awslabs / awslabs/aws-encryption-sdk-specification
[feature proposal] Support ranged decryption
- Dominant language
- JavaScript
- Stars
- 37
- Forks
- 27
- PR merge metrics
- No merged PRs in 30d
Description
I want to be able to randomly access the plaintext within an encrypted blob. This is really important for large (framed) objects in remote storage (such as S3).
As a straw-man, I propose the following API (build on the Java ESDK).
```java
/**
* This is a simple utility class used to retrieve ranges of plaintext from an AWS Encryption SDK encrypted ciphertext.
*
* When possible it only retrieves the minimum amount of data possible from the underlying ciphertext.
*/
@NotThreadSafe
public class RangedDecryptor {
/**
* Creates a new instance of this classed backed by {@code data}.
*
* @param cryptoMaterialsManager the cmm used to decrypt the ciphertext
* @param data a ranged view into the ciphertext
* @param skipSignature if we can skip trailing signature validation. (This will prevent decryption of framed ciphertexts with trailing signatures.)
*/
public RangedDecryptor(CryptoMaterialsManager cryptoMaterialsManager, RangedCiphertextAccessor data, boolean skipSignature);
public AwsCryptoResult getPlaintext(int from, int to);
@FunctionalInterface
public interface RangedCiphertextAccessor {
/**
* Returns a subset of the underlying data as specified by the starting index of {@code from} (inclusive)
* up through the ending index of {@code to} (exclusive). If {@code to} is greater than the total amount of
* available data or is negative, then all from {@code to} through the end is returned.
*/
byte[] getData(int from, int to);
}
```
Using this new tool, people can implement transparent decrypting proxies for other data-stores. For example, this should let us implement a decrypting version of the existing S3 clients.
Contributor guide
Research direction
Start with the proposed Java ESDK RangedDecryptor API and compare it with the existing S3 clients mentioned in the issue. Determine the design and validation requirements for ranged plaintext access, including framed ciphertext and trailing signature handling; done means the API and behavior are agreed and specified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- api, backend-api-design, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100