Skip to content

Commit 1c5ba6d

Browse files
sbisciglajewellamzseebees
committed
updates to the S3 Encryption Client
--------- Co-authored-by: Andy Jewell <ajewell@amazon.com> Co-authored-by: Ryan Emery <ryanemer@amazon.com>
1 parent 2051054 commit 1c5ba6d

File tree

24 files changed

+1968
-135
lines changed

24 files changed

+1968
-135
lines changed

‎src/aws-cpp-sdk-core/include/aws/core/utils/crypto/ContentCryptoMaterial.h‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ namespace Aws
3535
*/
3636
ContentCryptoMaterial(const Aws::Utils::CryptoBuffer& cek, ContentCryptoScheme contentCryptoScheme);
3737

38+
/*
39+
Initialize in the error state.
40+
*/
41+
ContentCryptoMaterial(const char * msg);
42+
3843
/**
3944
* Gets the underlying content encryption key.
4045
*/
@@ -59,6 +64,30 @@ namespace Aws
5964
return m_iv;
6065
}
6166

67+
/**
68+
* Gets the underlying encryption context
69+
*/
70+
inline const Aws::Map<Aws::String, Aws::String>& GetEncryptionContext() const
71+
{
72+
return m_encryptionContext;
73+
}
74+
75+
/**
76+
* Gets the underlying key commitment
77+
*/
78+
inline const Aws::Utils::CryptoBuffer& GetKeyCommitment() const
79+
{
80+
return m_keyCommitment;
81+
}
82+
83+
/**
84+
* Gets the underlying message ID
85+
*/
86+
inline const Aws::Utils::CryptoBuffer& GetMessageID() const
87+
{
88+
return m_messageId;
89+
}
90+
6291
/**
6392
* Gets the underlying crypto tag length
6493
*/
@@ -123,6 +152,43 @@ namespace Aws
123152
m_iv = iv;
124153
}
125154

155+
/**
156+
* Sets the underlying iv to 12 bytes of zero, as needed for V3 encoding
157+
*/
158+
inline void SetV3IV()
159+
{
160+
//= ../specification/s3-encryption/key-derivation.md#hkdf-operation
161+
//# When encrypting or decrypting with ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY, the IV used in the AES-GCM content encryption/decryption MUST consist entirely of bytes with the value 0x01.
162+
//# The IV's total length MUST match the IV length defined by the algorithm suite.
163+
unsigned char iv[12] = {0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01};
164+
CryptoBuffer iv2(&iv[0], 12);
165+
SetIV(iv2);
166+
}
167+
168+
/**
169+
* Sets the underlying encryption context. Copies from parameter encryptionContext.
170+
*/
171+
inline void SetEncryptionContext(const Aws::Map<Aws::String, Aws::String>& encryptionContext)
172+
{
173+
m_encryptionContext = encryptionContext;
174+
}
175+
176+
/**
177+
* Sets the underlying key commitment. Copies from parameter keyCommitment.
178+
*/
179+
inline void SetKeyCommitment(const Aws::Utils::CryptoBuffer& keyCommitment)
180+
{
181+
m_keyCommitment = keyCommitment;
182+
}
183+
184+
/**
185+
* Sets the underlying message ID. Copies from parameter messageId.
186+
*/
187+
inline void SetMessageID(const Aws::Utils::CryptoBuffer& messageId)
188+
{
189+
m_messageId = messageId;
190+
}
191+
126192
/**
127193
* Sets the underlying crypto Tag Length. Copies from parameter cryptoTagLength.
128194
*/
@@ -223,6 +289,28 @@ namespace Aws
223289
return m_finalCEK;
224290
}
225291

