Why the transit `rewrap` endpoint does not accept `associated_data`?

[d3bt3ch]

Why the transit/rewrap endpoint does not accept associated_data. In that case, when a data is encrypted with associated data, it is not possible to rewrap the cipher text?

[dosubot]

This appears to be an incomplete implementation in Vault. Looking at the source code, the AssociatedData field exists in the RewrapBatchRequestItem struct, but the rewrap logic never actually uses it:

1. The associated_data parameter is not included in the endpoint's Fields map for non-batch requests
2. The field is never decoded from base64 like it is in encrypt/decrypt
3. No AssocDataFactory is created to pass the data to the cryptographic operations

In contrast, the encrypt and decrypt endpoints fully implement associated_data support.

Current workaround: You would need to manually decrypt (with associated_data) and re-encrypt (with associated_data) as separate calls, though this defeats the purpose of rewrap (not exposing plaintext).

This looks like a valid bug and we will pass it on to the engineering teams.

Written by @dosu, edited by heatherezell

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

  

[d3bt3ch]

Noted. Thank you for the clarification.