Decrypting Data Encryption Keys

When a user opens an encrypted document, the wrapped key and the encrypted document are downloaded from the Google Workspace server. Google JWT is generated by the Google Workspace CSE library. After the third-party identity provider user authentication is successful, an authentication token (3P JWT) is generated. The user is authenticated using a Google JWT and third-party JWT. KACLS unwraps the wrapped key and returns the DEK. Google Workspace CSE decrypts the document using this DEK.

To decrypt an encrypted Google Docs document:

1. Open the Google Drive console, http://drive.google.com.

2. Log on as a super admin for the user domain.

3. Try to open the encrypted document (created in Encrypting Data Encryption Keys).

4. Sign in with the configured third-party identity provider user credentials.

KACLS’s unwrap API is called internally to decrypt the document for the user. The unwrap requests are logged at KACLS (under Cloud Key Manager > Records), as shown below.

These requests are also visible at KACLS (under Records > Server Records).