Azure / Azure/azure-linux-extensions

KEK is not implemented. It makes no calls to unwrapKey

Open
#570 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

I already opened https://github.com/Azure/azure-linux-extensions/issues/496 but it seems like it was misunderstood. I am opening another ticket with hopefully a clearer explanation.

KEK encryption does not do anything other than write the key to KeyVault. Please note that the key is never read from KeyVault. The code is apparently wholly unimplemented/non-existent.

There is a call to [wrapKey](https://docs.microsoft.com/en-us/rest/api/keyvault/wrapkey) but no call to [unwrapKey](https://docs.microsoft.com/en-us/rest/api/keyvault/unwrapkey).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the existing KEK encryption flow and the call to Key Vault wrapKey, then compare it with the linked unwrapKey API documentation. Confirm where the key is written and whether any read or unwrap path exists. Done means KEK encryption also retrieves and unwraps the key from Key Vault rather than only writing it.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, python
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.