Menu
AWS Key Management Service
Developer Guide

Encrypting and Decrypting Data Keys

This topic shows how to use the Encrypt, Decrypt, and ReEncrypt operations in the AWS KMS API.

These operations are designed to encrypt and decrypt data keys. They use an AWS KMS customer master key (CMK) in the encryption operations and they cannot accept more than 4 KB (4096 bytes) of data. Although you might use them to encrypt small amounts of data, such as a password or RSA key, they are not designed to encrypt application data.

To encrypt application data, use the server-side encryption features of an AWS service, or a client-side encryption library, such as the AWS Encryption SDK or the Amazon S3 encryption client.

Encrypting a Data Key

The Encrypt operation is designed to encrypt data keys, but it is not frequently used. The GenerateDataKey and GenerateDataKeyWithoutPlaintext operations return encrypted data keys. You might use this method when you are moving encrypted data to a new region and want to encrypt its data key with a CMK in the new region.

For details about the Java implementation of the Encrypt operation, see the encrypt method in the AWS SDK for Java API Reference.

Copy
// Encrypt a data key // // Replace the fictitious keyID value with a valid key ID, key ARN, or alias of an AWS CMK. String keyId = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"; ByteBuffer plaintext = ByteBuffer.wrap(new byte[]{1,2,3,4,5,6,7,8,9,0}); EncryptRequest req = new EncryptRequest().withKeyId(keyId).withPlaintext(plaintext); ByteBuffer ciphertext = kms.encrypt(req).getCiphertextBlob();

Decrypting a Data Key

To decrypt a data key, use the Decrypt operation. For details about the Java implementation, see the decrypt method in the AWS SDK for Java API Reference.

The ciphertextBlob must be a byte buffer that was returned by the GenerateDataKey, GenerateDataKeyWithoutPlaintext, or Encrypt operations.

Copy
// Decrypt a data key // ByteBuffer ciphertextBlob = Place your ciphertext here; DecryptRequest req = new DecryptRequest().withCiphertextBlob(ciphertextBlob); ByteBuffer plainText = kms.decrypt(req).getPlaintext();

Re-Encrypting a Data Key Under a Different Customer Master Key

To decrypt an encrypted data key, and then immediately re-encrypt the data key under a different customer master key (CMK), use the ReEncrypt operation. The operations are performed entirely on the server side within AWS KMS, so they never expose your plaintext outside of AWS KMS.

The ciphertextBlob must be a byte buffer that was returned by the GenerateDataKey, GenerateDataKeyWithoutPlaintext, or Encrypt operations.

For details about the Java implementation, see the reEncrypt method in the AWS SDK for Java API Reference.

Copy
// Re-encrypt a data key ByteBuffer sourceCiphertextBlob = Place your ciphertext here; // Replace the fictitious keyID value with a valid key ID, key ARN, or alias of an AWS CMK. String destinationKeyId = "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"; ReEncryptRequest req = new ReEncryptRequest(); req.setCiphertextBlob(sourceCiphertextBlob); req.setDestinationKeyId(destinationKeyId); ByteBuffer destinationCipherTextBlob = kms.reEncrypt(req).getCiphertextBlob();