awslabs / awslabs/aws-encryption-sdk-specification
The Caching CMM should never cache materials if the plaintext length is not know
- Dominant language
- JavaScript
- Stars
- 37
- Forks
- 27
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/awslabs/aws-encryption-sdk-specification/blob/master/framework/caching-cmm.md#get-encryption-materials
Since there is a maximum amount of data that can be safely encrypted under a single data key, if we do not know the amount of data, we can not safely encrypt under a cached data key.
An Example:
If I only want to encrypt 5K under a single data key,
and I have a cached key that has 4.999K already used,
a 10B message will exhaust my margin.
Therefore if I do not know how large a given message is,
I can not safely encrypt it under this key.
Contributor guide
Research direction
Start by reading the linked caching-cmm.md section, “Get Encryption Materials,” and compare its current requirements with the stated safety case. Done means the specification explicitly prevents cached materials from being used when plaintext length is unknown; the payload names no tests or implementation files to run.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100