292+
//= ../specification/s3-encryption/key-derivation.md#hkdf-operation
293+
//= type=implication
294+
//# The client MUST set the AAD to the Algorithm Suite ID represented as bytes.
295+
296+
//= ../specification/s3-encryption/encryption.md#alg-aes-256-gcm-iv12-tag16-no-kdf
297+
//= type=implication
298+
//# The client MUST NOT provide any AAD when encrypting with ALG_AES_256_GCM_IV12_TAG16_NO_KDF.
299+
inline const Aws::Utils::CryptoBuffer GetAAD() const
300+
{
301+
if (m_contentCryptoScheme == ContentCryptoScheme::GCM_COMMIT) {
302+
// Algorithm Suite 0x0073 as bytes
303+
static const uint8_t gcmAAD[2] = {0, 0x73};
304+
return Aws::Utils::CryptoBuffer(gcmAAD, 2);
305+
} else {
306+
return Aws::Utils::CryptoBuffer();
307+
}
308+
}
309+
310+
inline bool Ok() const {return m_error.empty();}
311+
inline bool Fail() const {return !m_error.empty();}
312+
inline const Aws::String & Error() const {return m_error;}
313+
226314
private:
227315
Aws::Utils::CryptoBuffer m_contentEncryptionKey;
228316
Aws::Utils::CryptoBuffer m_encryptedContentEncryptionKey;
@@ -234,10 +322,14 @@ namespace Aws
234322
Aws::Utils::CryptoBuffer m_cekIV;
235323
Aws::Utils::CryptoBuffer m_gcmAAD;
236324
Aws::Utils::CryptoBuffer m_cekGCMTag;
325+
Aws::Map<Aws::String, Aws::String> m_encryptionContext;
326+
Aws::Utils::CryptoBuffer m_keyCommitment;
327+
Aws::Utils::CryptoBuffer m_messageId;
237328
size_t m_cryptoTagLength;
238329
Aws::Map<Aws::String, Aws::String> m_materialsDescription;
239330
KeyWrapAlgorithm m_keyWrapAlgorithm;
240331
ContentCryptoScheme m_contentCryptoScheme;
332+
Aws::String m_error;
241333
};
242334
}
243335
}

‎src/aws-cpp-sdk-core/include/aws/core/utils/crypto/ContentCryptoScheme.h‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,12 @@ namespace Aws
1717
CBC,
1818
CTR,
1919
GCM,
20+
GCM_COMMIT,
2021
NONE
2122
};
22-
23+
inline bool IsGCM(ContentCryptoScheme scheme) {
24+
return scheme == ContentCryptoScheme::GCM || scheme == ContentCryptoScheme::GCM_COMMIT;
25+
}
2326
namespace ContentCryptoSchemeMapper
2427
{
2528
AWS_CORE_API ContentCryptoScheme GetContentCryptoSchemeForName(const Aws::String& name);
@@ -29,4 +32,4 @@ namespace Aws
2932
} //namespace Crypto
3033

3134
}//namespace Utils
32-
}//namespace Aws
35+
}//namespace Aws

‎src/aws-cpp-sdk-core/source/utils/crypto/ContentCryptoMaterial.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@ namespace Aws
1818
{
1919
}
2020

21+
ContentCryptoMaterial::ContentCryptoMaterial(const char * msg) :
22+
m_cryptoTagLength(0), m_keyWrapAlgorithm(KeyWrapAlgorithm::NONE), m_contentCryptoScheme(ContentCryptoScheme::NONE),
23+
m_error(msg)
24+
{
25+
AWS_LOGSTREAM_ERROR("DataHandler", msg);
26+
}
27+
2128
ContentCryptoMaterial::ContentCryptoMaterial(ContentCryptoScheme contentCryptoScheme) :
2229
m_contentEncryptionKey(SymmetricCipher::GenerateKey()), m_cryptoTagLength(0), m_keyWrapAlgorithm(KeyWrapAlgorithm::NONE), m_contentCryptoScheme(contentCryptoScheme)
2330
{

‎src/aws-cpp-sdk-core/source/utils/crypto/ContentCryptoScheme.cpp‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ namespace Aws
2020
static const int cryptoScheme_CBC_HASH = HashingUtils::HashString("AES/CBC/PKCS5Padding");
2121
static const int cryptoScheme_CTR_HASH = HashingUtils::HashString("AES/CTR/NoPadding");
2222
static const int cryptoScheme_GCM_HASH = HashingUtils::HashString("AES/GCM/NoPadding");
23+
// "115" represents ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY (0x0073)
24+
static const int cryptoScheme_COMMIT_HASH = HashingUtils::HashString("115");
2325

