[英]GCP - DLP - Decryption failed: the ciphertext is invalid error when using KMS wrapped key
While trying out on a POC with GCP DLP, facing the below issue:在使用 GCP DLP 尝试 POC 时,面临以下问题:
log:
Received the following error message from Cloud KMS when unwrapping KmsWrappedCryptoKey
"projects/<<PROJECT_ID>>/locations/global/keyRings/<<KMS_KEY_RING>>/cryptoKeys
/<<KMS_KEY_NAME>>": Decryption failed: the ciphertext is invalid.
I have just created the key and key ring using the generate key option in KMS and a basic DLP template to Pseudoanaonymize the data with cryptographic deterministic token.我刚刚使用 KMS 中的生成密钥选项和基本 DLP 模板创建了密钥和密钥环,以使用加密确定性令牌对数据进行伪匿名化。 The wrapped key I gave is a simple base-64 format key.
我给出的封装密钥是一个简单的 base-64 格式密钥。 When testing out this template in console with the data, I am facing this issue.
在控制台中使用数据测试此模板时,我遇到了这个问题。 The same issue is replicated in the application logs when trying to encrypt the data.
尝试加密数据时,应用程序日志中会复制相同的问题。
PS : We have tried out generating a manual key using Open SSL and importing it into the KMS. PS :我们已尝试使用 Open SSL 生成手动密钥并将其导入 KMS。 We are still facing this issue.
我们仍然面临这个问题。
Figured out the issue in this case.在这种情况下找出问题。
The issue was with the way we created the wrapped key which we gave in the DLP template.问题在于我们创建在 DLP 模板中提供的封装密钥的方式。 Below are the steps to generate the wrapped key:
以下是生成包装密钥的步骤:
Below are the commands for above steps in the same order:以下是按相同顺序执行上述步骤的命令:
openssl rand 16 > secret.txt
This generates random string of 16 bytes.这将生成 16 个字节的随机字符串。 The size had to be one of 16,24,32 (mandatory)
大小必须是 16,24,32 之一(强制)
gcloud kms encrypt --location global --keyring <key-ring-name> --key \
<key-name> --plaintext-file secret.txt --ciphertext-file \
mysecret.txt.encrypted
This encrpts the random string.这将加密随机字符串。
base64 mysecret.txt.encrypted
Use this in the DLP template.在 DLP 模板中使用它。
This answer helped me figure out the issue : https://stackoverflow.com/a/60513800/6908062这个答案帮助我弄清楚了这个问题: https : //stackoverflow.com/a/60513800/6908062
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.