AsymmetricDecrypt - Key Management Service - Alibaba Cloud Documentation Center

Usage notes

Keys outside Key Management Service (KMS) instances: To perform cryptographic operations, use Alibaba Cloud SDK to call operations.
Keys in KMS instances: To perform cryptographic operations, use one of the following methods:
- Method 1 (recommended): Use KMS Instance SDK to call KMS Instance API operations. For more information, see KMS Instance SDK and KMS Instance API.
- Method 2: Use Alibaba Cloud SDK to call operations. The authentication method supports only RAM roles whose trusted entities are Alibaba Cloud services. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

QPS limits

You can call this operation up to 200 times per second per account. If the number of the calls per second exceeds the limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limit when you call this operation.

Description

This operation supports only asymmetric keys for which Usage is set to ENCRYPT/DECRYPT. The following table lists supported encryption algorithms.

KeySpec	Algorithm	Description	Maximum length in bytes
RSA_2048	RSAES_OAEP_SHA_256	RSAES-OAEP using SHA-256 and MGF1 with SHA-256	256
RSA_2048	RSAES_OAEP_SHA_1	RSAES-OAEP using SHA1 and MGF1 with SHA1	256
RSA_3072	RSAES_OAEP_SHA_256	RSAES-OAEP using SHA-256 and MGF1 with SHA-256	384
RSA_3072	RSAES_OAEP_SHA_1	RSAES-OAEP using SHA1 and MGF1 with SHA1	384
EC_SM2	SM2PKE	SM2 public key encryption algorithm based on elliptic curves	6144

In this example, an asymmetric key whose ID is 5c438b18-05be-40ad-b6c2-3be6752c**** and whose version ID is 2ab1a983-7072-4bbc-a582-584b5bd8**** and the RSAES_OAEP_SHA_1 decryption algorithm are used to decrypt the BQKP+1zK6+ZEMxTP5qaVzcsgXtWplYBKm0NXdSnB5FzliFxE1bSiu4dnEIlca2JpeH7yz1/S6fed630H+hIH6DoM25fTLNcKj+mFB0Xnh9m2+HN59Mn4qyTfcUeadnfCXSWcGBouhXFwcdd2rJ3n337bzTf4jm659gZu3L0i6PLuxM9p7mqdwO0cKJPfGVfhnfMz+f4alMg79WB/NNyE2lyX7/qxvV49ObNrrJbKSFiz8Djocaf0IESNLMbfYI5bXjWkJlX92DQbKhibtQW8ZOJ//ZC6t0AWcUoKL6QDm/dg5koQalcleRinpB+QadFm894sLbVZ9+N4GVsv1W****== ciphertext.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters

Parameter	Type	Required	Example	Description
Action	String	Yes	AsymmetricDecrypt	The operation that you want to perform. Set the value to AsymmetricDecrypt.
CiphertextBlob	String	Yes	BQKP+1zK6+ZEMxTP5qaVzcsgXtWplYBKm0NXdSnB5FzliFxE1bSiu4dnEIlca2JpeH7yz1/S6fed630H+hIH6DoM25fTLNcKj+mFB0Xnh9m2+HN59Mn4qyTfcUeadnfCXSWcGBouhXFwcdd2rJ3n337bzTf4jm659gZu3L0i6PLuxM9p7mqdwO0cKJPfGVfhnfMz+f4alMg79WB/NNyE2lyX7/qxvV49ObNrrJbKSFiz8Djocaf0IESNLMbfYI5bXjWkJlX92DQbKhibtQW8ZOJ//ZC6t0AWcUoKL6QDm/dg5koQalcleRinpB+QadFm894sLbVZ9+N4GVsv1W****==	The ciphertext. Note The value must be encoded in Base64. Note You can call the AsymmetricEncrypt operation to generate ciphertext.
KeyId	String	Yes	5c438b18-05be-40ad-b6c2-3be6752c****	The ID of the key. The ID must be globally unique. Note You can also set this parameter to an alias that is bound to the key. For more information, see Alias overview.
KeyVersionId	String	Yes	2ab1a983-7072-4bbc-a582-584b5bd8****	The version ID of the key. The ID must be globally unique.
Algorithm	String	Yes	RSAES_OAEP_SHA_1	The decryption algorithm.

Response parameters

Parameter	Type	Example	Description
KeyVersionId	String	2ab1a983-7072-4bbc-a582-584b5bd8****	The version ID of the key that is used to encrypt the plaintext.
KeyId	String	5c438b18-05be-40ad-b6c2-3be6752c****	The ID of the key. The ID must be globally unique. Note If you set KeyId in the request to an alias, the ID of the key to which the alias is bound is returned.
RequestId	String	475f1620-b9d3-4d35-b5c6-3fbdd941423d	The ID of the request, which is used to locate and troubleshoot issues.
Plaintext	String	SGVsbG8gd29ybGQ=	The Base64-encoded plaintext.

Examples

Sample requests

http(s)://[Endpoint]/?Action=AsymmetricDecrypt
&CiphertextBlob=BQKP+1zK6+ZEMxTP5qaVzcsgXtWplYBKm0NXdSnB5FzliFxE1bSiu4dnEIlca2JpeH7yz1/S6fed630H+hIH6DoM25fTLNcKj+mFB0Xnh9m2+HN59Mn4qyTfcUeadnfCXSWcGBouhXFwcdd2rJ3n337bzTf4jm659gZu3L0i6PLuxM9p7mqdwO0cKJPfGVfhnfMz+f4alMg79WB/NNyE2lyX7/qxvV49ObNrrJbKSFiz8Djocaf0IESNLMbfYI5bXjWkJlX92DQbKhibtQW8ZOJ//ZC6t0AWcUoKL6QDm/dg5koQalcleRinpB+QadFm894sLbVZ9+N4GVsv1W****==
&KeyId=5c438b18-05be-40ad-b6c2-3be6752c****
&KeyVersionId=2ab1a983-7072-4bbc-a582-584b5bd8****
&Algorithm=RSAES_OAEP_SHA_1
&Common request parameters

Sample success responses

XML format

HTTP/1.1 200 OK
Content-Type:application/xml

<AsymmetricDecryptResponse>
    <KeyVersionId>2ab1a983-7072-4bbc-a582-584b5bd8****</KeyVersionId>
    <KeyId>5c438b18-05be-40ad-b6c2-3be6752c****</KeyId>
    <RequestId>475f1620-b9d3-4d35-b5c6-3fbdd941423d</RequestId>
    <Plaintext>SGVsbG8gd29ybGQ=</Plaintext>
</AsymmetricDecryptResponse>

JSON format

HTTP/1.1 200 OK
Content-Type:application/json

{
  "KeyVersionId" : "2ab1a983-7072-4bbc-a582-584b5bd8****",
  "KeyId" : "5c438b18-05be-40ad-b6c2-3be6752c****",
  "RequestId" : "475f1620-b9d3-4d35-b5c6-3fbdd941423d",
  "Plaintext" : "SGVsbG8gd29ybGQ="
}

Error codes

HTTP status code	Error code	Error message	Description
400	Rejected.UnsupportedOperation	Unsupported operation.	The operation is not supported.
404	Forbidden.AliasNotFound	The specified Alias is not found.	The specified alias is not found.
404	Forbidden.KeyNotFound	The specified Key is not found.	The specified key does not exist.

For a list of error codes, see Service error codes.