2426
ContentCryptoScheme GetContentCryptoSchemeForName(const Aws::String& name)
2527
{
@@ -36,8 +38,12 @@ namespace Aws
3638
{
3739
return ContentCryptoScheme::GCM;
3840
}
39-
assert(0);
40-
return ContentCryptoScheme::NONE;
41+
else if (hashcode == cryptoScheme_COMMIT_HASH)
42+
{
43+
return ContentCryptoScheme::GCM_COMMIT;
44+
}
45+
// Return NONE for unrecognized schemes instead of asserting
46+
return ContentCryptoScheme::NONE;
4147
}
4248

4349
Aws::String GetNameForContentCryptoScheme(ContentCryptoScheme enumValue)
@@ -50,6 +56,8 @@ namespace Aws
5056
return "AES/CTR/NoPadding";
5157
case ContentCryptoScheme::GCM:
5258
return "AES/GCM/NoPadding";
59+
case ContentCryptoScheme::GCM_COMMIT:
60+
return "115";
5361
default:
5462
assert(0);
5563
return "";
@@ -58,4 +66,4 @@ namespace Aws
5866
}//namespace ContentCryptoSchemeMapper
5967
} //namespace Crypto
6068
}//namespace Utils
61-
}//namespace Aws
69+
}//namespace Aws

‎src/aws-cpp-sdk-core/source/utils/crypto/KeyWrapAlgorithm.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,12 @@ namespace Aws
3737
{
3838
return KeyWrapAlgorithm::AES_KEY_WRAP;
3939
}
40-
else if (hashcode == keyWrapAlgorithm_AES_GCM_HASH)
41-
{
42-
return KeyWrapAlgorithm::AES_GCM;
43-
}
44-
assert(0);
45-
return KeyWrapAlgorithm::NONE;
40+
else if (hashcode == keyWrapAlgorithm_AES_GCM_HASH)
41+
{
42+
return KeyWrapAlgorithm::AES_GCM;
43+
}
44+
// Return NONE for unrecognized algorithms instead of asserting
45+
return KeyWrapAlgorithm::NONE;
4646
}
4747

4848
Aws::String GetNameForKeyWrapAlgorithm(KeyWrapAlgorithm enumValue)

‎src/aws-cpp-sdk-s3-encryption/SUPPORT_POLICY.rst‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
Overview
2+
========
3+
This page describes the support policy for the S3EncryptionClient.
4+
We regularly provide the S3EncryptionClient with updates that may contain support for new or updated APIs, new features, enhancements, bug fixes, security patches, or documentation updates. Updates may also address changes with dependencies, and operating systems.
5+
6+
We recommend users to stay up-to-date with S3EncryptionClient to keep up with the latest features, security updates, and underlying dependencies. Continued use of an unsupported S3EncryptionClient version is not recommended and is done at the user’s discretion
7+
8+
9+
Major Version Lifecycle
10+
========================
11+
The S3 Encryption Client uses separately named classes for new major versions.
12+
13+
Version Support Matrix
14+
===============================
15+
This table describes the current support status of each major version of the S3EncryptionClient. It also shows the next status each major version will transition to, and the date at which that transition will happen.
16+
17+
.. list-table::
18+
:widths: 30 50 50
19+
:header-rows: 1
20+
21+
* - Major version
22+
- Current status
23+
- Next status
24+
* - S3EncryptionClient
25+
- End Of Support
26+
-
27+
* - S3EncryptionClientV2
28+
- Maintenance
29+
- End Of Support
30+
* - S3EncryptionClientV3
31+
- Generally Available
32+
-
33+
34+
.. _AWS SDKs and Tools Maintenance Policy: https://docs.aws.amazon.com/sdkref/latest/guide/maint-policy.html#version-life-cycle

0 commit comments

Comments
 (0)