Question

我正在尝试使用AWS KMS加密和解密一个简单的字符串，
我正在使用AWS Javascript SDK来实现，
我可以对字符串进行加密和某种程度的解密，因为没有错误，
但是，KMS解密方法的输出不会产生我尝试加密的原始字符串。

这是我的工作代码-

var AWS = require('aws-sdk');
const util = require('util');

AWS.config.update({region:'us-east-1'});
var kms = new AWS.KMS({apiVersion: '2014-11-01'});

let test = async () => {

    try {
        let data = `test`;

        var encryptionParams = {
            KeyId: "someKMSKeyId",
            Plaintext: data
        };

        let kmsEncrypt = util.promisify(kms.encrypt).bind(kms);
        let encryptedData = await kmsEncrypt(encryptionParams);

        //encryptedData contained 2 parts, CiphertextBlob and KeyId
        console.log('encryptedData => \n', encryptedData);
        console.log('\nencryptedData.CiphertextBlob => \n', encryptedData.CiphertextBlob);
        console.log('\nencryptedData.KeyId => \n', encryptedData.KeyId);

        var decryptionParams = {
            CiphertextBlob : encryptedData.CiphertextBlob
        };

        let kmsDecrypt = util.promisify(kms.decrypt).bind(kms);
        let decryptedData = await kmsDecrypt(decryptionParams);

        //ndecryptedData contained 2 parts, Plaintext and KeyId
        console.log('\ndecryptedData => \n', decryptedData);
        console.log('\ndecryptedData.Plaintext => \n', decryptedData.Plaintext);
        console.log('\ndecryptedData.KeyId => \n', decryptedData.KeyId);
    } catch (error) {
        console.log('\nerror => \n',error);
    }
}

test();

我希望decryptedData.Plaintext的输出进行测试，
但是输出类似于-<Buffer 74 65 73 74>，
我这是怎么了？

参考-
https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/KMS.html#endpoint-property

Answer 1

由于kdgregory的提示，我能够通过使用base64将PlainText解码为String来解决此问题，
以下是使用AWS KMS进行加密和解密的最终工作代码-

var AWS = require('aws-sdk');
const util = require('util');

AWS.config.update({region:'us-east-1'});
var kms = new AWS.KMS({apiVersion: '2014-11-01'});

let test = async () => {

    try {
        let data = 'test';

        var encryptionParams = {
            KeyId: "kmsKeyId",
            Plaintext: data
        };

        let kmsEncrypt = util.promisify(kms.encrypt).bind(kms);
        let encryptedData = await kmsEncrypt(encryptionParams);

        //encryptedData contained 2 parts, CiphertextBlob and KeyId
        console.log('encryptedData => \n', encryptedData);
        console.log('\nencryptedData.CiphertextBlob => \n', encryptedData.CiphertextBlob);
        console.log('\nencryptedData.KeyId => \n', encryptedData.KeyId);

        let buff = Buffer.from(encryptedData.CiphertextBlob);
        let encryptedBase64data = buff.toString('base64');
        console.log("\nencryptedBase64data => \n", encryptedBase64data);

        var decryptionParams = {
            CiphertextBlob : encryptedData.CiphertextBlob
        };

        let kmsDecrypt = util.promisify(kms.decrypt).bind(kms);
        let decryptedData = await kmsDecrypt(decryptionParams);

        //ndecryptedData contained 2 parts, Plaintext and KeyId
        console.log('\ndecryptedData => \n', decryptedData);
        console.log('\ndecryptedData.Plaintext => \n', decryptedData.Plaintext);
        console.log('\ndecryptedData.KeyId => \n', decryptedData.KeyId);

        let buff2 = Buffer.from(decryptedData.Plaintext, 'base64');  
        let originalText = buff2.toString('ascii');
        console.log('\noriginalText => \n', originalText);
    } catch (error) {
        console.log('\nerror => \n',error);
    }
}

test();

Answer 2

只是为了补充您的答案。

纯文本

解密的明文数据。 使用HTTP API或   AWS CLI，该值是Base64编码的。否则，它不会被编码。

类型：Base64编码的二进制数据对象

长度限制：最小长度为1。最大长度为4096。

参考：https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html#API_Decrypt_ResponseElements

如何使用AWS KMS加密和解密字符串？

2 个答案: