awslabs / awslabs/aws-encryption-sdk-specification

[feature proposal] Support ranged decryption

Open
#108 4 comments 1 reaction 0 assignees View on GitHub
Doc impact enhancement
Dominant language
JavaScript
Stars
37
Forks
27
PR merge metrics
No merged PRs in 30d

Description

I want to be able to randomly access the plaintext within an encrypted blob. This is really important for large (framed) objects in remote storage (such as S3).

As a straw-man, I propose the following API (build on the Java ESDK).

```java
/**
* This is a simple utility class used to retrieve ranges of plaintext from an AWS Encryption SDK encrypted ciphertext.
*


* When possible it only retrieves the minimum amount of data possible from the underlying ciphertext.
*/
@NotThreadSafe
public class RangedDecryptor {

/**
* Creates a new instance of this classed backed by {@code data}.
*
* @param cryptoMaterialsManager the cmm used to decrypt the ciphertext
* @param data a ranged view into the ciphertext
* @param skipSignature if we can skip trailing signature validation. (This will prevent decryption of framed ciphertexts with trailing signatures.)
*/
public RangedDecryptor(CryptoMaterialsManager cryptoMaterialsManager, RangedCiphertextAccessor data, boolean skipSignature);

public AwsCryptoResult getPlaintext(int from, int to);

@FunctionalInterface
public interface RangedCiphertextAccessor {
/**
* Returns a subset of the underlying data as specified by the starting index of {@code from} (inclusive)
* up through the ending index of {@code to} (exclusive). If {@code to} is greater than the total amount of
* available data or is negative, then all from {@code to} through the end is returned.
*/
byte[] getData(int from, int to);
}
```

Using this new tool, people can implement transparent decrypting proxies for other data-stores. For example, this should let us implement a decrypting version of the existing S3 clients.

Contributor guide

Open the contributing guide

Research direction

Start with the proposed Java ESDK RangedDecryptor API and compare it with the existing S3 clients mentioned in the issue. Determine the design and validation requirements for ranged plaintext access, including framed ciphertext and trailing signature handling; done means the API and behavior are agreed and specified.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
api, backend-api-design, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.