Skip to content

Commit 0a8a581

Browse files
seebeesseebees
committed
feat!: Updates to the AWS Encryption SDK.
This change includes fixes for issues that were reported by Thai Duong from Google's Security team, and for issues that were identified by AWS Cryptography. BREAKING CHANGE: AWS KMS KeyIDs must be specified explicitly or Discovery mode explicitly chosen. Key committing suites are now default. CommitmentPolicy requires commitment by default. See: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/migration.html
1 parent 4469f3e commit 0a8a581

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+606
-405
lines changed

‎modules/client-browser/src/index.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import { buildEncrypt } from '@aws-crypto/encrypt-browser'
1616
import { buildDecrypt } from '@aws-crypto/decrypt-browser'
1717

1818
export function buildClient(
19-
commitmentPolicy: CommitmentPolicy
19+
commitmentPolicy: CommitmentPolicy = CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
2020
): ReturnType<typeof buildEncrypt> & ReturnType<typeof buildDecrypt> {
2121
return {
2222
...buildEncrypt(commitmentPolicy),

‎modules/client-node/src/index.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import { buildEncrypt } from '@aws-crypto/encrypt-node'
1515
import { buildDecrypt } from '@aws-crypto/decrypt-node'
1616

1717
export function buildClient(
18-
commitmentPolicy: CommitmentPolicy
18+
commitmentPolicy: CommitmentPolicy = CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
1919
): ReturnType<typeof buildEncrypt> & ReturnType<typeof buildDecrypt> {
2020
return {
2121
...buildEncrypt(commitmentPolicy),

‎modules/decrypt-browser/src/decrypt.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ export async function _decrypt(
6464
.map((i) => (i > 15 ? i.toString(16) : '0' + i.toString(16)))
6565
.join('')
6666

67-
/* The parsed header algorithmSuite in _decrypt must be supported by the commitmentPolicy. */
67+
/* Precondition: The parsed header algorithmSuite in _decrypt must be supported by the commitmentPolicy. */
6868
CommitmentPolicySuites.isDecryptEnabled(
6969
commitmentPolicy,
7070
algorithmSuite,
@@ -79,7 +79,7 @@ export async function _decrypt(
7979
encryptedDataKeys,
8080
})
8181

82-
/* The material algorithmSuite returned to _decrypt must be supported by the commitmentPolicy. */
82+
/* Precondition: The material algorithmSuite returned to _decrypt must be supported by the commitmentPolicy. */
8383
CommitmentPolicySuites.isDecryptEnabled(
8484
commitmentPolicy,
8585
material.suite,

‎modules/decrypt-browser/src/decrypt_client.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type CurryFirst<fn extends (...a: any[]) => any> = fn extends (
1515
: []
1616

1717
export function buildDecrypt(
18-
commitmentPolicy: CommitmentPolicy
18+
commitmentPolicy: CommitmentPolicy = CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
1919
): {
2020
decrypt: (...args: CurryFirst<typeof _decrypt>) => ReturnType<typeof _decrypt>
2121
} {

‎modules/decrypt-browser/src/index.ts

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,5 @@
11
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
import { CommitmentPolicy } from '@aws-crypto/material-management-browser'
5-
import { buildDecrypt } from './decrypt_client'
4+
export { buildDecrypt } from './decrypt_client'
65
export { MessageHeader } from '@aws-crypto/serialize'
7-
/** @deprecated Use `buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)` for migration. */
8-
export const { decrypt } = buildDecrypt(
9-
CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT
10-
)
11-
export { buildDecrypt }

‎modules/decrypt-browser/test/compatibility.test.ts

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
import * as chai from 'chai'
77
import chaiAsPromised from 'chai-as-promised'
8-
import { decrypt } from '../src/index'
8+
import { buildDecrypt } from '../src/index'
99
import {
1010
needs,
1111
importForWebCryptoDecryptionMaterial,
@@ -15,7 +15,10 @@ import {
1515
WebCryptoEncryptionMaterial,
1616
} from '@aws-crypto/material-management-browser'
1717
import * as fixtures from './fixtures'
18-
import { MessageFormat } from '@aws-crypto/material-management'
18+
import {
19+
CommitmentPolicy,
20+
MessageFormat,
21+
} from '@aws-crypto/material-management'
1922
import {
2023
KmsKeyringBrowser,
2124
KMS,
@@ -26,6 +29,8 @@ import { toUtf8 } from '@aws-sdk/util-utf8-browser'
2629
chai.use(chaiAsPromised)
2730
const { expect } = chai
2831

