ImportKeyMaterial request failed - InvalidCiphertextException

Question

Hi,

I have encrypted a symmetric key by the downloaded wrappingKey, then upload the encrypted symmetric key with the importToken. Then it returns the error: ImportKeyMaterial request failed - InvalidCiphertextException.

After having some research in the internet, it is suggested to use "**openssl rand -out symmetric.key 32**", but the symmetric key I generated is using "**openssl rand -base64 32 > symmetric.key; openssl rand -base64 16 >> symmetric.key**". I can successfully import the key generated by the suggested command. Below is my enquiry

1. is it not possible for me to upload a key generated by "**openssl rand -base64 32 > symmetric.key; openssl rand -base64 16 >> symmetric.key**"?
2. Is there any guideline on symmetric key generation?

Thanks and Regards,
KTMo

Answer

Hi,

I understand that you are receiving an error ”InvalidCiphertextException” when trying to import a key generated from the command “openssl rand -base64 32 > symmetric.key; openssl rand -base64 16 >> symmetric.key” .

In regards to your first question this would not be possible to use the command listed. You would need to ensure that the key material is a 256-bit symmetric key and the file size of the encrypted key material is 32 bytes. I am attaching the following documentation that goes over the error here (1).

For a guideline on symmetric key generation I am attaching the following documentation that has a step by step walk-through of how to create and  import key material in AWS KMS (2). Lastly I am attaching the following that goes over the certain considerations when deciding to import key material into AWS KMS (3).

Let us know if you need any further information! I hope you have a great rest of your day!

References

(1) https://aws.amazon.com/premiumsupport/knowledge-center/invalidciphertext-kms/

(2) https://aws.amazon.com/premiumsupport/knowledge-center/import-keys-kms/

(3) https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-considerations

ImportKeyMaterial request failed - InvalidCiphertextException

Relevant content