awslabs / awslabs/aws-encryption-sdk-specification

Allow for non-sequential frame IV values in decryption

Open
#229 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
37
Forks
27
PR merge metrics
No merged PRs in 30d

Description

In https://github.com/awslabs/aws-encryption-sdk-specification/blob/master/client-apis/decrypt.md#decrypt-the-message-body:

"The IV is the sequence number used in the message body AAD above, padded to the IV length with 0."

This is actually too restrictive, because the message format includes an IV field in each frame which should be the source of this value. It happens that most ESDK implementations now use sequential IV values when encrypting (https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/IV-reference.html), but ESDKs still need to be able to parse older messages or ones created by other implementations.

Contributor guide

Open the contributing guide

Research direction

Open decrypt.md at the “Decrypt the message body” section and compare the stated IV derivation with the frame format and referenced IV guidance. Update the specification so the frame IV field is the source of the value and non-sequential IVs are allowed; done means the decryption requirements no longer require sequence-number-derived IVs.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.