32+
const { decrypt } = buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
33+
2934
declare const credentials: {
3035
accessKeyId: string
3136
secretAccessKey: string

‎modules/decrypt-browser/test/decrypt.test.ts

Lines changed: 43 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
import * as chai from 'chai'
77
import chaiAsPromised from 'chai-as-promised'
8-
import { decrypt } from '../src/index'
8+
import { buildDecrypt } from '../src/index'
99
import { _decrypt } from '../src/decrypt'
1010
import {
1111
AlgorithmSuiteIdentifier,
@@ -16,9 +16,15 @@ import {
1616
WebCryptoEncryptionMaterial,
1717
} from '@aws-crypto/material-management-browser'
1818
import * as fixtures from './fixtures'
19-
import { MessageFormat } from '@aws-crypto/material-management'
19+
import {
20+
CommitmentPolicy,
21+
MessageFormat,
22+
WebCryptoAlgorithmSuite,
23+
} from '@aws-crypto/material-management'
24+
import { fromBase64 } from '@aws-sdk/util-base64-browser'
2025
chai.use(chaiAsPromised)
2126
const { expect } = chai
27+
const { decrypt } = buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
2228

2329
describe('decrypt', () => {
2430
it('buffer', async () => {
@@ -42,41 +48,41 @@ describe('decrypt', () => {
4248
).to.rejectedWith(Error, 'Invalid commitment policy.')
4349
})
4450

45-
// it('The parsed header algorithmSuite in _decrypt must be supported by the commitmentPolicy.', async () => {
46-
// await expect(
47-
// _decrypt(
48-
// CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT,
49-
// fixtures.decryptKeyring(),
50-
// fixtures.base64CiphertextAlgAes256GcmIv12Tag16HkdfSha384EcdsaP384With4Frames()
51-
// )
52-
// ).to.rejectedWith(
53-
// Error,
54-
// 'Configuration conflict. Cannot process message with ID'
55-
// )
56-
// })
57-
58-
// it('The material algorithmSuite returned to _decrypt must be supported by the commitmentPolicy.', async () => {
59-
// const cmm = {
60-
// async decryptMaterials() {
61-
// return new WebCryptoDecryptionMaterial(
62-
// new WebCryptoAlgorithmSuite(
63-
// AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384
64-
// ),
65-
// {}
66-
// )
67-
// },
68-
// } as any
69-
// await expect(
70-
// _decrypt(
71-
// CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT,
72-
// cmm,
73-
// fromBase64(fixtures.compatibilityVectors().tests[0].ciphertext)
74-
// )
75-
// ).to.rejectedWith(
76-
// Error,
77-
// 'Configuration conflict. Cannot process message with ID'
78-
// )
79-
// })
51+
it('Precondition: The parsed header algorithmSuite in _decrypt must be supported by the commitmentPolicy.', async () => {
52+
await expect(
53+
_decrypt(
54+
CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT,
55+
fixtures.decryptKeyring(),
56+
fixtures.base64CiphertextAlgAes256GcmIv12Tag16HkdfSha384EcdsaP384With4Frames()
57+
)
58+
).to.rejectedWith(
59+
Error,
60+
'Configuration conflict. Cannot process message with ID'
61+
)
62+
})
63+
64+
it('Precondition: The material algorithmSuite returned to _decrypt must be supported by the commitmentPolicy.', async () => {
65+
const cmm = {
66+
async decryptMaterials() {
67+
return new WebCryptoDecryptionMaterial(
68+
new WebCryptoAlgorithmSuite(
69+
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384
70+
),
71+
{}
72+
)
73+
},
74+
} as any
75+
await expect(
76+
_decrypt(
77+
CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT,
78+
cmm,
79+
fromBase64(fixtures.compatibilityVectors().tests[0].ciphertext)
80+
)
81+
).to.rejectedWith(
82+
Error,
83+
'Configuration conflict. Cannot process message with ID'
84+
)
85+
})
8086

8187
it('Precondition: The sequenceNumber is required to monotonically increase, starting from 1.', async () => {
8288
return decrypt(

‎modules/decrypt-node/src/decrypt_client.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ type CurryFirst<fn extends (...a: any[]) => any> = fn extends (
1313
: never
1414

1515
export function buildDecrypt(
16-
commitmentPolicy: CommitmentPolicy
16+
commitmentPolicy: CommitmentPolicy = CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
1717
): {
1818
decryptStream: (
1919
...args: CurryFirst<typeof _decryptStream>

