GenerateDataKeyPairWithoutPlaintextResponse

This example returns an asymmetric elliptic curve (ECC) data key pair. The private key is encrypted under the symmetric encryption KMS key that you specify. This operation doesn't return a plaintext (unencrypted) private key.

To generate an asymmetric data key pair without a plaintext key

var client = new AmazonKeyManagementServiceClient();
var response = client.GenerateDataKeyPairWithoutPlaintext(new GenerateDataKeyPairWithoutPlaintextRequest 
{
    KeyId = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", // The symmetric encryption KMS key that encrypts the private key of the ECC data key pair.
    KeyPairSpec = "ECC_NIST_P521" // The requested key spec of the ECC asymmetric data key pair.
});

string keyId = response.KeyId; // The key ARN of the symmetric encryption KMS key that encrypted the private key in the ECC asymmetric data key pair.
string keyPairSpec = response.KeyPairSpec; // The actual key spec of the ECC asymmetric data key pair.
MemoryStream privateKeyCiphertextBlob = response.PrivateKeyCiphertextBlob; // The encrypted private key of the asymmetric ECC data key pair.
MemoryStream publicKey = response.PublicKey; // The public key (plaintext).