Skip to content

Commit cc79bc1

Browse files
seebeesseebees
authored
fix!: Remove Keyring Trace (aws#402)
resolves: aws#351 As outlined the intention of the keyring trace is better satisfied by constructing correct keyrings and CMMs. BREAKING CHANGE: - Remove trace from all cryptographic materials. - Remove KeyringTrace exports
1 parent f0b58dc commit cc79bc1

31 files changed

+303
-1550
lines changed

‎modules/cache-material/test/caching_cryptographic_materials_decorators.test.ts

Lines changed: 11 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ import { createHash } from 'crypto'
1717
import {
1818
NodeAlgorithmSuite,
1919
AlgorithmSuiteIdentifier,
20-
KeyringTraceFlag,
2120
EncryptedDataKey,
2221
NodeEncryptionMaterial,
2322
NodeDecryptionMaterial,
@@ -202,37 +201,22 @@ describe('Cryptographic Material Functions', () => {
202201
15,
203202
16,
204203
])
205-
const encryptTrace = {
206-
keyNamespace: 'keyNamespace',
207-
keyName: 'keyName',
208-
flags: KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY,
209-
}
210-
const decryptTrace = {
211-
keyNamespace: 'keyNamespace',
212-
keyName: 'keyName',
213-
flags: KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY,
214-
}
215204

216205
const edk1 = new EncryptedDataKey({
217206
providerId: 'keyNamespace',
218207
providerInfo: 'keyName',
219208
encryptedDataKey: new Uint8Array([1]),
220209
})
221-
const edk2 = new EncryptedDataKey({
222-
providerId: 'p2',
223-
providerInfo: 'pi2',
224-
encryptedDataKey: new Uint8Array([2]),
225-
})
226210

227-
const encryptionMaterial = new NodeEncryptionMaterial(nodeSuite, {})
228-
.setUnencryptedDataKey(udk128, encryptTrace)
229-
.addEncryptedDataKey(edk1, KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY)
230-
.addEncryptedDataKey(edk2, KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY)
211+
const encryptionMaterial = new NodeEncryptionMaterial(
212+
nodeSuite,
213+
{}
214+
).setUnencryptedDataKey(udk128)
231215

232216
const decryptionMaterial = new NodeDecryptionMaterial(
233217
nodeSuite,
234218
{}
235-
).setUnencryptedDataKey(udk128, decryptTrace)
219+
).setUnencryptedDataKey(udk128)
236220

237221
const context = {}
238222

@@ -392,11 +376,6 @@ describe('Cryptographic Material Functions', () => {
392376
15,
393377
16,
394378
])
395-
const encryptTrace = {
396-
keyNamespace: 'keyNamespace',
397-
keyName: 'keyName',
398-
flags: KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY,
399-
}
400379

401380
const edk1 = new EncryptedDataKey({
402381
providerId: 'keyNamespace',
@@ -410,15 +389,9 @@ describe('Cryptographic Material Functions', () => {
410389
})
411390

412391
const encryptionMaterial = new NodeEncryptionMaterial(nodeSuite, {})
413-
.setUnencryptedDataKey(udk128, encryptTrace)
414-
.addEncryptedDataKey(
415-
edk1,
416-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
417-
)
418-
.addEncryptedDataKey(
419-
edk2,
420-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
421-
)
392+
.setUnencryptedDataKey(udk128)
393+
.addEncryptedDataKey(edk1)
394+
.addEncryptedDataKey(edk2)
422395

423396
const testCMM = {
424397
_partition,
@@ -482,11 +455,6 @@ describe('Cryptographic Material Functions', () => {
482455
15,
483456
16,
484457
])
485-
const encryptTrace = {
486-
keyNamespace: 'keyNamespace',
487-
keyName: 'keyName',
488-
flags: KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY,
489-
}
490458

491459
const edk1 = new EncryptedDataKey({
492460
providerId: 'keyNamespace',
@@ -500,15 +468,9 @@ describe('Cryptographic Material Functions', () => {
500468
})
501469

502470
const encryptionMaterial = new NodeEncryptionMaterial(nodeSuite, {})
503-
.setUnencryptedDataKey(udk128, encryptTrace)
504-
.addEncryptedDataKey(
505-
edk1,
506-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
507-
)
508-
.addEncryptedDataKey(
509-
edk2,
510-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
511-
)
471+
.setUnencryptedDataKey(udk128)
472+
.addEncryptedDataKey(edk1)
473+
.addEncryptedDataKey(edk2)
512474

513475
const testCMM = {
514476
_partition,

‎modules/decrypt-browser/test/fixtures.ts

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import {
77
WebCryptoDecryptionMaterial,
88
WebCryptoEncryptionMaterial,
99
KeyringWebCrypto,
10-
KeyringTraceFlag,
1110
importForWebCryptoDecryptionMaterial,
1211
} from '@aws-crypto/material-management-browser'
1312

