[Python] GCP DLP(Data Loss prevention) getting “Decryption failed: the ciphertext is...

I created a key ring and then a key.Then used import job to create a wrapped key .Thereafter used the below code to decrypt a normal text. But I am getting below error:

.InvalidArgument: 400 Received the following error message from Cloud KMS when unwrapping KmsWrappedCryptoKey "projects/XXXXXXXXXXXX/location
s/global/keyRings/demo-keyring/cryptoKeys/demo_v1": Decryption failed: the ciphertext is invalid.


Below is the code:

# Import the client library
import google.cloud.dlp

# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
project = 'XXXXXX'
stringVal = 'My name is Sonal Singh and my email id is : sonalsingh@gmail.com'
alphabet='ALPHA_NUMERIC'
surrogate_type='EMAIL_ADDRESS'
wrapped_key=('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX+'
'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX+gr'
'l+XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX+'
'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX+/+'
'//xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=')

#key_name = ('projects/XXXXXXXXXXXXX/locations/global/keyRings/demo-keyring/cryptoKeys/demo_key')


parent = dlp.project_path(project)
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
import base64

wrapped_key = base64.b64decode(wrapped_key)

# Construct FPE configuration dictionary
crypto_replace_ffx_fpe_config = {
"crypto_key": {
"kms_wrapped": {
"wrapped_key": wrapped_key,
"crypto_key_name": key_name,
}
},
"common_alphabet": alphabet,
}

# Add surrogate type
if surrogate_type:
crypto_replace_ffx_fpe_config["surrogate_info_type"] = {
"name": surrogate_type
}

# Construct inspect configuration dictionary
inspect_config = {
"info_types": [{"name": info_type} for info_type in ["FIRST_NAME", "LAST_NAME", "EMAIL_ADDRESS"]]
}

# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": crypto_replace_ffx_fpe_config
}
}
]
}
}

# Convert string to item
item = {"value": stringVal}

# Call the API
response = dlp.deidentify_content(
parent,
inspect_config=inspect_config,
deidentify_config=deidentify_config,
item=item
)

# Print results
print(response.item.value)


I could see another stack overflow post with same issue: GCP DLP(Data Loss prevention) getting "Decryption failed: the ciphertext is invalid." but was not sure what does this step meant:

Use this generated value in your request to Google Cloud DLP API.
​

How to use this value in the above code?

Continue reading...