awslabs / awslabs/aws-encryption-sdk-specification

The Caching CMM should never cache materials if the plaintext length is not know

Open
#80 6 comments 0 reactions 0 assignees View on GitHub
Doc impact
Dominant language
JavaScript
Stars
37
Forks
27
PR merge metrics
No merged PRs in 30d

Description

https://github.com/awslabs/aws-encryption-sdk-specification/blob/master/framework/caching-cmm.md#get-encryption-materials

Since there is a maximum amount of data that can be safely encrypted under a single data key, if we do not know the amount of data, we can not safely encrypt under a cached data key.

An Example:
If I only want to encrypt 5K under a single data key,
and I have a cached key that has 4.999K already used,
a 10B message will exhaust my margin.
Therefore if I do not know how large a given message is,
I can not safely encrypt it under this key.

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked caching-cmm.md section, “Get Encryption Materials,” and compare its current requirements with the stated safety case. Done means the specification explicitly prevents cached materials from being used when plaintext length is unknown; the payload names no tests or implementation files to run.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.