Encrypt

Available in Classic and VPC

Encrypt up to 32 KB of data with the current version of the key. It can only be requested as an AES256 or RSA2048 key type.

Request

This section describes the request format. The method and URI are as follows:

Method	URI
POST	/kms/v1/keys/{keyTag}/encrypt

Request headers

For information about the headers common to all Key Management Service APIs, see the account authentication method in Key Management Service request headers.

Request path parameters

You can use the following path parameters with your request:

Field	Type	Required	Description
`keyTag`	String	Required	Key tag Unique identifier for the key derived from the key name See Get key list Use to request encryption or decryption with REST APIs Key tags are not treated as confidential information

Request body

You can include the following data in the body of your request:

Field	Type	Required	Description
`plaintext`	String or Array[String]	Required	Base64-encoded string data Up to 32 KB of data can be encrypted
`context`	String	Conditional	Base64-encoded string data Required when using keys with convergent encryption Can be up to 50 bytes long Always generate the same ciphertext, even when encrypting the same data multiple times

Request example

The request example is as follows:

Request plaintext as String type

curl --location --request POST 'https://ocapi.ncloud.com/kms/v1/keys/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/encrypt' \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-iam-access-key: {Access Key}' \
--header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \
--data '{
  "plaintext": "{BASE64_PLAINTEXT}",
  "context": "{BASE64_CONTEXT}"
}'

Request plaintext as Array[String] type

curl --location --request POST 'https://ocapi.ncloud.com/kms/v1/keys/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/encrypt' \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-iam-access-key: {Access Key}' \
--header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \
--data '{
  "plaintext": ["{BASE64_PLAINTEXT_1}", "{BASE64_PLAINTEXT_2}", "{BASE64_PLAINTEXT_3}"],
  "context": "{BASE64_CONTEXT}"
}'

Response

This section describes the response format.

Response body

The response body includes the following data:

Field	Type	Required	Description
`code`	String	-	Success or Failure
`data`	Object	-	Response result
`data.ciphertext`	String or Array[String]	-	String data created by encrypting a plaintext

Response status codes

For information about the HTTP status codes common to all Key Management Service APIs, see Key Management Service response status codes.

Response example

The response example is as follows:

Request plaintext as String type

{
    "code": "SUCCESS",
    "data": {
        "ciphertext": "{CIPHERTEXT}"
    }
}

Request plaintext as Array[String] type

{
    "code": "SUCCESS",
    "data": {
        "ciphertext": [
            "{CIPHERTEXT_1}",
            "{CIPHERTEXT_2}",
            "{CIPHERTEXT_3}"
        ]
    }
}

What to know when encrypting directly with the RSA2048 public key

The encryption algorithm parameters for the RSA2048 key are as follows:

Item	Value
Algorithm	RSAES-OAEP
OAEP hash	SHA-256
MGF	MGF1 with SHA-256
Label	None
Maximum plaintext size	190 bytes

The following is an example of defining the parameters in Java:

OAEPParameterSpec spec = new OAEPParameterSpec(
        "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT);

Note

NCP KMS doesn't support OAEP-SHA1 under domestic cryptography recommendation standards and operates only with the single spec above, so you don't need to specify an algorithm parameter for encryption or decryption requests. Data encrypted directly with the public key without calling the KMS API can also be decrypted with Decrypt, as long as it was encrypted under the same conditions as above. For an example of retrieving the public key and encrypting with it, see Get Public Key.