aws / aws/aws-encryption-sdk-java
Support Re-Key Operation in AwsCrypto
未关闭
enhancement
- 主要语言
- Java
- 星标
- 240
- 派生
- 125
- PR 合并指标
- 30 天内没有已合并 PR
描述
For scenarios like key-rotation, I think it would be very useful to support a re-keying operation, where we decrypt the data key using one master key, and then re-encrypt with another master key. This also leverages the convenient envelope structure of the encrypted payload. I've noticed this is supported using the KMS Client (re-keying happens on the server side in that case), but feels like it should also exist in the SDK as well!
Thoughts?
Nick
CC: @walliee
贡献指南
调研方向
首先阅读 AwsCrypto 入口点,并查看 KMS Client 如何在服务器端执行 re-keying。跟踪加密 payload 的 envelope 和数据密钥处理方式,然后确定 SDK 为使用一个主密钥解密并使用另一个主密钥重新加密所需的行为。只有在所提议的操作范围明确且保留加密 payload 的结构时,才算完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- aws, java
- 领域
- security
- Issue 类型
- 功能
- 难度
- 5/5
- 预计耗时
- 一周以上
- 活跃度
- 停滞
- 描述清晰度
- 需要澄清
- 新手友好度
- 25/100