decrypt_data ¶

def decrypt_data(
    self,
    key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    cipher_text: "capo_payment_cryptography_data.types.cipher_text_type.CipherTextType",
    decryption_attributes: "capo_payment_cryptography_data.types.encryption_decryption_attributes.EncryptionDecryptionAttributes",
    *,
    config_overrides: Optional[PaymentCryptographyDataClientConfig] = None,
    wrapped_key: Optional[
        "capo_payment_cryptography_data.types.wrapped_key.WrappedKey"
    ] = None,
) -> "capo_payment_cryptography_data.types.decrypt_data_output.DecryptDataOutput":
    """<p>Decrypts ciphertext data to plaintext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/decrypt-data.html">Decrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>You can use an decryption key generated within Amazon Web Services Payment Cryptography, or you can import your own decryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Decrypt</code>. In asymmetric decryption, Amazon Web Services Payment Cryptography decrypts the ciphertext using the private component of the asymmetric encryption key pair. For data encryption outside of Amazon Web Services Payment Cryptography, you can export the public component of the asymmetric key pair by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html">GetPublicCertificate</a>.</p> <p>This operation also supports dynamic keys, allowing you to pass a dynamic decryption key as a TR-31 WrappedKeyBlock. This can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To decrypt using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped decryption key material. The incoming wrapped key shall have a key purpose of D0 with a mode of use of B or D. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>For symmetric and DUKPT decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For EMV decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> algorithms. For asymmetric decryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. </p> <p>When you use TDES or TDES DUKPT, the ciphertext data length must be a multiple of 8 bytes. For AES or AES DUKPT, the ciphertext data length must be a multiple of 16 bytes. For RSA, it sould be equal to the key size unless padding is enabled.</p> <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p> <p> <b>Cross-account use</b>: This operation supports cross-account use when the key has a resource-based policy that grants access. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security_iam_resource-based-policies.html">Resource-based policies</a>.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>EncryptData</a> </p> </li> <li> <p> <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html">GetPublicCertificate</a> </p> </li> <li> <p> <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a> </p> </li> </ul>

    Args:
        key_identifier: <p>The <code>keyARN</code> of the encryption key that Amazon Web Services Payment Cryptography uses for ciphertext decryption.</p> <p>When a WrappedKeyBlock is provided, this value will be the identifier to the key wrapping key. Otherwise, it is the key identifier used to perform the operation.</p>
        cipher_text: <p>The ciphertext to decrypt.</p>
        decryption_attributes: <p>The encryption key type and attributes for ciphertext decryption.</p>
        wrapped_key: <p>The WrappedKeyBlock containing the encryption key for ciphertext decryption.</p>

    Raises:
        capo_payment_cryptography_data.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_payment_cryptography_data.errors.internal_server_exception.InternalServerException: <p>The request processing has failed because of an unknown error, exception, or failure.</p>
        capo_payment_cryptography_data.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request was denied due to an invalid resource error.</p>
        capo_payment_cryptography_data.errors.throttling_exception.ThrottlingException: <p>The request was denied due to request throttling.</p>
        capo_payment_cryptography_data.errors.validation_exception.ValidationException: <p>The request was denied due to an invalid request error.</p>
        capo_payment_cryptography_data.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_payment_cryptography_data.types.decrypt_data_input.DecryptDataInput]",
    ) -> OperationResponse[
        "capo_payment_cryptography_data.types.decrypt_data_output.DecryptDataOutput"
    ]:
        import capo_payment_cryptography_data._operations.payment_cryptography_data_plane.decrypt_data

        output, http_response = (
            capo_payment_cryptography_data._operations.payment_cryptography_data_plane.decrypt_data.decrypt_data(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_payment_cryptography_data.types.decrypt_data_input.DecryptDataInput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.decrypt_data_input

        return capo_payment_cryptography_data.types.decrypt_data_input.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_payment_cryptography_data.types.decrypt_data_output.DecryptDataOutput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.decrypt_data_output

        return capo_payment_cryptography_data.types.decrypt_data_output.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "DecryptData", redact_input=_redact_input, redact_output=_redact_output
        ),
    )
    input_: capo_payment_cryptography_data.types.decrypt_data_input.DecryptDataInput = {
        "key_identifier": key_identifier,
        "cipher_text": cipher_text,
        "decryption_attributes": decryption_attributes,
    }
    if wrapped_key is not None:
        input_["wrapped_key"] = wrapped_key

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output