GCLOUD_KMS_DECRYPT(1)

NAME

gcloud kms decrypt - decrypt a ciphertext file using a key

SYNOPSIS

gcloud kms decrypt --ciphertext-file=CIPHERTEXT_FILE --plaintext-file=PLAINTEXT_FILE [--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE] [--key=KEY] [--keyring=KEYRING] [--location=LOCATION] [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
Decrypts the given ciphertext file using the given CryptoKey and writes the result to the named plaintext file. If an additional authenticated data file is provided, its contents must match the additional authenticated data provided during encryption. The file must not be larger than 64KiB. If --ciphertext-file or --additional-authenticated-data-file is set to '-', that file is read from stdin. Similarly, if --plaintext-file is set to '-', the decrypted plaintext is written to stdout.

REQUIRED FLAGS

    --ciphertext-file=CIPHERTEXT_FILE
        Path to the ciphertext file to decrypt.

    --plaintext-file=PLAINTEXT_FILE
        Path to the plaintext file to output.

OPTIONAL FLAGS

    --additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE
        Path to the optional file containing the additional authenticated data.

    --key=KEY
        The key to use for decryption.

    --keyring=KEYRING
        The containing keyring.

    --location=LOCATION
        The location of the requested resource.

GCLOUD WIDE FLAGS
These flags are available to all commands: --account, --configuration, --flatten, --format, --help, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity. Run $ gcloud help for details.

EXAMPLES
The following command will read the file 'path/to/ciphertext', decrypt it using the CryptoKey frodo with the KeyRing fellowship and Location global, and write the plaintext to 'path/to/plaintext'.
    $ gcloud kms decrypt frodo \
        --keyring fellowship \
        --location global \
        --ciphertext-file path/to/input/ciphertext \
        --plaintext-file path/to/output/plaintext