You can use the keys in HUKS to encrypt or decrypt data.
The Group Key feature is supported since API version 23.
The following table lists the supported specifications for key encryption and decryption.
Specifications for mobile phones, tablets, PCs/2-in-1 devices, TVs, and wearables
| Algorithm/Cipher Mode/Padding Mode | Description | API Version |
|---|---|---|
AES/CBC/NoPadding AES/CBC/PKCS7 AES/CTR/NoPadding | IV is mandatory. In CBC mode, the data length should be a multiple of the block size used by the encryption algorithm. If the padding mode is NoPadding and the length of the input data is not a multiple of 16 bytes, the service side must pad the input data to the required length. | 8+ |
| AES/GCM/NoPadding | Encryption: NONCE and AAD are optional. If the NONCE parameter is not specified, data is returned in the format of "Ciphertext + AEAD + NONCE". The length of AEAD is 16, and the default length of NONCE is 12. Decryption: AAD is optional, but NONCE and AEAD are mandatory. | 8+ |
| AES/CCM/NoPadding | Encryption: NONCE and AAD are optional. If the NONCE parameter is not specified, data is returned in the format of "Ciphertext + AEAD + NONCE". The default length of AEAD is 16, and the default length of NONCE is 7. Decryption: AAD is optional, but NONCE and AEAD are mandatory. You can set the length of AEAD to 4, 6, 8, 10, 12, 14, or 16. | 22+ |
RSA/ECB/NoPadding RSA/ECB/PKCS1_V1_5 RSA/ECB/OAEP | The OAEP padding mode supports the following MD algorithms: SHA-256, SHA-384, and SHA-512. | 8+ |
| SM4/ECB/PKCS7 | The ECB mode is not recommended. | 20+ |
| SM4/CBC/PKCS7 | IV is mandatory. | 9+ |
SM4/CTR/NoPadding SM4/CBC/NoPadding SM4/CFB/NoPadding SM4/OFB/NoPadding | IV is mandatory. | 12+ |
| SM2/-/NoPadding | SM3 is used as the MD algorithm. | 11+ |
DES/CBC/NoPadding DES/ECB/NoPadding | The IV parameter is mandatory in CBC mode. | 18+ |
3DES/CBC/NoPadding 3DES/ECB/NoPadding | The IV parameter is mandatory in CBC mode. | 18+ |
Specifications for lite wearables
| Algorithm/Cipher Mode/Padding Mode | Description | API Version |
|---|---|---|
| AES/GCM/NoPadding | Encryption: NONCE and AAD are optional. If the NONCE parameter is not specified, data is returned in the format of "Ciphertext + AEAD + NONCE". The length of AEAD is 16, and the default length of NONCE is 12. Decryption: AAD is optional, but NONCE and AEAD are mandatory. | 8+ |
AES/CBC/NoPadding AES/CTR/NoPadding | IV is mandatory. | 11+ |
| DES/ECB/NoPadding | - | 12+ |
| DES/CBC/NoPadding | IV is mandatory. | 12+ |
| 3DES/ECB/NoPadding | - | 12+ |
| 3DES/CBC/NoPadding | IV is mandatory. | 12+ |
| RSA/ECB/NoPadding | - | 12+ |
| RSA/ECB/PKCS1_V1_5 | - | 12+ |
| RSA/ECB/OAEP | SHA-256 is used as the MD algorithm. | 12+ |