使用GCP KMS加密成功但解密失败，请求技术支持

算力阿峰

2026-8-11

GCP KMS解密失败问题修复

问题根源

加密生成的密文是二进制数据，你直接用toStringUtf8()将其转为字符串，这会破坏原始字节——因为二进制密文并非合法的UTF-8编码内容，转换过程中会丢失或篡改部分字节。解密时基于损坏的字符串生成字节数组，KMS自然无法识别，抛出INVALID_ARGUMENT错误。

修复代码

改用Base64编码处理密文，确保二进制数据完整保留：

import com.google.common.io.BaseEncoding;
import com.google.protobuf.ByteString;
import com.google.cloud.kms.v1.CryptoKeyName;
import com.google.cloud.kms.v1.DecryptResponse;
import com.google.cloud.kms.v1.EncryptResponse;
import com.google.cloud.kms.v1.KeyManagementServiceClient;
import java.io.IOException;

public String encryptAndDecrypt() throws IOException {

    try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {

        String plaintext = "Just an ordinary string";
        CryptoKeyName keyVersionName = CryptoKeyName.of("us-con-gcp-npr-0000305-041421",
                "global", "test", "test1");

        // 加密明文
        EncryptResponse response = client.encrypt(keyVersionName, ByteString.copyFromUtf8(plaintext));
        ByteString ciphertextBytes = response.getCiphertext();
        // 用Base64将二进制密文转为字符串
        String cipherText = BaseEncoding.base64().encode(ciphertextBytes.toByteArray());
        System.out.printf("Ciphertext: %s%n", cipherText);

        // 解密：先Base64解码回二进制数据
        byte[] decodedCiphertext = BaseEncoding.base64().decode(cipherText);
        DecryptResponse decryptResponse = client.decrypt(keyVersionName, ByteString.copyFrom(decodedCiphertext));
        System.out.printf("Plaintext: %s%n", decryptResponse.getPlaintext().toStringUtf8());
    }
    return "Done";
}