@@ -6359,13 +6358,8 @@ class TestKeyring extends KeyringWebCrypto {
63596358
const unencryptedDataKey = new Uint8Array(
63606359
material.suite.keyLengthBytes
63616360
).fill(0)
6362-
const trace = {
6363-
keyNamespace: 'k',
6364-
keyName: 'k',
6365-
flags: KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY,
6366-
}
63676361
return importForWebCryptoDecryptionMaterial(
6368-
material.setUnencryptedDataKey(unencryptedDataKey, trace)
6362+
material.setUnencryptedDataKey(unencryptedDataKey)
63696363
)
63706364
}
63716365
}

‎modules/decrypt-node/test/fixtures.ts

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import {
77
NodeDecryptionMaterial,
88
NodeEncryptionMaterial,
99
KeyringNode,
10-
KeyringTraceFlag,
1110
} from '@aws-crypto/material-management-node'
1211

1312
export function base64CiphertextAlgAes256GcmIv12Tag16HkdfSha384EcdsaP384() {
@@ -71,12 +70,8 @@ export function decryptKeyring() {
7170
const unencryptedDataKey = new Uint8Array(
7271
material.suite.keyLengthBytes
7372
).fill(0)
74-
const trace = {
75-
keyNamespace: 'k',
76-
keyName: 'k',
77-
flags: KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY,
78-
}
79-
return material.setUnencryptedDataKey(unencryptedDataKey, trace)
73+
74+
return material.setUnencryptedDataKey(unencryptedDataKey)
8075
}
8176
}
8277

‎modules/encrypt-browser/test/encrypt.test.ts

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import {
1010
WebCryptoEncryptionMaterial,
1111
KeyringWebCrypto,
1212
EncryptedDataKey,
13-
KeyringTraceFlag,
1413
WebCryptoAlgorithmSuite,
1514
importForWebCryptoEncryptionMaterial,
1615
} from '@aws-crypto/material-management-browser'
@@ -50,17 +49,10 @@ describe('encrypt structural testing', () => {
5049
const unencryptedDataKey = new Uint8Array(
5150
material.suite.keyLengthBytes
5251
).fill(0)
53-
const trace = {
54-
keyNamespace: 'k',
55-
keyName: 'k',
56-
flags: KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY,
57-
}
52+
5853
material
59-
.setUnencryptedDataKey(unencryptedDataKey, trace)
60-
.addEncryptedDataKey(
61-
edk,
62-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
63-
)
54+
.setUnencryptedDataKey(unencryptedDataKey)
55+
.addEncryptedDataKey(edk)
6456
return importForWebCryptoEncryptionMaterial(material)
6557
}
6658
async _onDecrypt(): Promise<WebCryptoDecryptionMaterial> {

‎modules/encrypt-node/test/encrypt.test.ts

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import {
1010
NodeEncryptionMaterial,
1111
KeyringNode,
1212
EncryptedDataKey,
13-
KeyringTraceFlag,
1413
AlgorithmSuiteIdentifier,
1514
NodeAlgorithmSuite,
1615
} from '@aws-crypto/material-management-node'
@@ -56,17 +55,10 @@ describe('encrypt structural testing', () => {
5655
const unencryptedDataKey = new Uint8Array(
5756
material.suite.keyLengthBytes
5857
).fill(0)
59-
const trace = {
60-
keyNamespace: 'k',
61-
keyName: 'k',
62-
flags: KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY,
63-
}
58+
6459
return material
65-
.setUnencryptedDataKey(unencryptedDataKey, trace)
66-
.addEncryptedDataKey(
67-
edk,
68-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
69-
)
60+
.setUnencryptedDataKey(unencryptedDataKey)
61+
.addEncryptedDataKey(edk)
7062
}
7163
async _onDecrypt(): Promise<NodeDecryptionMaterial> {
7264
throw new Error('I should never see this error')

‎modules/kms-keyring/src/kms_keyring.ts

Lines changed: 4 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@ import {
99
EncryptionMaterial,
1010
DecryptionMaterial,
1111
SupportedAlgorithmSuites,
12-
KeyringTrace,
13-
KeyringTraceFlag,
1412
EncryptedDataKey,
1513
immutableClass,
1614
readOnlyProperty,
@@ -136,26 +134,12 @@ export function KmsKeyringClass<
136134
if (!dataKey)
137135
throw new Error('Generator KMS key did not generate a data key')
138136

