Encrypting the Data using a Symmetric Key
The post v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt API encrypts a plaintext data using an encryption key stored in a keystore on CipherTrust Manager. The key specified in the key_id path variable MUST be a symmetric key with ENCRYPT and DECRYPT attributes.
The API encrypts the plaintext data using the AES-GCM algorithm. The additional authenticated data (AAD) and key version ID are optional fields. If a specific key version ID is not provided, the latest version of the key is used to encrypt the plaintext data. The output is a JSON blob that can be passed to the symmetric decrypt API.
Note
This API does not accept an external IV, and it is generated by CipherTrust Manager.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| plaintext | string | A byte array of data to be encrypted. JSON encodes byte arrays to base64 strings. Therefore, the string in the JSON object should be a valid base64 string. |
| aad (optional) | string | A byte array of data to be authenticated. It should be a valid base64 string. |
| sap_tenant_id | string | ID of the SAP Tenant. |
| sap_group_id (optional) | string | ID of the SAP Group . |
| sap_user_type (optional) | string | Type of the SAP user. |
| sap_request_id (optional) | string | Request ID of the call made to SAP DC KMS to correlate SAP audit record with Thales CM audit record. |
Example Request
post https://<Host IP Address>/api/v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt
<authorization token and other headers>
{
"plaintext": "dGVzdGluZw==",
"aad": "a2FqYWw=",
"request_metadata": {
"sap_tenant_id": "5e3d1d87-9502-42af-a946-3ffec9e71a44",
"sap_group_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487",
"sap_user_type": "USER_DEV",
"sap_request_id": "86428acc-a1c8-6de1-b8f7-8de9a436gdr3"
}
}
Example Response
{
"ciphertext": "QE84BatkGw==",
"iv": "h0R8plP4nAcGgs9B",
"tag": "niKrwAK4LNOKmG++I/Nbaw==",
"aad": "a2FqYWw=",
"key_version_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487"
}
Response Codes
| Response Code | Description |
|---|---|
| 200 | Ok |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Not found |
| 403 | Forbidden |
| 500 | Internal server error |
Refer to HTTP status codes for details.
