Encryption and Decryption Overview and Algorithm Specifications

You can use the keys in HUKS to encrypt or decrypt data.

Supported Algorithms

The following table lists the supported specifications for key encryption and decryption.

The key management service specifications include mandatory specifications and optional specifications. Mandatory specifications are algorithm specifications that must be supported. Optional specifications can be used based on actual situation. Before using the optional specifications, refer to the documents provided by the vendor to ensure that the specifications are supported.

You are advised to use mandatory specifications in your development for compatibility purposes.

Specifications for Standard-System Devices

Algorithm/Cipher Mode/Padding Mode	Description	API Version	Mandatory
AES/ECB/NoPadding AES/ECB/PKCS7	In ECB mode, the data length should be a multiple of the block size used by the encryption algorithm. If the padding mode is NoPadding and the length of the input data is not a multiple of 16 bytes, the service side must pad the input data to the required length.	8+	No
AES/CBC/NoPadding AES/CBC/PKCS7 AES/CTR/NoPadding	IV is mandatory. In CBC mode, the data length should be a multiple of the block size used by the encryption algorithm. If the padding mode is NoPadding and the length of the input data is not a multiple of 16 bytes, the service side must pad the input data to the required length.	8+	Yes
AES/GCM/NoPadding	Nonce is mandatory for encryption. Nonce and AEAD are mandatory for decryption.	8+	Yes
RSA/ECB/NoPadding RSA/ECB/PKCS1_V1_5 RSA/ECB/OAEP	The OAEP padding mode supports the following MD algorithms: SHA-256, SHA-384, and SHA-512.	8+	Yes
SM4/ECB/NoPadding SM4/ECB/PKCS7 SM4/CBC/PKCS7	IV is mandatory in CBC mode and is not recommended in ECB mode.	9+	No
SM4/CTR/NoPadding SM4/CBC/NoPadding SM4/CFB/NoPadding	IV is mandatory.	12+	Yes
SM4/OFB/NoPadding	Nonce is mandatory.	12+	Yes
SM2/-/NoPadding	SM3 is used as the MD algorithm.	11+	Yes
DES/CBC/NoPadding DES/ECB/NoPadding	IV is mandatory in CBC mode.	16+	Yes
3DES/CBC/NoPadding 3DES/ECB/NoPadding	IV is mandatory in CBC mode.	16+	Yes

Specifications for Mimi-System Devices

Before implementing the specifications for mini-system devices, determine whether your device supports the related specifications.

Algorithm/Cipher Mode/Padding Mode	Description	API Version
AES/GCM/NoPadding	Nonce is mandatory for encryption. Nonce and AEAD are mandatory for decryption.	8+
AES/CBC/NoPadding AES/CTR/NoPadding	IV is mandatory.	11+
DES/ECB/NoPadding	-	12+
DES/CBC/NoPadding	IV is mandatory.	12+
3DES/ECB/NoPadding	-	12+
3DES/CBC/NoPadding	IV is mandatory.	12+
RSA/ECB/NoPadding	-	12+
RSA/ECB/PKCS1_V1_5	-	12+
RSA/ECB/OAEP	SHA-256 is used as the MD algorithm.	12+