awslabs / awslabs/aws-encryption-sdk-specification

Caching CMM MUST NOT call underlying CMM with plaintext length specified

Open
#81 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
37
Forks
27
PR merge metrics
No merged PRs in 30d

Description

Problem: The CMM interface doesn't make any guarantees on the EncryptionMaterials returned based on the plaintext length (nor does the Caching CMM). However, one could construct a specific CMM implementation that does. If the Caching CMM uses such a CMM as it's underlying CMM, and that underlying CMM performs some plaintext specific logic to produce a set of encryption materials which then get cached, that is bad.

Solution: specify the following: A Caching CMM, when calling it's underlying CMM, MUST NOT pass on this value to the underlying CMM, and instead leave it unspecified.

Contributor guide

Open the contributing guide

Research direction

The issue names no file, test, or entry point. Locate the Caching CMM specification and its requirements for calls to the underlying CMM; update the normative text so the plaintext length is left unspecified, and confirm the requirement is stated unambiguously.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.