aws-samples / aws-samples/samples-for-payment-cryptography-service
MACService.getMacVerification: MAC passed as its own message
- Dominant language
- Python
- Stars
- 31
- Forks
- 24
- Avg merge
- 3m
- Merged PRs (30d)
- 1
Description
MACService.java lines 88/98–99: getMacVerification(String macKeyArn, String mac) builds .mac(mac).messageData(mac) — the MAC is passed as the message data, and the method never receives the real message. VerifyMac checks MAC(key, messageData) == mac, so this can’t do a real verification. The generateMac counterpart (line 79) shows the intended form: .messageData(Hex.encodeHexString(text.getBytes())). Fix: thread the original message in and hex-encode it.
Contributor guide
Research direction
Start in MACService.java at lines 79 and 88/98–99, comparing getMacVerification with the generateMac counterpart. Trace how the original message reaches verification and confirm the message data is hex-encoded as described. Done means verification uses the original message rather than the MAC itself and the relevant Java checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- payments, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100