6

I'm just getting myself setup with the AWS Key Management Service and am calling the method generateDataKey. The method is working and returning the CiphertextBlob and the Plaintext blob.

However, the blobs are formatted something like:

�g�'��w�i�<��a*\B4p 1IG

I'm using the API so, according to the docs, it is not encoded. I'm trying to understand if the Plaintext can somehow be "decoded" in PHP so I can store it / use it without all the odd looking ASCII characters. What I was expecting was a long string of characters and not the special characters above. I feel like I'm missing something simple.

Thank you!

Jason
  • 1,105
  • 3
  • 16
  • 30
  • 4
    You should be Base-64 encoding and decoding the value when passing it around. – Shotgun Ninja Jun 23 '15 at 20:48
  • That did the trick - thank you! – Jason Jun 23 '15 at 22:09
  • One more thing to add: please DON'T store the plain text key. It should be used to encrypt your data and then immediately discarded. From the official AWS guideline (http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys): "Security best practices dictate that you should remove the plaintext data key from memory as soon as practical after use." – Viccari Apr 27 '17 at 15:44

2 Answers2

2

The answer is a binary blob. These will need to be base64 encoded so that you'll get the expected result.

Sample code follows: 

use Aws\Kms\KmsClient;

$options = [
    'region'                => 'eu-west-1',
    'version'               => '2014-11-01',
    'profile'               => 'default',
    'retries'               => 0,
    'scheme'                => 'https',
    'debug'                 => false
];

$kmsClient = new KmsClient($options);

$result = $kmsClient->generateDataKey([
    'KeyId' => '12345678-1234-1233-1234-1234567890ab',
    'KeySpec' => 'AES_256'
]);

echo base64_encode($result["CiphertextBlob"]);
echo "\r\n";
echo ($result["KeyId"]);
Keith Goodlip
  • 31
  • 5
1

You will need to encode the blobs in base64 encoding in order to conform to the API.

MikeW
  • 21
  • 3