当加密请求中提供加密上下文时,加密上下文被加密绑定到密文,因此需要相同的加密上下文来解密(或解密和重新加密)数据。如果解密请求中提供的加密上下文不是精确的区分大小写的匹配,则解密请求失败。只有加密上下文对的顺序可以改变。
但是,在JAVA的示例代码中在解密时不指定加密上下文。
crypto.decryptString(prov,密文);
这两篇文章听起来有点矛盾,因为我认为解密用户需要自己提供加密上下文。我在sdk中检查了AwsCrypto.decryptString(final CryptoMaterialsManager provider, final String ciphertext))的源代码,加密上下文似乎也包含在密码文本中。
我能知道为什么这样设置吗?
发布于 2019-02-19 18:13:04
经过一些研究,我发现至少有两种方法来执行加密和解密。如果有人感兴趣的话,就把它们贴在这里。这是用科特林写的。
class AwsEncryptionSDKWrapper(private val keyIdArn: String, region: String) {
private val crypto = AwsCrypto()
private val prov: KmsMasterKeyProvider = KmsMasterKeyProvider.builder().withDefaultRegion(region).withKeysForEncryption(keyIdArn).build()
fun encrypt(raw: String, encryptionContext: Map<String, String>): String {
return crypto.encryptString(prov, raw, encryptionContext).result
}
fun decrypt(cipherText: String, encryptionContext: Map<String, String>): String {
val decryptedResponse = crypto.decryptString(prov, cipherText)
if (decryptedResponse.masterKeyIds[0] != keyIdArn) {
throw IllegalStateException("Wrong key ID!")
}
encryptionContext.entries.forEach { (key, value) ->
if (value != decryptedResponse.encryptionContext[key]) {
throw IllegalStateException("Wrong Encryption Context!")
}
}
return decryptedResponse.result
}
}
class AwsKMSSDKWrapper(region: String) {
private val client = AWSKMSClientBuilder.standard().withRegion(region).build()
fun encrypt(keyIdArn: String, raw: String, encryptionContext: Map<String, String>): String {
val plaintextBytes = raw.toByteArray(StandardCharsets.UTF_8)
val encReq = EncryptRequest()
encReq.keyId = keyIdArn
encReq.plaintext = ByteBuffer.wrap(plaintextBytes)
encReq.withEncryptionContext(encryptionContext)
val cipherText = client.encrypt(encReq).ciphertextBlob
return Base64.getEncoder().encodeToString(cipherText.array())
}
fun decrypt(base64CipherText: String, encryptionContext: Map<String, String>, keyIdArn: String): String {
val req = DecryptRequest()
.withCiphertextBlob(ByteBuffer.wrap(Base64.getDecoder().decode(base64CipherText)))
.withEncryptionContext(encryptionContext)
val resp = client.decrypt(req)
if (resp.keyId == null || resp.keyId!!.contentEquals(keyIdArn)) throw IllegalStateException("keyid not match ! provided $keyIdArn, actual ${resp.keyId}");
return resp.plaintext.array().toString(StandardCharsets.UTF_8)
}
}特别感谢@kdgregory指出我的困惑。
https://stackoverflow.com/questions/54762952
复制相似问题