All Products
Search

This Product

    Key Management Service:AsymmetricEncrypt

    Document Center

    Key Management Service:AsymmetricEncrypt

    Last Updated:Mar 08, 2024

    Encrypts data by using an asymmetric key.

    Usage notes

    • Keys outside Key Management Service (KMS) instances: To perform cryptographic operations, use Alibaba Cloud SDK to call operations.
    • Keys in KMS instances: To perform cryptographic operations, use one of the following methods:

    QPS limits

    You can call this operation up to 200 times per second per account. If the number of the calls per second exceeds the limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limit when you call this operation.

    Description

    This operation is supported only for asymmetric keys for which Usage is set to ENCRYPT/DECRYPT. The following table lists the supported encryption algorithms:

    KeySpec

    Algorithm

    Description

    Maximum number of bytes that can be encrypted

    RSA_2048

    RSAES_OAEP_SHA_256

    RSAES-OAEP using SHA-256 and MGF1 with SHA-256

    190

    RSA_2048

    RSAES_OAEP_SHA_1

    RSAES-OAEP using SHA1 and MGF1 with SHA1

    214

    RSA_3072

    RSAES_OAEP_SHA_256

    RSAES-OAEP using SHA-256 and MGF1 with SHA-256

    318

    RSA_3072

    RSAES_OAEP_SHA_1

    RSAES-OAEP using SHA1 and MGF1 with SHA1

    342

    EC_SM2

    SM2PKE

    SM2 public key encryption algorithm based on elliptic curves

    6047

    You can use the asymmetric key whose ID is 5c438b18-05be-40ad-b6c2-3be6752c**** and version ID is 2ab1a983-7072-4bbc-a582-584b5bd8**** and the RSAES_OAEP_SHA_1 algorithm to encrypt the SGVsbG8gd29ybGQ= plaintext based on the parameter settings provided in this topic.

    Debugging

    OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

    Request parameters

    Parameter

    Type

    Required

    Example

    Description
    Action String Yes AsymmetricEncrypt

    The operation that you want to perform. Set the value to AsymmetricEncrypt.

    Plaintext String Yes SGVsbG8gd29ybGQ=

    The plaintext. The plaintext must be Base64-encoded.

    KeyId String Yes 5c438b18-05be-40ad-b6c2-3be6752c****

    The ID of the key. The ID must be globally unique.

    Note You can also set this parameter to an alias that is bound to the key. For more information, see Overview of aliases.
    KeyVersionId String Yes 2ab1a983-7072-4bbc-a582-584b5bd8****

    The version ID of the key. The ID must be globally unique.

    Note You can call the ListKeyVersions operation to query the versions of a key. The ID of a version is specified by KeyVersionId.
    Algorithm String Yes RSAES_OAEP_SHA_1

    The encryption algorithm.

    Response parameters

    Parameter

    Type

    Example

    Description
    KeyVersionId String 2ab1a983-7072-4bbc-a582-584b5bd8****

    The version ID of the key that is used to encrypt the plaintext.

    KeyId String 5c438b18-05be-40ad-b6c2-3be6752c****

    The ID of the key. The ID must be globally unique.

    Note If you set KeyId in the request to an alias, the ID of the key to which the alias is bound is returned.
    CiphertextBlob String BQKP+1zK6+ZEMxTP5qaVzcsgXtWplYBKm0NXdSnB5FzliFxE1bSiu4dnEIlca2JpeH7yz1/S6fed630H+hIH6DoM25fTLNcKj+mFB0Xnh9m2+HN59Mn4qyTfcUeadnfCXSWcGBouhXFwcdd2rJ3n337bzTf4jm659gZu3L0i6PLuxM9p7mqdwO0cKJPfGVfhnfMz+f4alMg79WB/NNyE2lyX7/qxvV49ObNrrJbKSFiz8Djocaf0IESNLMbfYI5bXjWkJlX92DQbKhibtQW8ZOJ//ZC6t0AWcUoKL6QDm/dg5koQalcleRinpB+QadFm894sLbVZ9+N4GVsv1Wbjwg==

    The Base64-encoded ciphertext.

    RequestId String 475f1620-b9d3-4d35-b5c6-3fbdd941423d

    The ID of the request, which is used to locate and troubleshoot issues.

    Examples

    Sample requests

    http(s)://[Endpoint]/?Action=AsymmetricEncrypt
&Plaintext=SGVsbG8gd29ybGQ=
&KeyId=5c438b18-05be-40ad-b6c2-3be6752c****
&KeyVersionId=2ab1a983-7072-4bbc-a582-584b5bd8****
&Algorithm=RSAES_OAEP_SHA_1
&Common request parameters

    Sample success responses

    XML format

    HTTP/1.1 200 OK
Content-Type:application/xml

<AsymmetricEncryptResponse>
    <KeyVersionId>2ab1a983-7072-4bbc-a582-584b5bd8****</KeyVersionId>
    <KeyId>5c438b18-05be-40ad-b6c2-3be6752c****</KeyId>
    <CiphertextBlob>BQKP+1zK6+ZEMxTP5qaVzcsgXtWplYBKm0NXdSnB5FzliFxE1bSiu4dnEIlca2JpeH7yz1/S6fed630H+hIH6DoM25fTLNcKj+mFB0Xnh9m2+HN59Mn4qyTfcUeadnfCXSWcGBouhXFwcdd2rJ3n337bzTf4jm659gZu3L0i6PLuxM9p7mqdwO0cKJPfGVfhnfMz+f4alMg79WB/NNyE2lyX7/qxvV49ObNrrJbKSFiz8Djocaf0IESNLMbfYI5bXjWkJlX92DQbKhibtQW8ZOJ//ZC6t0AWcUoKL6QDm/dg5koQalcleRinpB+QadFm894sLbVZ9+N4GVsv1Wbjwg==</CiphertextBlob>
    <RequestId>475f1620-b9d3-4d35-b5c6-3fbdd941423d</RequestId>
</AsymmetricEncryptResponse>

    JSON format

    HTTP/1.1 200 OK
Content-Type:application/json

{
  "KeyVersionId" : "2ab1a983-7072-4bbc-a582-584b5bd8****",
  "KeyId" : "5c438b18-05be-40ad-b6c2-3be6752c****",
  "CiphertextBlob" : "BQKP+1zK6+ZEMxTP5qaVzcsgXtWplYBKm0NXdSnB5FzliFxE1bSiu4dnEIlca2JpeH7yz1/S6fed630H+hIH6DoM25fTLNcKj+mFB0Xnh9m2+HN59Mn4qyTfcUeadnfCXSWcGBouhXFwcdd2rJ3n337bzTf4jm659gZu3L0i6PLuxM9p7mqdwO0cKJPfGVfhnfMz+f4alMg79WB/NNyE2lyX7/qxvV49ObNrrJbKSFiz8Djocaf0IESNLMbfYI5bXjWkJlX92DQbKhibtQW8ZOJ//ZC6t0AWcUoKL6QDm/dg5koQalcleRinpB+QadFm894sLbVZ9+N4GVsv1Wbjwg==",
  "RequestId" : "475f1620-b9d3-4d35-b5c6-3fbdd941423d"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 Rejected.UnsupportedOperation Unsupported operation. The operation is not supported.
    404 Forbidden.AliasNotFound The specified Alias is not found. The specified alias is not found.
    404 Forbidden.KeyNotFound The specified Key is not found. The specified key does not exist.

    For a list of error codes, see Service error codes.