‎modules/decrypt-node/src/index.ts

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,5 @@
11
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
3-
import { CommitmentPolicy } from '@aws-crypto/material-management-node'
4-
import { buildDecrypt } from './decrypt_client'
3+
4+
export { buildDecrypt } from './decrypt_client'
55
export { MessageHeader } from '@aws-crypto/serialize'
6-
import { deprecate } from 'util'
7-
const { decrypt: decryptTmp, decryptStream: decryptStreamTmp } = buildDecrypt(
8-
CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT
9-
)
10-
/** @deprecated Use `buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)` for migration. */
11-
const decrypt = deprecate(
12-
decryptTmp,
13-
'Use `buildClient(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)` for migration. See: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/troubleshooting-migration.html'
14-
)
15-
/** @deprecated Use `buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)` for migration. */
16-
const decryptStream = deprecate(
17-
decryptStreamTmp,
18-
'Use `buildClient(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)` for migration. See: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/troubleshooting-migration.html'
19-
)
20-
export { decrypt, decryptStream }
21-
export { buildDecrypt }

‎modules/decrypt-node/src/parse_header_stream.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ export class ParseHeaderStream extends PortableTransformWithType {
6767

6868
const { messageHeader, algorithmSuite } = headerInfo
6969
const messageIDStr = Buffer.from(messageHeader.messageId).toString('hex')
70-
/* The parsed header algorithmSuite from ParseHeaderStream must be supported by the commitmentPolicy. */
70+
/* Precondition: The parsed header algorithmSuite from ParseHeaderStream must be supported by the commitmentPolicy. */
7171
CommitmentPolicySuites.isDecryptEnabled(
7272
commitmentPolicy,
7373
algorithmSuite,
@@ -83,7 +83,7 @@ export class ParseHeaderStream extends PortableTransformWithType {
8383
materialsManager
8484
.decryptMaterials({ suite, encryptionContext, encryptedDataKeys })
8585
.then((material) => {
86-
/* The material algorithmSuite returned to ParseHeaderStream must be supported by the commitmentPolicy. */
86+
/* Precondition: The material algorithmSuite returned to ParseHeaderStream must be supported by the commitmentPolicy. */
8787
CommitmentPolicySuites.isDecryptEnabled(
8888
commitmentPolicy,
8989
material.suite,

‎modules/decrypt-node/test/compatibility.test.ts

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,20 @@ import {
1111
NodeDecryptionMaterial,
1212
NodeEncryptionMaterial,
1313
} from '@aws-crypto/material-management-node'
14-
import { decrypt } from '../src/index'
14+
import { buildDecrypt } from '../src/index'
1515
import * as fixtures from './fixtures'
1616
chai.use(chaiAsPromised)
1717
const { expect } = chai
18-
import { MessageFormat, needs } from '@aws-crypto/material-management'
18+
import {
19+
CommitmentPolicy,
20+
MessageFormat,
21+
needs,
22+
} from '@aws-crypto/material-management'
1923

2024
import { KmsKeyringNode } from '@aws-crypto/kms-keyring-node'
2125

26+
const { decrypt } = buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
27+
2228
describe('committing algorithm test', () => {
2329
fixtures.compatibilityVectors().tests.forEach((test) => {
2430
it(test.comment, async () => {

‎modules/decrypt-node/test/decrypt.test.ts

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,16 @@
55

66
import * as chai from 'chai'
77
import chaiAsPromised from 'chai-as-promised'
8-
import { AlgorithmSuiteIdentifier } from '@aws-crypto/material-management-node'
9-
import { decrypt } from '../src/index'
8+
import {
9+
AlgorithmSuiteIdentifier,
10+
CommitmentPolicy,
11+
} from '@aws-crypto/material-management-node'
12+
import { buildDecrypt } from '../src/index'
1013
import * as fixtures from './fixtures'
1114
chai.use(chaiAsPromised)
1215
const { expect } = chai
1316
import from from 'from2'
17+
const { decrypt } = buildDecrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
1418

