gcloud kms raw-decrypt

NAME
gcloud kms raw-decrypt - decrypt a ciphertext file using a raw key
SYNOPSIS
gcloud kms raw-decrypt --ciphertext-file=CIPHERTEXT_FILE --plaintext-file=PLAINTEXT_FILE --version=VERSION [--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE] [--initialization-vector-file=INITIALIZATION_VECTOR_FILE] [--key=KEY] [--keyring=KEYRING] [--location=LOCATION] [--skip-integrity-verification] [GCLOUD_WIDE_FLAG …]
DESCRIPTION
gcloud kms raw-decrypt decrypts the given ciphertext file using the given CryptoKey containing a raw key and writes the result to the named plaintext file. The ciphertext file must not be larger than 64KiB.

The supported algorithms are: AES-128-GCM, AES-256-GCM, AES-128-CBC, AES-256-CBC, AES-128-CTR, and AES-256-CTR.

AES-GCM provides authentication which means that it accepts additional authenticated data (AAD). So, the flag --additional-authenticated-data-file is only valid with AES-128-GCM and AES-256-GCM algorithms. If AAD is provided during encryption, it must be provided during decryption too. The file must not be larger than 64KiB.

If --plaintext-file or --additional-authenticated-data-file or --initialization-vector-file is set to '-', that file is read from stdin. Similarly, if --ciphertext-file is set to '-', the ciphertext is written to stdout.

By default, the command performs integrity verification on data sent to and received from Cloud KMS. Use --skip-integrity-verification to disable integrity verification.

EXAMPLES
The following command reads and decrypts the file path/to/input/ciphertext. The file will be decrypted using the CryptoKey KEYNAME containing a raw key, from the KeyRing KEYRING in the global location. It uses the additional authenticated data file path/to/input/aad (only valid with the AES-GCM algorithms) and the initialization vector file path/to/input/iv. The resulting plaintext will be written to path/to/output/plaintext. 
gcloud kms raw-decrypt --key=KEYNAME --keyring=KEYRING --location=global --ciphertext-file=path/to/input/ciphertext --additional-authenticated-data-file=path/to/input/aad --initialization-vector-file=path/to/input/iv --plaintext-file=path/to/output/plaintext
REQUIRED FLAGS
--ciphertext-file=CIPHERTEXT_FILE
File path of the ciphertext file to decrypt.
--plaintext-file=PLAINTEXT_FILE
File path of the plaintext file to store the decrypted data.
--version=VERSION
Version to use for decryption.
OPTIONAL FLAGS
--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE
File path to the optional file containing the additional authenticated data.
--initialization-vector-file=INITIALIZATION_VECTOR_FILE
File path to the optional file containing the initialization vector for decryption.
--key=KEY
The (raw) key to use for decryption.
--keyring=KEYRING
Key ring of the key.
--location=LOCATION
Location of the keyring.
--skip-integrity-verification
Skip integrity verification on request and response API fields.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

NOTES
These variants are also available: 
gcloud alpha kms raw-decrypt
 
gcloud beta kms raw-decrypt