DecryptResponse Class | AWS SDK for .NET Version 4

This is the response object from the Decrypt operation.

In this article ▶

Inheritance Hierarchy

System.Object
Amazon.Runtime.AmazonWebServiceResponse
Amazon.KeyManagementService.Model.DecryptResponse

Namespace: Amazon.KeyManagementService.Model
Assembly: AWSSDK.KeyManagementService.dll
Version: 3.x.y.z

Syntax

public class DecryptResponse : AmazonWebServiceResponse

The DecryptResponse type exposes the following members

Constructors

	Name	Description
	DecryptResponse()

Properties

Name	Type	Description
CiphertextForRecipient	System.IO.MemoryStream	Gets and sets the property CiphertextForRecipient. The plaintext data encrypted with the public key from the attestation document. This ciphertext can be decrypted only by using a private key from the attested environment. This field is included in the response only when the `Recipient` parameter in the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM. For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see Cryptographic attestation support in KMS in the Key Management Service Developer Guide.
ContentLength	System.Int64	Inherited from Amazon.Runtime.AmazonWebServiceResponse.
EncryptionAlgorithm	Amazon.KeyManagementService.EncryptionAlgorithmSpec	Gets and sets the property EncryptionAlgorithm. The encryption algorithm that was used to decrypt the ciphertext.
HttpStatusCode	System.Net.HttpStatusCode	Inherited from Amazon.Runtime.AmazonWebServiceResponse.
KeyId	System.String	Gets and sets the property KeyId. The Amazon Resource Name (key ARN) of the KMS key that was used to decrypt the ciphertext.
KeyMaterialId	System.String	Gets and sets the property KeyMaterialId. The identifier of the key material used to decrypt the ciphertext. This field is present only when the operation uses a symmetric encryption KMS key. This field is omitted if the request includes the `Recipient` parameter.
Plaintext	System.IO.MemoryStream	Gets and sets the property Plaintext. Decrypted plaintext data. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded. If the response includes the `CiphertextForRecipient` field, the `Plaintext` field is null or empty.
ResponseMetadata	Amazon.Runtime.ResponseMetadata	Inherited from Amazon.Runtime.AmazonWebServiceResponse.

Examples

The following example decrypts data that was encrypted with an asymmetric encryption KMS key. When the KMS encryption key is asymmetric, you must specify the KMS key ID and the encryption algorithm that was used to encrypt the data.

To decrypt data with an asymmetric encryption KMS key


var client = new AmazonKeyManagementServiceClient();
var response = client.Decrypt(new DecryptRequest
{
    CiphertextBlob = new MemoryStream(<binary data>),
    EncryptionAlgorithm = "RSAES_OAEP_SHA_256",
    KeyId = "0987dcba-09fe-87dc-65ba-ab0987654321"
});

EncryptionAlgorithmSpec encryptionAlgorithm = response.EncryptionAlgorithm;
string keyId = response.KeyId;
MemoryStream plaintext = response.Plaintext;

The following example decrypts data that was encrypted with a symmetric encryption KMS key. The KeyId is not required when decrypting with a symmetric encryption key, but it is a best practice.

To decrypt data with a symmetric encryption KMS key


var client = new AmazonKeyManagementServiceClient();
var response = client.Decrypt(new DecryptRequest
{
    CiphertextBlob = new MemoryStream(<binary data>),
    KeyId = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
});

EncryptionAlgorithmSpec encryptionAlgorithm = response.EncryptionAlgorithm;
string keyId = response.KeyId;
string keyMaterialId = response.KeyMaterialId;
MemoryStream plaintext = response.Plaintext;

Version Information

.NET:
Supported in: 8.0 and newer, Core 3.1

.NET Standard:
Supported in: 2.0

.NET Framework:
Supported in: 4.7.2 and newer