aws / aws/aws-encryption-sdk-java

duplicate requests on CMM cache miss

未关闭
#2,176 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Java
星标
240
派生
125
PR 合并指标
30 天内没有已合并 PR

描述

### Problem:

While profiling an application we noticed duplicate request for encryption keys and decryption keys, typically after an DEK has just expired

### Solution:

The cause of this was on a miss used by expiration of an encryption DEK or a decryption DEK. In our case both were related to TTL
for a simple example - imaging 10 threads encrypting data, using the same keys. The key expires, and 10 threads, make 10 request to the MasterKey for 10 new encryption DEKs, which causes a little more latency, and cost (if the underlying KMS charges)

I think that the library can easily de-duplicate these requests (maybe as an option). We have done this in our application

Happy to contribute/colaborate on this but will need some steer from the maintainers

### Out of scope:

Is there anything the solution will intentionally NOT address?

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

贡献指南

打开贡献指南

调研方向

首先跟踪 CMM 中与加密和解密 DEK 过期相关的缓存未命中路径,包括请求如何到达 MasterKey。使用并发线程和已过期的 TTL 重现报告的案例;完成的标准应是,在不改变密钥获取行为的情况下,对等的并发未命中能够去重,并获得维护者关于 API 或选项设计的指导。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
cryptography, security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。