0

I have imported the key material into Cloud KMS and KMS generated a (AES-256) key, then I saved the key material locally and encrypted some data files with generated key.

After that if my Google account is arrears or Cloud KMS crashes and causes the KMS key to be lost (I know this is highly unlikely). Can I still recover the key and decrypt the encrypted file?

Specifically, my scenario is that, after I renewed my payment method, my KMS service resumed. Can I use the same key material to re-import it into KMS to regenerate a new key that can decrypt the files that were encrypted with the old key?

yyyyahir
  • 2,262
  • 1
  • 5
  • 14
TianXing Chu
  • 3
  • 1
  • My question is: After I renewed my fee or KMS resumed service, Can I use the material in my hand to re-import to KMS (but the previously generated KMS key is still missing) to regenerate a new KMS key that can decrypt the files that encrypted by the first KMS key. – TianXing Chu Oct 11 '19 at 04:41

1 Answers1

0

Even if you have your imported key material, Cloud KMS only allows operations through its API, this means that without access to it, is not possible to decrypt files.

From the documentation on symmetrical keys:

For security reasons, the raw cryptographic key material represented by a Cloud KMS key can never be viewed or exported. It can only be used by an authorized user to encrypt or decrypt data when they invoke the Cloud KMS API.

In your specific scenario, even if you use the same key material to create another symmetrical key, you won't be able to decrypt the previously encrypted files with the old key.

yyyyahir
  • 2,262
  • 1
  • 5
  • 14
  • Thank you for your answer. My English is not good, I don't express it clearly. My question is: After I renewed my fee or KMS resumed service, Can I use the material in my hand to re-import to KMS (but the previously generated KMS key is still missing) to regenerate a new KMS key that can decrypt the files. – TianXing Chu Oct 11 '19 at 04:19
  • This is not possible. I edited the question to reflect this. – yyyyahir Oct 16 '19 at 13:33
  • Got it. Now I am confusing that why google give people a choice to import key material. – TianXing Chu Oct 18 '19 at 09:40