Skip to content

/AWS1/CL_KMSGETPUBLICKEYRSP

GetPublicKeyResponse

CONSTRUCTOR

IMPORTING

Optional arguments:

iv_keyid TYPE /AWS1/KMSKEYIDTYPE /AWS1/KMSKEYIDTYPE

The Amazon Resource Name (key ARN) of the asymmetric KMS key from which the public key was downloaded.

iv_publickey TYPE /AWS1/KMSPUBLICKEYTYPE /AWS1/KMSPUBLICKEYTYPE

The exported public key.

The value is a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo (SPKI), as defined in RFC 5280. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.

iv_customermasterkeyspec TYPE /AWS1/KMSCUSTOMERMASTERKEYSPEC /AWS1/KMSCUSTOMERMASTERKEYSPEC

Instead, use the KeySpec field in the GetPublicKey response.

The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

iv_keyspec TYPE /AWS1/KMSKEYSPEC /AWS1/KMSKEYSPEC

The type of the of the public key that was downloaded.

iv_keyusage TYPE /AWS1/KMSKEYUSAGETYPE /AWS1/KMSKEYUSAGETYPE

The permitted use of the public key. Valid values for asymmetric key pairs are ENCRYPT_DECRYPT, SIGN_VERIFY, and KEY_AGREEMENT.

This information is critical. For example, if a public key with SIGN_VERIFY key usage encrypts data outside of KMS, the ciphertext cannot be decrypted.

it_encryptionalgorithms TYPE /AWS1/CL_KMSENCALGSPECLIST_W=>TT_ENCRYPTIONALGORITHMSPECLIST TT_ENCRYPTIONALGORITHMSPECLIST

The encryption algorithms that KMS supports for this key.

This information is critical. If a public key encrypts data outside of KMS by using an unsupported encryption algorithm, the ciphertext cannot be decrypted.

This field appears in the response only when the KeyUsage of the public key is ENCRYPT_DECRYPT.

it_signingalgorithms TYPE /AWS1/CL_KMSSIGNINGALGSPECLS00=>TT_SIGNINGALGORITHMSPECLIST TT_SIGNINGALGORITHMSPECLIST

The signing algorithms that KMS supports for this key.

This field appears in the response only when the KeyUsage of the public key is SIGN_VERIFY.

it_keyagreementalgorithms TYPE /AWS1/CL_KMSKEYAGREEMENTALGS00=>TT_KEYAGREEMENTALGSPECLIST TT_KEYAGREEMENTALGSPECLIST

The key agreement algorithm used to derive a shared secret. This field is present only when the KMS key has a KeyUsage value of KEY_AGREEMENT.

Queryable Attributes

KeyId

The Amazon Resource Name (key ARN) of the asymmetric KMS key from which the public key was downloaded.

Accessible with the following methods

Method Description
GET_KEYID() Getter for KEYID, with configurable default
ASK_KEYID() Getter for KEYID w/ exceptions if field has no value
HAS_KEYID() Determine if KEYID has a value

PublicKey

The exported public key.

The value is a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo (SPKI), as defined in RFC 5280. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.

Accessible with the following methods

Method Description
GET_PUBLICKEY() Getter for PUBLICKEY, with configurable default
ASK_PUBLICKEY() Getter for PUBLICKEY w/ exceptions if field has no value
HAS_PUBLICKEY() Determine if PUBLICKEY has a value

CustomerMasterKeySpec

Instead, use the KeySpec field in the GetPublicKey response.

The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

Accessible with the following methods

Method Description
GET_CUSTOMERMASTERKEYSPEC() Getter for CUSTOMERMASTERKEYSPEC, with configurable default
ASK_CUSTOMERMASTERKEYSPEC() Getter for CUSTOMERMASTERKEYSPEC w/ exceptions if field has
HAS_CUSTOMERMASTERKEYSPEC() Determine if CUSTOMERMASTERKEYSPEC has a value

KeySpec

The type of the of the public key that was downloaded.

Accessible with the following methods

Method Description
GET_KEYSPEC() Getter for KEYSPEC, with configurable default
ASK_KEYSPEC() Getter for KEYSPEC w/ exceptions if field has no value
HAS_KEYSPEC() Determine if KEYSPEC has a value

KeyUsage

The permitted use of the public key. Valid values for asymmetric key pairs are ENCRYPT_DECRYPT, SIGN_VERIFY, and KEY_AGREEMENT.

This information is critical. For example, if a public key with SIGN_VERIFY key usage encrypts data outside of KMS, the ciphertext cannot be decrypted.

Accessible with the following methods

Method Description
GET_KEYUSAGE() Getter for KEYUSAGE, with configurable default
ASK_KEYUSAGE() Getter for KEYUSAGE w/ exceptions if field has no value
HAS_KEYUSAGE() Determine if KEYUSAGE has a value

EncryptionAlgorithms

The encryption algorithms that KMS supports for this key.

This information is critical. If a public key encrypts data outside of KMS by using an unsupported encryption algorithm, the ciphertext cannot be decrypted.

This field appears in the response only when the KeyUsage of the public key is ENCRYPT_DECRYPT.

Accessible with the following methods

Method Description
GET_ENCRYPTIONALGORITHMS() Getter for ENCRYPTIONALGORITHMS, with configurable default
ASK_ENCRYPTIONALGORITHMS() Getter for ENCRYPTIONALGORITHMS w/ exceptions if field has n
HAS_ENCRYPTIONALGORITHMS() Determine if ENCRYPTIONALGORITHMS has a value

SigningAlgorithms

The signing algorithms that KMS supports for this key.

This field appears in the response only when the KeyUsage of the public key is SIGN_VERIFY.

Accessible with the following methods

Method Description
GET_SIGNINGALGORITHMS() Getter for SIGNINGALGORITHMS, with configurable default
ASK_SIGNINGALGORITHMS() Getter for SIGNINGALGORITHMS w/ exceptions if field has no v
HAS_SIGNINGALGORITHMS() Determine if SIGNINGALGORITHMS has a value

KeyAgreementAlgorithms

The key agreement algorithm used to derive a shared secret. This field is present only when the KMS key has a KeyUsage value of KEY_AGREEMENT.

Accessible with the following methods

Method Description
GET_KEYAGREEMENTALGORITHMS() Getter for KEYAGREEMENTALGORITHMS, with configurable default
ASK_KEYAGREEMENTALGORITHMS() Getter for KEYAGREEMENTALGORITHMS w/ exceptions if field has
HAS_KEYAGREEMENTALGORITHMS() Determine if KEYAGREEMENTALGORITHMS has a value