Converts encrypted data (a binary byte stream) to its original source format, and returns a MEMPTR containing the decrypted data.

You must use the same cryptographic algorithm, initialization vector, and encryption key values to encrypt and decrypt the same data instance.

Syntax

DECRYPT ( data-to-decrypt [ , encrypt-key [ , iv-value [ , algorithm 
    [, tag [, aad ] ] ]]] )
Note: The tag and aad parameters are applicable only to the AES_GCM_128, AES_GCM_192 and AES_GCM_256 encryption algorithms. They are not applicable to other supported encryption algorithms.
data-to-decrypt
The encrypted data to decrypt. The value may be of type RAW or MEMPTR.
encrypt-key
An optional RAW expression that evaluates to the encryption key (a binary value) originally used to encrypt the specified data. If you specify the Unknown value (?), the current value of the SYMMETRIC-ENCRYPTION-KEY attribute is used. If the value of the SYMMETRIC-ENCRYPTION-KEY attribute is also the Unknown value (?), the AVM generates a run-time error.

The AVM compares the size of the specified encryption key to the key size specified by the cryptographic algorithm. If the key sizes are inconsistent, the AVM generates a run-time error.

You can use the GENERATE-PBE-KEY function to regenerate the same encryption key originally used to encrypt the specified data as long as you specify the same password string, hash algorithm, number of iterations, and salt value.

Note: Do not use the GENERATE-RANDOM-KEY function to generate this encryption key. The random key it generates will always be different than the key originally used to encrypt the specified data.

You are responsible for generating, storing, and transporting this value.

iv-value
An optional RAW expression that evaluates to the initialization vector value to use with the specified encryption key in the original encryption operation. If you specify the Unknown value (?), the current value of the SYMMETRIC-ENCRYPTION-IV attribute is used.
algorithm
An optional CHARACTER expression that evaluates to the name of the symmetric cryptographic algorithm originally used to encrypt the specified data instance. If you specify the Unknown value (?), the current value of the SYMMETRIC-ENCRYPTION-ALGORITHM attribute is used.

For a list the supported cryptographic algorithms, see the SYMMETRIC-SUPPORT attribute reference entry.

tag (Authentication Tag)
For AES_GCM encryption, a mandatory MEMPTR expression of a cryptographic checksum generated on unencrypted data and additional authenticated data. It is designed to reveal both accidental errors and the intentional modification of the data.
aad (Additional Authenticated Data)
For AES_GCM encryption, an optional RAW expression of input data that is authenticated but not encrypted.

See also

ENCRYPT function, SECURITY-POLICY system handle