GenerateDataKeyResponse

The following example generates a 256-bit symmetric data encryption key (data key) in two formats. One is the unencrypted (plainext) data key, and the other is the data key encrypted with the specified KMS key.

To generate a data key

var client = new AmazonKeyManagementServiceClient();
var response = client.GenerateDataKey(new GenerateDataKeyRequest 
{
    KeyId = "alias/ExampleAlias", // The identifier of the KMS key to use to encrypt the data key. You can use the key ID or Amazon Resource Name (ARN) of the KMS key, or the name or ARN of an alias that refers to the KMS key.
    KeySpec = "AES_256" // Specifies the type of data key to return.
});

MemoryStream ciphertextBlob = response.CiphertextBlob; // The encrypted data key.
string keyId = response.KeyId; // The ARN of the KMS key that was used to encrypt the data key.
MemoryStream plaintext = response.Plaintext; // The unencrypted (plaintext) data key.

            

The following example includes the Recipient parameter with a signed attestation document from an AWS Nitro enclave. Instead of returning a copy of the data key encrypted by the KMS key and a plaintext copy of the data key, GenerateDataKey returns one copy of the data key encrypted by the KMS key (CiphertextBlob) and one copy of the data key encrypted by the public key from the attestation document (CiphertextForRecipient). The operation doesn't return a plaintext data key.

To generate a data key pair for a Nitro enclave

var client = new AmazonKeyManagementServiceClient();
var response = client.GenerateDataKey(new GenerateDataKeyRequest 
{
    KeyId = "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", // Identifies the KMS key used to encrypt the encrypted data key (CiphertextBlob)
    KeySpec = "AES_256", // Specifies the type of data key to return
    Recipient = new RecipientInfo {
        AttestationDocument = new MemoryStream(<attestation document>),
        KeyEncryptionAlgorithm = "RSAES_OAEP_SHA_256"
    } // Specifies the attestation document from the Nitro enclave and the encryption algorithm to use with the public key from the attestation document
});

MemoryStream ciphertextBlob = response.CiphertextBlob; // The data key encrypted by the specified KMS key
MemoryStream ciphertextForRecipient = response.CiphertextForRecipient; // The plaintext data key encrypted by the public key from the attestation document
string keyId = response.KeyId; // The KMS key used to encrypt the CiphertextBlob (encrypted data key)
MemoryStream plaintext = response.Plaintext; // This field is null or empty