[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[],[],null,["# Verify an imported key version\n\nThis topic shows you how to verify an asymmetric key version that you\n[import](/kms/docs/importing-a-key) into Cloud KMS or\nCloud HSM.\n\nFor more details about how import works, including limitations and\nrestrictions, refer to [Key import](/kms/docs/key-import).\n\nLimitations on verifying imported keys\n--------------------------------------\n\n### Data encrypted outside of Cloud KMS\n\nThe best way to test an imported key is to decrypt data that was encrypted\nbefore the key was imported, or to encrypt data using the imported key and\ndecrypt it using the key before import.\n\nIn Cloud KMS or Cloud HSM, this is only possible when you\nimport an asymmetric key. This is because when data is encrypted using a\nsymmetric Cloud KMS or Cloud HSM key, extra metadata about\nthe encryption key version is saved, encrypted, along with the encrypted data.\nThis metadata is not present in data encrypted outside of Cloud KMS.\n\n### Verify attestations\n\nYou can [verify attestations](#verifying_attestations) about Cloud HSM\nkeys. These attestations assert that the key is an HSM key, that the HSM module\nis owned by Google, and other details about the key. These attestations are not\navailable for software keys.\n\nBefore you begin\n----------------\n\n- [Import an asymmetric key](/kms/docs/importing-a-key) into Cloud KMS or Cloud HSM. You must use Cloud HSM if you want to verify the key's attestations.\n- If possible, complete the tasks in this topic using the same local system where you imported the key, so the local system already has the Google Cloud CLI installed and configured.\n- Encrypt a file using the local key, or copy a file encrypted with that key to the local system.\n\nVerify that the key material is identical\n-----------------------------------------\n\nAfter you import an asymmetric key into Cloud KMS or\nCloud HSM, the key material is identical to the local key. To verify\nthat this is true, you can use the imported key to decrypt data that was\nencrypted using the key before it was imported.\n\nTo decrypt a file using a Cloud KMS or Cloud HSM key: \n\n```\ngcloud kms decrypt \\\n --location=location \\\n --keyring=key-ring-name \\\n --key=key-name \\\n --ciphertext-file=filepath-and-file-to-decrypt \\\n --plaintext-file=decrypted-filepath-and-file.dec\n```\n\nIf the file pointed to by the `--plaintext-file` flag contains the correct\ndecrypted data, the key material of the external and imported key is identical.\n\nTo learn more, see [encrypting and decrypting data](/kms/docs/encrypt-decrypt).\n\nVerify attestations for a Cloud HSM key\n---------------------------------------\n\nAfter a key is imported into an HSM, you can view attestations to verify that\nthe HSM is owned by Google. The procedure is different to verify\n[symmetric Cloud HSM keys](#verifying_symmetric) and\n[asymmetric keys](#verifying_asymmetric).\n\nAttestations are not available for software keys in Cloud KMS.\n\n### Symmetric Cloud HSM keys\n\nYou can use the Extended Key Checksum Value (EKCV) key attribute to verify an\nimported Cloud HSM key's key material. This value is calculated by\nfollowing [RFC 5869](https://tools.ietf.org/html/rfc5869),\nsection 2. The value is derived using SHA-256-based HMAC-based\nExtract-and-Expand Key Derivation Function (HKDF) with 32 zero bytes as salt and\nexpanding it with the fixed string **Key Check Value** as info. To retrieve this\nvalue, you can [attest the key](/kms/docs/attest-key#verify_key_properties).\n\n### Asymmetric Cloud HSM keys\n\nWhen you make the import request for an asymmetric key, you include your wrapped\nprivate key. The private key contains sufficient information for\nCloud KMS to derive the public key. After your key is imported, you\ncan retrieve the public key and verify that it matches the public key you have\nstored locally. For more information about checking\nthe public key attribute, see\n[To verify the public key](/kms/docs/attest-key#verify_public_key).\n\nYou can verify the EKCV verification for asymmetric keys. In this case, the\nvalue is the SHA-256 digest of the DER-encoded public key. You can retrieve this\nvalue by looking at the attestation of the key. For more information about\nchecking the EKCV key attribute, see\n[To verify key properties](/kms/docs/attest-key#verify_key_properties).\n\nFor additional information about attesting keys you import, see\n[Attesting a key](/kms/docs/attest-key#verify_key_properties)\n\nWhat's next\n-----------\n\n- Learn how to [create keys](/kms/docs/creating-keys)\n- Learn about [encrypting and decrypting](/kms/docs/encrypt-decrypt)\n- Learn about [signing and\n validating data](/kms/docs/create-validate-signatures)"]]
