Skip to content

Commit c43d706

Browse files
alex-chewalex-chew
committed
feat!: Updates to the AWS Encryption SDK
This change includes fixes for issues that were reported by Thai Duong from Google's Security team, and for issues that were identified by AWS Cryptography. See: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/migration.html BREAKING CHANGE: AWS KMS KeyIDs must be specified explicitly or Discovery mode explicitly chosen. Key committing suites are now default. CommitmentPolicy requires commitment by default.
1 parent 4ed2df0 commit c43d706

34 files changed

+2292
-754
lines changed

‎CMakeLists.txt

+2-3
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ include(FindOpenSSL)
4949
set(PROJECT_NAME aws-encryption-sdk)
5050

5151
# Version number of the SDK to be consumed by C code and Doxygen
52-
set(MAJOR 1)
53-
set(MINOR 7)
52+
set(MAJOR 2)
53+
set(MINOR 0)
5454
set(PATCH 0)
5555

5656
# Compiler feature tests and feature flags
@@ -161,7 +161,6 @@ target_link_libraries(aws-encryption-sdk-test PRIVATE ${PLATFORM_LIBS} ${OPENSSL
161161
target_link_libraries(aws-encryption-sdk-test PUBLIC AWS::aws-c-common)
162162
target_compile_definitions(aws-encryption-sdk-test PRIVATE AWS_CRYPTOSDK_TEST_STATIC=)
163163
target_compile_definitions(aws-encryption-sdk-test PUBLIC AWS_ENCRYPTION_SDK_FORCE_STATIC)
164-
target_compile_definitions(aws-encryption-sdk-test PRIVATE UNIT_TEST_ONLY_ALLOW_ENCRYPT_WITH_COMMITMENT)
165164

166165
include(CodeCoverageTargets)
167166

‎aws-encryption-sdk-cpp/tests/data/commitment_known_answer_tests.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1023,4 +1023,4 @@
10231023
"comment": "46. [Java ESDK] alg=ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384; unframed"
10241024
}
10251025
]
1026-
}
1026+
}

‎aws-encryption-sdk-cpp/tests/test_vectors/static_test_vectors.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -305,11 +305,12 @@ static int process_test_scenarios(
305305
goto next_test_scenario;
306306
}
307307

308-
if (!(session = aws_cryptosdk_session_new_from_cmm(alloc, AWS_CRYPTOSDK_DECRYPT, cmm))) {
308+
if (!(session = aws_cryptosdk_session_new_from_cmm_2(alloc, AWS_CRYPTOSDK_DECRYPT, cmm))) {
309309
failed++;
310310
fprintf(stderr, "Failed to initialize aws_cryptosdk_session, %s\n", aws_error_str(aws_last_error()));
311311
goto next_test_scenario;
312312
}
313+
aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT);
313314

314315
if (test_loadfile(ct_filename.c_str(), &ciphertext, &ct_len)) {
315316
failed++;

‎examples/CMakeLists.txt

+4
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ if (BUILD_AWS_ENC_SDK_CPP)
7070
$ENV{AWS_ENC_SDK_EXAMPLE_KEY_ARN} ${CMAKE_CURRENT_SOURCE_DIR}/example_data/aes_256_key)
7171
aws_add_test(example_string ${CMAKE_CURRENT_BINARY_DIR}/string
7272
$ENV{AWS_ENC_SDK_EXAMPLE_KEY_ARN})
73+
aws_add_test(example_string_alternate_algorithm_suite ${CMAKE_CURRENT_BINARY_DIR}/string_alternate_algorithm_suite
74+
$ENV{AWS_ENC_SDK_EXAMPLE_KEY_ARN})
75+
aws_add_test(example_string_legacy_compatibility ${CMAKE_CURRENT_BINARY_DIR}/string_legacy_compatibility
76+
$ENV{AWS_ENC_SDK_EXAMPLE_KEY_ARN})
7377

7478
set_tests_properties(example_file_streaming PROPERTIES FIXTURES_REQUIRED Examples)
7579
endif()

‎examples/caching_cmm.cpp

+8-2
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,10 @@ std::vector<uint8_t> encrypt(struct aws_allocator *alloc, struct aws_cryptosdk_c
6969
struct aws_cryptosdk_session *session = aws_cryptosdk_session_new_from_cmm_2(alloc, AWS_CRYPTOSDK_ENCRYPT, cmm);
7070
if (!session) abort();
7171

