awslabs / awslabs/aws-encryption-sdk-specification
Caching CMM MUST NOT call underlying CMM with plaintext length specified
- Dominant language
- JavaScript
- Stars
- 37
- Forks
- 27
- PR merge metrics
- No merged PRs in 30d
Description
Problem: The CMM interface doesn't make any guarantees on the EncryptionMaterials returned based on the plaintext length (nor does the Caching CMM). However, one could construct a specific CMM implementation that does. If the Caching CMM uses such a CMM as it's underlying CMM, and that underlying CMM performs some plaintext specific logic to produce a set of encryption materials which then get cached, that is bad.
Solution: specify the following: A Caching CMM, when calling it's underlying CMM, MUST NOT pass on this value to the underlying CMM, and instead leave it unspecified.
Contributor guide
Research direction
The issue names no file, test, or entry point. Locate the Caching CMM specification and its requirements for calls to the underlying CMM; update the normative text so the plaintext length is left unspecified, and confirm the requirement is stated unambiguously.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100