1519
describe('decrypt', () => {
1620
it('string with encoding', async () => {

‎modules/decrypt-node/test/parse_header_stream.test.ts

Lines changed: 41 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ import * as stream from 'stream'
1010
const pipeline = util.promisify(stream.pipeline)
1111
import { ParseHeaderStream } from '../src/parse_header_stream'
1212
import {
13+
NodeAlgorithmSuite,
14+
NodeDecryptionMaterial,
15+
AlgorithmSuiteIdentifier,
1316
NodeDefaultCryptographicMaterialsManager,
1417
needs,
1518
} from '@aws-crypto/material-management-node'
@@ -37,40 +40,48 @@ describe('ParseHeaderStream', () => {
3740
)
3841
})
3942

40-
// it('The parsed header algorithmSuite from ParseHeaderStream must be supported by the commitmentPolicy.', async () => {
41-
// const cmm = new NodeDefaultCryptographicMaterialsManager(
42-
// fixtures.decryptKeyring()
43-
// )
44-
// const data = Buffer.from(
45-
// fixtures.base64Ciphertext4BytesWith4KFrameLength(),
46-
// 'base64'
47-
// )
43+
it('Precondition: The parsed header algorithmSuite from ParseHeaderStream must be supported by the commitmentPolicy.', async () => {
44+
const cmm = new NodeDefaultCryptographicMaterialsManager(
45+
fixtures.decryptKeyring()
46+
)
47+
const data = Buffer.from(
48+
fixtures.base64Ciphertext4BytesWith4KFrameLength(),
49+
'base64'
50+
)
4851

49-
// await expect(
50-
// testStream(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT, cmm, data)
51-
// ).to.rejectedWith(Error, 'Configuration conflict. Cannot process message with ID')
52-
// })
52+
await expect(
53+
testStream(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT, cmm, data)
54+
).to.rejectedWith(
55+
Error,
56+
'Configuration conflict. Cannot process message with ID'
57+
)
58+
})
5359

54-
// it('The material algorithmSuite returned to ParseHeaderStream must be supported by the commitmentPolicy.', async () => {
55-
// let called_decryptMaterials = false
56-
// const cmm = {
57-
// async decryptMaterials() {
58-
// called_decryptMaterials = true
59-
// const suite = new NodeAlgorithmSuite(AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384)
60-
// return new NodeDecryptionMaterial(suite, {})
61-
// }
62-
// } as any
63-
// const data = Buffer.from(
64-
// fixtures.compatibilityVectors().tests[0].ciphertext,
65-
// 'base64'
66-
// )
60+
it('Precondition: The material algorithmSuite returned to ParseHeaderStream must be supported by the commitmentPolicy.', async () => {
61+
let called_decryptMaterials = false
62+
const cmm = {
63+
async decryptMaterials() {
64+
called_decryptMaterials = true
65+
const suite = new NodeAlgorithmSuite(
66+
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384
67+
)
68+
return new NodeDecryptionMaterial(suite, {})
69+
},
70+
} as any
71+
const data = Buffer.from(
72+
fixtures.compatibilityVectors().tests[0].ciphertext,
73+
'base64'
74+
)
6775

68-
// await expect(
69-
// testStream(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT, cmm, data)
70-
// ).to.rejectedWith(Error, 'Configuration conflict. Cannot process message with ID')
76+
await expect(
77+
testStream(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT, cmm, data)
78+
).to.rejectedWith(
79+
Error,
80+
'Configuration conflict. Cannot process message with ID'
81+
)
7182

72-
// expect(called_decryptMaterials).to.equal(true)
73-
// })
83+
expect(called_decryptMaterials).to.equal(true)
84+
})
7485

7586
it('Postcondition: A completed header MUST have been processed.', async () => {
7687
const completeHeaderLength = 73

‎modules/encrypt-browser/src/encrypt_client.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type CurryFirst<fn extends (...a: any[]) => any> = fn extends (
1515
: []
1616

1717
export function buildEncrypt(
18-
commitmentPolicy: CommitmentPolicy
18+
commitmentPolicy: CommitmentPolicy = CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
1919
): {
2020
encrypt: (...args: CurryFirst<typeof _encrypt>) => ReturnType<typeof _encrypt>
2121
} {

‎modules/encrypt-browser/src/index.ts

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
11
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
import { CommitmentPolicy } from '@aws-crypto/material-management-browser'
5-
import { buildEncrypt } from './encrypt_client'
4+
export { buildEncrypt } from './encrypt_client'
65
export { MessageHeader } from '@aws-crypto/serialize'
7-
8-
/** @deprecated Use `buildEncrypt(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)` for migration. */
9-
export const { encrypt } = buildEncrypt(
10-
CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT
11-
)
12-
13-
export { buildEncrypt }

0 commit comments

Comments
 (0)