nsmithuk
commented
4 years ago Hi @ozbillwang
In your example test above, the CiphertextBlob that you pass to the decrypt method needs to exactly match the CiphertextBlob returned from the encrypt operation.
So in your example, you'd need to pass decrypt "CiphertextBlob":"S2Fybjphd3M6a21zOmV1LXdlc3QtMjoxMTExMjIyMjMzMzM6a2V5L2JjNDM2NDg1LTUwOTItNDJiOC05MmEzLTBhYThiOTM1MzZkYwAAAACH7BBmLEn+3YuYzVEnu1ABJSPrqjz8epykbOnSHwS7gA4=".
Here's an example of the full chain that I've just run, done with httpie to get pretty outputs:
http --json POST http://localhost:8081/ X-Amz-Target:TrentService.CreateKey
HTTP/1.1 200 OK
Content-Length: 329
Content-Type: application/x-amz-json-1.1
Date: Thu, 17 Oct 2019 09:24:50 GMT
{
"KeyMetadata": {
"AWSAccountId": "111122223333",
"Arn": "arn:aws:kms:eu-west-2:111122223333:key/46d26eff-112b-4c64-9723-a8252d4de7b9",
"CreationDate": 1571304290,
"Description": "",
"Enabled": true,
"KeyId": "46d26eff-112b-4c64-9723-a8252d4de7b9",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS"
}
}
We need to take KeyId from above and pass it as an input to encrypt.
http --json POST http://localhost:8081/ X-Amz-Target:TrentService.Encrypt KeyId=46d26eff-112b-4c64-9723-a8252d4de7b9 Plaintext='SGVsbG8='
HTTP/1.1 200 OK
Content-Length: 259
Content-Type: application/x-amz-json-1.1
Date: Thu, 17 Oct 2019 09:25:36 GMT
{
"CiphertextBlob": "S2Fybjphd3M6a21zOmV1LXdlc3QtMjoxMTExMjIyMjMzMzM6a2V5LzQ2ZDI2ZWZmLTExMmItNGM2NC05NzIzLWE4MjUyZDRkZTdiOQAAAAAFZhJPGVEwyrKX4XLO9vjlQsv9z74g8qz0DZIaWAI4NCo=",
"KeyId": "arn:aws:kms:eu-west-2:111122223333:key/46d26eff-112b-4c64-9723-a8252d4de7b9"
}
We need to take CiphertextBlob from above and pass it as an input to decrypt.
http --json POST http://localhost:8081/ X-Amz-Target:TrentService.Decrypt CiphertextBlob='S2Fybjphd3M6a21zOmV1LXdlc3QtMjoxMTExMjIyMjMzMzM6a2V5LzQ2ZDI2ZWZmLTExMmItNGM2NC05NzIzLWE4MjUyZDRkZTdiOQAAAAAFZhJPGVEwyrKX4XLO9vjlQsv9z74g8qz0DZIaWAI4NCo='
HTTP/1.1 200 OK
Content-Length: 110
Content-Type: application/x-amz-json-1.1
Date: Thu, 17 Oct 2019 09:26:15 GMT
{
"KeyId": "arn:aws:kms:eu-west-2:111122223333:key/46d26eff-112b-4c64-9723-a8252d4de7b9",
"Plaintext": "SGVsbG8="
}
ozbillwang
I start up local-kms on port 8081 (because localstack is started at port 8080)
https://github.com/localstack/localstack/issues/206#issuecomment-542960650
Here is my test result, that I can encrypt data, but can't decrypt it.