gcloud kms raw-encrypt - encrypt a plaintext file using a raw key

gcloud kms raw-encrypt--ciphertext-file=CIPHERTEXT_FILE--plaintext-file=PLAINTEXT_FILE--version=VERSION[--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE][--initialization-vector-file=INITIALIZATION_VECTOR_FILE][--key=KEY][--keyring=KEYRING][--location=LOCATION][--skip-integrity-verification][GCLOUD_WIDE_FLAG …]

The supported algorithms are:AES-128-GCM,AES-256-GCM,AES-128-CBC,AES-256-CBC,AES-128-CTR,and AES-256-CTR.

AES-GCM provides authentication which means that it acceptsadditional authenticated data (AAD). So, the flag--additional-authenticated-data-file is only valid withAES-128-GCM andAES-256-GCM algorithms.

The initialization vector (flag--initialization-vector-file) isonly supported forAES-CBC andAES-CTR algorithms, andmust be 16B in length.

Therefore, both additional authenticated data and initialization vector can't beprovided during encryption. If an additional authenticated data file isprovided, its contents must also be provided during decryption. The file mustnot be larger than 64KiB.

The flag--version indicates the version of the key to use forencryption.

If--plaintext-file or--additional-authenticated-data-file or--initialization-vector-file is set to '-', that file is read fromstdin. Similarly, if--ciphertext-file is set to '-', theciphertext is written to stdout.

By default, the command performs integrity verification on data sent to andreceived from Cloud KMS. Use--skip-integrity-verification todisable integrity verification.

gcloudkmsraw-encrypt--key=KEYNAME--keyring=KEYRING--location=global--plaintext-file=path/to/input/plaintext--additional-authenticated-data-file=path/to/input/aad--ciphertext-file=path/to/output/ciphertext

The following command reads and encrypts the filepath/to/input/plaintext. The file will be encrypted using theAES-CBC CryptoKeyKEYNAME from the KeyRingKEYRING in theglobal location using theinitialization vector stored atpath/to/input/aad. The resultingciphertext will be written topath/to/output/ciphertext.

gcloudkmsraw-encrypt--key=KEYNAME--keyring=KEYRING--location=global--plaintext-file=path/to/input/plaintext--initialization-vector-file=path/to/input/iv--ciphertext-file=path/to/output/ciphertext

--ciphertext-file=CIPHERTEXT_FILE

File path of the ciphertext file to output.

--plaintext-file=PLAINTEXT_FILE

File path of the plaintext file to encrypt.

--version=VERSION

Version to use for encryption.

--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE

File path to the optional file containing the additional authenticated data.

--initialization-vector-file=INITIALIZATION_VECTOR_FILE

File path to the optional file containing the initialization vector forencryption.

--key=KEY

The key to use for encryption.

--keyring=KEYRING

Key ring of the key.

--location=LOCATION

Location of the keyring.

--skip-integrity-verification

Skip integrity verification on request and response API fields.

Run$gcloud help for details.