GenerateDataKeyPairResponse

This example generates an RSA data key pair for encryption and decryption. The operation returns a plaintext public key and private key, and a copy of the private key that is encrypted under a symmetric encryption KMS key that you specify.

To generate an RSA key pair for encryption and decryption

var client = new AmazonKeyManagementServiceClient();
var response = client.GenerateDataKeyPair(new GenerateDataKeyPairRequest 
{
    KeyId = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", // The key ID of the symmetric encryption KMS key that encrypts the private RSA key in the data key pair.
    KeyPairSpec = "RSA_3072" // The requested key spec of the RSA data key pair.
});

string keyId = response.KeyId; // The key ARN of the symmetric encryption KMS key that was used to encrypt the private key.
string keyPairSpec = response.KeyPairSpec; // The actual key spec of the RSA data key pair.
MemoryStream privateKeyCiphertextBlob = response.PrivateKeyCiphertextBlob; // The encrypted private key of the RSA data key pair.
MemoryStream privateKeyPlaintext = response.PrivateKeyPlaintext; // The plaintext private key of the RSA data key pair.
MemoryStream publicKey = response.PublicKey; // The public key (plaintext) of the RSA data key pair.

            

The following example includes the Recipient parameter with a signed attestation document from an AWS Nitro enclave. Instead of returning a plaintext copy of the private data key, GenerateDataKeyPair returns a copy of the private data key encrypted by the public key from the attestation document (CiphertextForRecipient). It returns the public data key (PublicKey) and a copy of private data key encrypted under the specified KMS key (PrivateKeyCiphertextBlob), as usual, but plaintext private data key field (PrivateKeyPlaintext) is null or empty.

To generate a data key pair for a Nitro enclave

var client = new AmazonKeyManagementServiceClient();
var response = client.GenerateDataKeyPair(new GenerateDataKeyPairRequest 
{
    KeyId = "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", // The key ID of the symmetric encryption KMS key that encrypts the private RSA key in the data key pair.
    KeyPairSpec = "RSA_3072", // The requested key spec of the RSA data key pair.
    Recipient = new RecipientInfo {
        AttestationDocument = new MemoryStream(<attestation document>),
        KeyEncryptionAlgorithm = "RSAES_OAEP_SHA_256"
    } // Specifies the attestation document from the Nitro enclave and the encryption algorithm to use with the public key from the attestation document.
});

MemoryStream ciphertextForRecipient = response.CiphertextForRecipient; // The private key of the RSA data key pair encrypted by the public key from the attestation document
string keyId = response.KeyId; // The key ARN of the symmetric encryption KMS key that was used to encrypt the PrivateKeyCiphertextBlob.
string keyPairSpec = response.KeyPairSpec; // The actual key spec of the RSA data key pair.
MemoryStream privateKeyCiphertextBlob = response.PrivateKeyCiphertextBlob; // The private key of the RSA data key pair encrypted by the KMS key.
MemoryStream privateKeyPlaintext = response.PrivateKeyPlaintext; // This field is null or empty
MemoryStream publicKey = response.PublicKey; // The public key (plaintext) of the RSA data key pair.