72-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
72+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
73+
* policy is selected by default in v2.0, so this is not required.
74+
*/
75+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
7376
error("set_commitment_policy");
7477
}
7578

@@ -89,7 +92,10 @@ std::string decrypt(
8992
struct aws_cryptosdk_session *session = aws_cryptosdk_session_new_from_cmm_2(alloc, AWS_CRYPTOSDK_DECRYPT, cmm);
9093
if (!session) abort();
9194

92-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
95+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
96+
* policy is selected by default in v2.0, so this is not required.
97+
*/
98+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
9399
error("set_commitment_policy");
94100
}
95101

‎examples/file_streaming.cpp

+4-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,10 @@ static int process_file(
5656
struct aws_cryptosdk_session *session = aws_cryptosdk_session_new_from_keyring_2(allocator, mode, kms_keyring);
5757
if (!session) abort();
5858

59-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
59+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
60+
* policy is selected by default in v2.0, so this is not required.
61+
*/
62+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
6063
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
6164
abort();
6265
}

‎examples/kms_discovery.cpp

+8-2
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,10 @@ void encrypt_string(
5050
if (!session) abort();
5151
aws_cryptosdk_keyring_release(kms_keyring);
5252

53-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
53+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
54+
* policy is selected by default in v2.0, so this is not required.
55+
*/
56+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
5457
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
5558
abort();
5659
}
@@ -87,7 +90,10 @@ void decrypt_string(
8790
aws_cryptosdk_session_new_from_keyring_2(alloc, AWS_CRYPTOSDK_DECRYPT, kms_keyring);
8891
if (!session) abort();
8992

90-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
93+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
94+
* policy is selected by default in v2.0, so this is not required.
95+
*/
96+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
9197
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
9298
abort();
9399
}

‎examples/multi_keyring.cpp

+4-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,10 @@ void encrypt_or_decrypt(
3232
struct aws_cryptosdk_session *session = aws_cryptosdk_session_new_from_keyring_2(alloc, mode, keyring);
3333
if (!session) abort();
3434

35-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
35+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
36+
* policy is selected by default in v2.0, so this is not required.
37+
*/
38+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
3639
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
3740
abort();
3841
}

‎examples/raw_aes_keyring.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,10 @@ void encrypt_or_decrypt_with_keyring(
3333
struct aws_cryptosdk_session *session = aws_cryptosdk_session_new_from_keyring_2(alloc, mode, keyring);
3434
if (!session) abort();
3535

36-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
36+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
37+
* policy is selected by default in v2.0, so this is not required.
38+
*/
39+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
3740
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
3841
abort();
3942
}

‎examples/raw_rsa_keyring.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,10 @@ void encrypt_or_decrypt_with_keyring(
3333
struct aws_cryptosdk_session *session = aws_cryptosdk_session_new_from_keyring_2(alloc, mode, keyring);
3434
if (!session) abort();
3535

36-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
36+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
37+
* policy is selected by default in v2.0, so this is not required.
38+
*/
39+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
3740
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
3841
abort();
3942
}

‎examples/string.cpp

+5-2
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,10 @@ int encrypt_string(
4646
return AWS_OP_ERR;
4747
}
4848

49-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
49+
/* For clarity, we set the commitment policy explicitly. The COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT
50+
* policy is selected by default in v2.0, so this is not required.
51+
*/
52+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
5053
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
5154
return AWS_OP_ERR;
5255
}
@@ -118,7 +121,7 @@ int decrypt_string_and_verify_encryption_context(
118121
return AWS_OP_ERR;
119122
}
120123

121-
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_FORBID_ENCRYPT_ALLOW_DECRYPT)) {
124+
if (aws_cryptosdk_session_set_commitment_policy(session, COMMITMENT_POLICY_REQUIRE_ENCRYPT_REQUIRE_DECRYPT)) {
122125
fprintf(stderr, "set_commitment_policy failed: %s", aws_error_debug_str(aws_last_error()));
123126
return AWS_OP_ERR;
124127
}

0 commit comments

Comments
 (0)