CODEWITHSUNDEEP
encryptiongoogle-bigquerygoogle-cloud-kms
Noura
Noura

Reputation: 59

DETERMINISTIC_DECRYPT_STRING failed: Keyset deserialization failed: Error reading keyset data: Could not parse the input stream as a Keyset-proto

I have a data encryption key encrypted (DEK) that was used to encrypt some values using the algorithm AES256 and the encrypted values are in a BigQuery table.

I am using the KMS provided by Google to encrypt the DEK, so that i can use the encrypted DEK in BigQuery console to decrypt the encrypted data.

i followed this document to create the KMS key, and below are the configuration of my key ring: enter image description here

below are the configuration of my key: enter image description here

Then i followed this documentation and the solution mentioned here to encrypt DEK with KMS key and perform data decryption from BigQuery. Below is the commands i used from the backend to generate the bytes of the encrypted DEK:

echo "my_DEK_in_base64_format" |base64 --decode > /tmp/decoded_key
gcloud kms encrypt --plaintext-file=/tmp/decoded_key--key=projects/my_project/locations/us/keyRings/my_keyring/cryptoKeys/my_key--ciphertext-file=/tmp/encrypted_DEK
od -An -t o1 /tmp/encrypted_DEK | tr -d '\n' |tr -s ' ' | tr ' ' '\'

and below is my code in Bigquery:

DECLARE KMS_RESOURCE_NAME STRING;
DECLARE FIRST_LEVEL_KEYSET BYTES;
 
SET KMS_RESOURCE_NAME = 'gcp-kms://projects/vf-my_project/locations/us/keyRings/my_keyring/cryptoKeys/my_key';

SET FIRST_LEVEL_KEYSET = b'\012\0........70\050\040\052\250\241\175\073\017';
 
select DETERMINISTIC_DECRYPT_STRING(KEYS.KEYSET_CHAIN(KMS_RESOURCE_NAME, FIRST_LEVEL_KEYSET), FROM_BASE64("RandoMValueBlaBlaBla=="), '');

However, i am getting the below error in BigQuery console when i execute the BigQuery code:

Query error: DETERMINISTIC_DECRYPT_STRING failed: Keyset deserialization failed: Error reading keyset data: Could not parse the input stream as a Keyset-proto.; Error in DETERMINISTIC_DECRYPT_STRING (KEYSET, 5q�����bl{8���2/�3|+�,K�n3��f��ei\:, ).; error in DETERMINISTIC_DECRYPT_STRING expression at [8:1]

Can you please support, as i can't figure out the issue or how to fix it.

Upvotes: 0

Views: 164

Answers (0)

Related Questions