139-
const flags =
140-
KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY |
141-
KeyringTraceFlag.WRAPPING_KEY_SIGNED_ENC_CTX |
142-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
143-
const trace: KeyringTrace = {
144-
keyNamespace: KMS_PROVIDER_ID,
145-
keyName: dataKey.KeyId,
146-
flags,
147-
}
148-
149137
material
150138
/* Postcondition: The generated unencryptedDataKey length must match the algorithm specification.
151139
* See cryptographic_materials as setUnencryptedDataKey will throw in this case.
152140
*/
153-
.setUnencryptedDataKey(dataKey.Plaintext, trace)
154-
.addEncryptedDataKey(
155-
kmsResponseToEncryptedDataKey(dataKey),
156-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY |
157-
KeyringTraceFlag.WRAPPING_KEY_SIGNED_ENC_CTX
158-
)
141+
.setUnencryptedDataKey(dataKey.Plaintext)
142+
.addEncryptedDataKey(kmsResponseToEncryptedDataKey(dataKey))
159143
} else if (generatorKeyId) {
160144
keyIds.unshift(generatorKeyId)
161145
}
@@ -166,9 +150,6 @@ export function KmsKeyringClass<
166150
*/
167151
const unencryptedDataKey = unwrapDataKey(material.getUnencryptedDataKey())
168152

169-
const flags =
170-
KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY |
171-
KeyringTraceFlag.WRAPPING_KEY_SIGNED_ENC_CTX
172153
for (const kmsKey of keyIds) {
173154
const kmsEDK = await encrypt(
174155
clientProvider,
@@ -180,10 +161,7 @@ export function KmsKeyringClass<
180161

181162
/* clientProvider may not return a client, in this case there is not an EDK to add */
182163
if (kmsEDK)
183-
material.addEncryptedDataKey(
184-
kmsResponseToEncryptedDataKey(kmsEDK),
185-
flags
186-
)
164+
material.addEncryptedDataKey(kmsResponseToEncryptedDataKey(kmsEDK))
187165
}
188166

189167
return material
@@ -241,19 +219,10 @@ export function KmsKeyringClass<
241219
'KMS Decryption key does not match serialized provider.'
242220
)
243221

244-
const flags =
245-
KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY |
246-
KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX
247-
const trace: KeyringTrace = {
248-
keyNamespace: KMS_PROVIDER_ID,
249-
keyName: dataKey.KeyId,
250-
flags,
251-
}
252-
253222
/* Postcondition: The decrypted unencryptedDataKey length must match the algorithm specification.
254223
* See cryptographic_materials as setUnencryptedDataKey will throw in this case.
255224
*/
256-
material.setUnencryptedDataKey(dataKey.Plaintext, trace)
225+
material.setUnencryptedDataKey(dataKey.Plaintext)
257226
return material
258227
}
259228

‎modules/kms-keyring/test/kms_keyring.ondecrypt.test.ts

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ import { KmsKeyringClass, KeyRingConstructible } from '../src/kms_keyring'
99
import {
1010
NodeAlgorithmSuite,
1111
AlgorithmSuiteIdentifier,
12-
KeyringTraceFlag,
1312
NodeDecryptionMaterial,
1413
EncryptedDataKey,
1514
Keyring,
@@ -68,17 +67,6 @@ describe('KmsKeyring: _onDecrypt', () => {
6867
)
6968

7069
expect(material.hasUnencryptedDataKey).to.equal(true)
71-
72-
expect(material.keyringTrace).to.have.lengthOf(1)
73-
const [traceDecrypt] = material.keyringTrace
74-
expect(traceDecrypt.keyNamespace).to.equal('aws-kms')
75-
expect(traceDecrypt.keyName).to.equal(generatorKeyId)
76-
expect(
77-
traceDecrypt.flags & KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY
78-
).to.equal(KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY)
79-
expect(
80-
traceDecrypt.flags & KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX
81-
).to.equal(KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX)
8270
})
8371

8472
it('discovery keyring should return material', async () => {
@@ -128,17 +116,6 @@ describe('KmsKeyring: _onDecrypt', () => {
128116
)
129117

130118
expect(material.hasUnencryptedDataKey).to.equal(true)
131-
132-
expect(material.keyringTrace).to.have.lengthOf(1)
133-
const [traceDecrypt] = material.keyringTrace
134-
expect(traceDecrypt.keyNamespace).to.equal('aws-kms')
135-
expect(traceDecrypt.keyName).to.equal(generatorKeyId)
136-
expect(
137-
traceDecrypt.flags & KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY
138-
).to.equal(KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY)
139-
expect(
140-
traceDecrypt.flags & KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX
141-
).to.equal(KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX)
142119
})
143120

144121
it('decrypt errors should not halt', async () => {
@@ -193,7 +170,6 @@ describe('KmsKeyring: _onDecrypt', () => {
193170
)
194171

195172
expect(material.hasUnencryptedDataKey).to.equal(true)
196-
expect(material.keyringTrace).to.have.lengthOf(1)
197173
})
198174

199175
it('Check for early return (Postcondition): clientProvider may not return a client.', async () => {
@@ -232,7 +208,6 @@ describe('KmsKeyring: _onDecrypt', () => {
232208
)
233209

234210
expect(material.hasUnencryptedDataKey).to.equal(false)
235-
expect(material.keyringTrace).to.have.lengthOf(0)
236211
})
237212

238213
it('Postcondition: The KeyId from KMS must match the encoded KeyID.', async () => {

0 commit comments

Comments
 (0)