Trying to encyption file upload cloud storage through the curl

Question

Please help me I am using curl file encrypt upload in cloud storage but file is not uploaded , but when I am trying to upload without encryption key and hash key then file gets uploaded successfully please solve this problem.

curl -X POST --data-binary @OBJECT\
         -H "Authorization: Bearer ya12.a0ARrdaM8ZPiR_ukSDNO_VPYAJa2W2O67Ds91CKwwLGnWU1DTZF02K237YsXFCqePCi3xSgD0s_cvhIIc_474-Y3h0bDZof69K0snlOAYlwwQw1fBM2QrBUQRKsQOZj1qHILgcZOxptqBxp0e8mx" \
         -H "Content-Type: image/jpg" \
         -H "x-goog-encryption-algorithm: AES256" \
         -H "x-goog-encryption-key: NSOgD4929vFoA8zawwmkuaizAdtdydWGQRuOeZID+GY=" \
         -H "x-goog-encryption-key-sha256:ca2f7dac23426d0ba16911be8911f9b71b1fa7f9ecc53ac87100932677d92319" \
            "https://storage.googleapis.com/upload/storage/v1/b/bucketName/o?uploadType=media&name=1.jpg"

Note: I am generating encryption key base64 in php and hash the key

$key = random_bytes(32);
$encodedKey = base64_encode($key);
$hash = hash('SHA256',$key);

I am getting this error

error": {
"code": 400,
"message": "Missing an encryption key, or it is not base64 encoded, or it does not meet the required length of the encryption algorithm.", "message": "Missing an encryption key, or it is not base64 encoded, or it does not meet the required length of the encryption algorithm."

Answer 1

Both x-goog-encryption-key and x-goog-encryption-key should be base64 encoded.

Based on the code in PHP you probably use the encryption key that is base64 encoded (that is OK), but the hash is not base64 encoded.

Try encode the hash at the end of the PHP, with:

base64-hash=base64_encode(hash)

More detail can be found here: https://cloud.google.com/storage/docs/encryption/customer-supplied-keys

Quote: Include the following HTTP headers in your JSON or XML request:

x-goog-encryption-algorithm string  The encryption algorithm to use. You must use the value AES256.
x-goog-encryption-key   string  An RFC 4648 Base64-encoded string of your AES-256 encryption key.
x-goog-encryption-key-sha256    string  An RFC 4648 Base64-encoded string of the SHA256 hash of your encryption key.