awslabs / awslabs/aws-encryption-sdk-specification
Allow for non-sequential frame IV values in decryption
- Dominant language
- JavaScript
- Stars
- 37
- Forks
- 27
- PR merge metrics
- No merged PRs in 30d
Description
In https://github.com/awslabs/aws-encryption-sdk-specification/blob/master/client-apis/decrypt.md#decrypt-the-message-body:
"The IV is the sequence number used in the message body AAD above, padded to the IV length with 0."
This is actually too restrictive, because the message format includes an IV field in each frame which should be the source of this value. It happens that most ESDK implementations now use sequential IV values when encrypting (https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/IV-reference.html), but ESDKs still need to be able to parse older messages or ones created by other implementations.
Contributor guide
Research direction
Open decrypt.md at the “Decrypt the message body” section and compare the stated IV derivation with the frame format and referenced IV guidance. Update the specification so the frame IV field is the source of the value and non-sequential IVs are allowed; done means the decryption requirements no longer require sequence-number-derived IVs.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100