aws / aws/aws-encryption-sdk-java

duplicate requests on CMM cache miss

Open
#2,176 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
240
Forks
125
PR merge metrics
No merged PRs in 30d

Description

### Problem:

While profiling an application we noticed duplicate request for encryption keys and decryption keys, typically after an DEK has just expired

### Solution:

The cause of this was on a miss used by expiration of an encryption DEK or a decryption DEK. In our case both were related to TTL
for a simple example - imaging 10 threads encrypting data, using the same keys. The key expires, and 10 threads, make 10 request to the MasterKey for 10 new encryption DEKs, which causes a little more latency, and cost (if the underlying KMS charges)

I think that the library can easily de-duplicate these requests (maybe as an option). We have done this in our application

Happy to contribute/colaborate on this but will need some steer from the maintainers

### Out of scope:

Is there anything the solution will intentionally NOT address?

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

Contributor guide

Open the contributing guide

Research direction

Start by tracing the CMM cache-miss path around encryption and decryption DEK expiration, including how requests reach the MasterKey. Reproduce the reported case with concurrent threads and expired TTLs; done should mean equivalent concurrent misses are de-duplicated without changing key retrieval behavior, with maintainer guidance on the API or option design.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.