Encrypting the Data using a Symmetric Key
The post v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt API encrypts a plaintext data using an encryption key stored in a keystore on CipherTrust Data Security Platform Service. The key specified in the key_id path variable MUST be a symmetric key with ENCRYPT and DECRYPT attributes.
The API encrypts the plaintext data using the AES-GCM algorithm. The additional authenticated data (AAD) and key version ID are optional fields. If a specific key version ID is not provided, the latest version of the key is used to encrypt the plaintext data. The output is a JSON blob that can be passed to the symmetric decrypt API.
Note
This API does not accept an external IV, and it is generated by CipherTrust Data Security Platform Service.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| plaintext | string | A byte array of data to be encrypted. JSON encodes byte arrays to base64 strings. Therefore, the string in the JSON object should be a valid base64 string. |
| aad (optional) | string | A byte array of data to be authenticated. It should be a valid base64 string. |
| sap_tenant_id | string | ID of the SAP Tenant. |
| sap_group_id (optional) | string | ID of the SAP Group . |
| sap_user_type (optional) | string | Type of the SAP user. |
| sap_request_id (optional) | string | Request ID of the call made to SAP DC KMS to correlate SAP audit record with Thales CipherTrust Data Security Platform Service server audit record. |
Example Request
post https://<Host IP Address>/api/v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt
<authorization token and other headers>
{
"plaintext": "dGVzdGluZw==",
"aad": "a2FqYWw=",
"request_metadata": {
"sap_tenant_id": "5e3d1d87-9502-42af-a946-3ffec9e71a44",
"sap_group_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487",
"sap_user_type": "USER_DEV",
"sap_request_id": "86428acc-a1c8-6de1-b8f7-8de9a436gdr3"
}
}
Example Response
{
"ciphertext": "QE84BatkGw==",
"iv": "h0R8plP4nAcGgs9B",
"tag": "niKrwAK4LNOKmG++I/Nbaw==",
"aad": "a2FqYWw=",
"key_version_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487"
}
Response Codes
| Response Code | Description |
|---|---|
| 200 | Ok |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Not found |
| 403 | Forbidden |
| 500 | Internal server error |
Refer to HTTP status codes for details.
