
  "destination_encryption_algorithm" : "SYMMETRIC_DEFAULT",
  "datakey_cipher_length" : "32",
  "cipher_text" : "020078000871efb21bfdc0712becf0dabfcc115a25eae06efb652aa9afa9689a4c4ec46b4bbeb3a902369b1a53eab67e9b8e730ced3879d1fb62c27cc314f2a44943687741a5d250403c861e4410936d422ef2d330353466616165332d666663322d346232332d386439342d63303562666338663539366100000000ed7fb70234ac273dedc19752900c6f7e4577fc2c1f1482539d0142ab0ff9fdda"
}