awslabs/aws-encryption-sdk-specification

AWS Encryption SDK Specification

Stars: 37
Forks: 27
Open beginner issues: 0
Indexed issues: 88

Dominant language: JavaScript
License: No license data
Last GitHub push: Jul 18, 2026
Latest indexed: Sep 14, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed
PR merge metrics: No merged PRs in 30d

Open All

88 open issues indexed

On decrypt path, the default CMM MUST remove the signature from the EC Open

awslabs/aws-encryption-sdk-specification#4 · 5 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Add support for SHA384 and SHA512 for use with RSA OAEP wrapping algorithms Open

awslabs/aws-encryption-sdk-specification#5 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Write message.md Open

awslabs/aws-encryption-sdk-specification#6 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Update CONTRIBUTING.md Open

awslabs/aws-encryption-sdk-specification#8 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Update algorithm-suites.md Security Considerations Open

awslabs/aws-encryption-sdk-specification#9 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Add Test Vectors section to all documents Open

awslabs/aws-encryption-sdk-specification#10 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
define decryption contract for multi-keyring Open

awslabs/aws-encryption-sdk-specification#12 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Write specification for Raw MK/MKP Open

awslabs/aws-encryption-sdk-specification#19 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Write specification for KMS MK/MKP Open

awslabs/aws-encryption-sdk-specification#20 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Fix message sample structures Open

awslabs/aws-encryption-sdk-specification#22 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Remove the term pseudo-ASN.1 structure Open

awslabs/aws-encryption-sdk-specification#28 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add the crypto format spec Open

awslabs/aws-encryption-sdk-specification#30 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Key hierarchies and combinations Open

enhancement

awslabs/aws-encryption-sdk-specification#45 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Rewrite Keyring interface in functional style Open

awslabs/aws-encryption-sdk-specification#53 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Mention that comparisons of plaintext data keys must be timing safe Open

awslabs/aws-encryption-sdk-specification#57 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Support for asymmetric cryptographic operations Open

enhancement

awslabs/aws-encryption-sdk-specification#64 · 5 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Allow implementations that return results instead of mutating inputs Open

awslabs/aws-encryption-sdk-specification#66 · 18 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
update PR template to ask about contributing issues Open

awslabs/aws-encryption-sdk-specification#77 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
The Caching CMM should never cache materials if the plaintext length is not know Open

Doc impact

awslabs/aws-encryption-sdk-specification#80 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Caching CMM MUST NOT call underlying CMM with plaintext length specified Open

awslabs/aws-encryption-sdk-specification#81 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Specification Message Body: Inconsistency size encrypted content in regular frame Open

awslabs/aws-encryption-sdk-specification#82 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
review decrypt API output - add at least encryption context Open

awslabs/aws-encryption-sdk-specification#96 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 14, 2026
add "required examples" specification Open

awslabs/aws-encryption-sdk-specification#103 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 14, 2026
[feature proposal] Support ranged decryption Open

Doc impact enhancement

awslabs/aws-encryption-sdk-specification#108 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
The ESDK only supports compressed ECDSA keys Open

awslabs/aws-encryption-sdk-specification#119 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
CMM decrypt contract makes an incorrect statement about the algorithm suite Open

awslabs/aws-encryption-sdk-specification#120 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
implementation: remove keyring trace Open

Doc impact

awslabs/aws-encryption-sdk-specification#121 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
docs: clarify AWS KMS permissions statements Open

awslabs/aws-encryption-sdk-specification#125 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
implementation: KMS Keyring to AWS KMS Keyring Open

Doc impact

awslabs/aws-encryption-sdk-specification#127 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
How do we ensure that implementations comply with the spec? Open

awslabs/aws-encryption-sdk-specification#128 · 3 comments · 0 reactions · 2 assignees · Indexed Sep 14, 2026
implementation: Update Key IDs and generator sections to reference valid AWS KMS values, additional naming clarity Open

Doc impact

awslabs/aws-encryption-sdk-specification#129 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
define "static" keyrings Open

enhancement

awslabs/aws-encryption-sdk-specification#132 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Check signature length against algorithm suite when decrypting Open

awslabs/aws-encryption-sdk-specification#134 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
document spec change doc format and process Open

awslabs/aws-encryption-sdk-specification#137 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
document ECDSA deterministic length signature algorithm Open

awslabs/aws-encryption-sdk-specification#141 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Accept expected encryption context as input to Decrypt Open

awslabs/aws-encryption-sdk-specification#142 · 7 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Keyring capability configuration/introspection Open

enhancement

awslabs/aws-encryption-sdk-specification#144 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
parallel multi-keyring design thoughts Open

enhancement

awslabs/aws-encryption-sdk-specification#146 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Create .net implementation Open

awslabs/aws-encryption-sdk-specification#147 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 14, 2026
add point decompression check Open

enhancement

awslabs/aws-encryption-sdk-specification#150 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Multi-keyrings MUST call OnDecrypt on list of child keyrings in order Open

awslabs/aws-encryption-sdk-specification#153 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
implementation: Rename "childrenKeyrings" to "childKeyrings" in MultiKeyring Open

awslabs/aws-encryption-sdk-specification#156 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Generalize "Encrypted Data Key" term Open

awslabs/aws-encryption-sdk-specification#158 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Move exact algorithm specifics from encrypt/decrypt into algorithm-suites Open

awslabs/aws-encryption-sdk-specification#162 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
define standard no-op keyring errors Open

awslabs/aws-encryption-sdk-specification#164 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
implementation: re-designing the AWS KMS keyring Open

Doc impact enhancement

awslabs/aws-encryption-sdk-specification#165 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Determine how/where/if the Raw RSA Keyring checks that public/private keys match Open

Doc impact

awslabs/aws-encryption-sdk-specification#167 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
implementation: detecting base64-encoded messages Open

awslabs/aws-encryption-sdk-specification#169 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
implementation: Require generation in the multi-keyring Open

awslabs/aws-encryption-sdk-specification#170 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Implementation: Raw keyrings MUST NOT accept a key namespace of "aws-kms" Open

awslabs/aws-encryption-sdk-specification#171 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026

A short digest of beginner-friendly GitHub issues.