Decrypting the Data using a Symmetric Key

The post /v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-decrypt API decrypts a ciphertext payload using an encryption key stored in a keystore on CipherTrust Manager. The key specified in the key_id path variable MUST be a symmetric key with ENCRYPT and DECRYPT attributes.

The API decrypts the ciphertext payload using the AES-GCM algorithm. The specified additional authenticated data (AAD), IV, authentication tag, and key version ID must be the same as returned when encrypting the plaintext data, otherwise, the decrypt operation fails.

Request Parameters

Parameter	Type	Description
ciphertext	string	A byte array that appears as a base64 encoded string in the JSON blob.
iv	string	A byte array is used with CBC and GCM cryptographic algorithm modes. The IV appears as a base64 encoded string in the JSON blob. It is recommended to omit this field to let the server generate and return a secure IV using its random number generator. Otherwise, follow the security guidelines in "NIST SP800-38A" and "NIST SP800-38D" publications to ensure your IV construction is secure.
aad (optional)	string	A byte array of data to be authenticated. It should be a valid base64 string.
tag	string	A byte array that appears as a base64 encoded string in the JSON blob.
sap_tenant_id	string	ID of the SAP Tenant.
sap_group_id (optional)	string	ID of the SAP Group .
sap_user_type (optional)	string	Type of the SAP user.
sap_request_id (optional)	string	Request ID of the call made to SAP DC KMS to correlate SAP audit record with Thales CM audit record.

Example Request

post https://<Host IP Address>/api/v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt
<authorization token and other headers>
{
    "ciphertext": "QE84BatkGw==",
    "iv": "h0R8plP4nAcGgs9B",
    "aad": "a2FqYWw=",
    "tag": "niKrwAK4LNOKmG++I/Nbaw==",
    "request_metadata": {
        "sap_tenant_id": "5e3d1d87-9502-42af-a946-3ffec9e71a44",
        "sap_group_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487",
        "sap_user_type": "USER_DEV",
        "sap_request_id": "86428acc-a1c8-6de1-b8f7-8de9a436gdr3"
    }
}

Example Response

{
    "plaintext": "dGVzdGluZw=="
}

Response Codes

Response Code	Description
200	Ok
400	Bad request
401	Unauthorized
404	Not found
403	Forbidden
500	Internal server error

Refer to HTTP status codes for details.

Decrypting the Data using a Symmetric Key

Request Parameters

Example Request

Example Response

Response Codes

On this page

Suggest A Change