gcloud alpha kms raw-decrypt

NAME
gcloud alpha kms raw-decrypt - decrypt a ciphertext file using a raw key
SYNOPSIS
gcloud alpha kms raw-decrypt --ciphertext-file=CIPHERTEXT_FILE --plaintext-file=PLAINTEXT_FILE --version=VERSION [--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE] [--initialization-vector-file=INITIALIZATION_VECTOR_FILE] [--key=KEY] [--keyring=KEYRING] [--location=LOCATION] [--skip-integrity-verification] [GCLOUD_WIDE_FLAG …]
DESCRIPTION
(ALPHA) gcloud alpha kms raw-decrypt decrypts the given ciphertext file using the given CryptoKey containing a raw key and writes the result to the named plaintext file. The ciphertext file must not be larger than 64KiB.

The supported algorithms are: AES-128-GCM, AES-256-GCM, AES-128-CBC, AES-256-CBC, AES-128-CTR, and AES-256-CTR.

AES-GCM provides authentication which means that it accepts additional authenticated data (AAD). So, the flag --additional-authenticated-data-file is only valid with AES-128-GCM and AES-256-GCM algorithms. If AAD is provided during encryption, it must be provided during decryption too. The file must not be larger than 64KiB.

If --plaintext-file or --additional-authenticated-data-file or --initialization-vector-file is set to '-', that file is read from stdin. Similarly, if --ciphertext-file is set to '-', the ciphertext is written to stdout.

By default, the command performs integrity verification on data sent to and received from Cloud KMS. Use --skip-integrity-verification to disable integrity verification.

EXAMPLES
The following command reads and decrypts the file path/to/input/ciphertext. The file will be decrypted using the CryptoKey KEYNAME containing a raw key, from the KeyRing KEYRING in the global location. It uses the additional authenticated data file path/to/input/aad (only valid with the AES-GCM algorithms) and the initialization vector file path/to/input/iv. The resulting plaintext will be written to path/to/output/plaintext. 
gcloud alpha kms raw-decrypt --key=KEYNAME --keyring=KEYRING --location=global --ciphertext-file=path/to/input/ciphertext --additional-authenticated-data-file=path/to/input/aad --initialization-vector-file=path/to/input/iv --plaintext-file=path/to/output/plaintext
REQUIRED FLAGS
--ciphertext-file=CIPHERTEXT_FILE
File path of the ciphertext file to decrypt.
--plaintext-file=PLAINTEXT_FILE
File path of the plaintext file to store the decrypted data.
--version=VERSION
Version to use for decryption.
OPTIONAL FLAGS
--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE
File path to the optional file containing the additional authenticated data.
--initialization-vector-file=INITIALIZATION_VECTOR_FILE
File path to the optional file containing the initialization vector for decryption.
--key=KEY
The (raw) key to use for decryption.
--keyring=KEYRING
Key ring of the key.
--location=LOCATION
Location of the keyring.
--skip-integrity-verification
Skip integrity verification on request and response API fields.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

NOTES
This command is currently in alpha and might change without notice. If this command fails with API permission errors despite specifying the correct project, you might be trying to access an API with an invitation-only early access allowlist. These variants are also available: 
gcloud kms raw-decrypt
 
gcloud beta kms raw-decrypt