Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 99559ca

Browse files
RitvikKapilaRitvikKapila
authoredApr 26, 2024
Merge branch 'mpl-reviewed' into rkapila/mpl-requiredec
2 parents 1c43dd9 + 44d9192 commit 99559ca

File tree

13 files changed

+390
-28
lines changed

13 files changed

+390
-28
lines changed
 

‎CHANGELOG.rst

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,58 @@
22
Changelog
33
*********
44

5+
3.2.0 -- 2024-03-18
6+
===================
7+
8+
Features
9+
-----------
10+
* test Python 3.12 in CI (#623 (https://github.com/josecorella/aws-encryption-sdk-python/issues/623)) (93a67d8 (https://github.com/josecorella/aws-encryption-sdk-python/commit/93a67d8a3806f560ead950e6d8898e53c4c4f9df))
11+
* update requirements and README (#638 (https://github.com/josecorella/aws-encryption-sdk-python/issues/638)) (bcead77 (https://github.com/josecorella/aws-encryption-sdk-python/commit/bcead776b022566ad8211a08e1a458375b23a356))
12+
13+
Fixes
14+
-----------
15+
* CI for Decrypt Oracle (#558 (https://github.com/josecorella/aws-encryption-sdk-python/issues/558)) (6c6b732 (https://github.com/josecorella/aws-encryption-sdk-python/commit/6c6b732379197e91d2137af9f018f670a1ce500a))
16+
* deprecate python36 from chalice (#539 (https://github.com/josecorella/aws-encryption-sdk-python/issues/539)) (f8aa29f (https://github.com/josecorella/aws-encryption-sdk-python/commit/f8aa29fe98d419dac916846d7ff207685ea95307))
17+
* test: correctly invoke ec.generate_private_key (#585 (https://github.com/josecorella/aws-encryption-sdk-python/issues/585)) (560e714 (https://github.com/josecorella/aws-encryption-sdk-python/commit/560e7143ac7caf98e190b17ce2af97b7eea6be16))
18+
* update pyca range (#507 (https://github.com/josecorella/aws-encryption-sdk-python/issues/507)) (aced92c (https://github.com/josecorella/aws-encryption-sdk-python/commit/aced92c3d87dddf3e0920b9dfad4cedd2473604a))
19+
* Use FORBID_ENCRYPT_ALLOW_DECRYPT policy for decrypt oracle (#538 (https://github.com/josecorella/aws-encryption-sdk-python/issues/538)) (e91838f (https://github.com/josecorella/aws-encryption-sdk-python/commit/e91838f65705867fc95506a4323054bca24e9521))
20+
* wrong formatting python warning (#546 (https://github.com/josecorella/aws-encryption-sdk-python/issues/546)) (9b618d3 (https://github.com/josecorella/aws-encryption-sdk-python/commit/9b618d3a5e517435304a891393fefcbbd89faf65))
21+
22+
Maintenance
23+
-----------
24+
* Add example for custom KMS client config (#440 (https://github.com/josecorella/aws-encryption-sdk-python/issues/440)) (08f305a (https://github.com/josecorella/aws-encryption-sdk-python/commit/08f305a9b7b5fc897d9cafac55fb98f3f2a6fe13))
25+
* Add Thread safety section to README (#562 (https://github.com/josecorella/aws-encryption-sdk-python/issues/562)) (7a07b16 (https://github.com/josecorella/aws-encryption-sdk-python/commit/7a07b161d51900066c131627f9f7330acb926d3b))
26+
* bump deps & document upstream test (#646 (https://github.com/josecorella/aws-encryption-sdk-python/issues/646)) (a93ffe7 (https://github.com/josecorella/aws-encryption-sdk-python/commit/a93ffe7a98f8913040f6a693701ba287dd1570fb))
27+
* CFN: Commit existing CFN (#636 (https://github.com/josecorella/aws-encryption-sdk-python/issues/636)) (c122076 (https://github.com/josecorella/aws-encryption-sdk-python/commit/c12207621d295b335fdfb500c2b02694cc6786d8))
28+
* ci: skip pyenv installation if already exists (#627 (https://github.com/josecorella/aws-encryption-sdk-python/issues/627)) (1006758 (https://github.com/josecorella/aws-encryption-sdk-python/commit/10067581cd3316fbb379929806db6867e4cb0feb))
29+
* deps: bump actions/checkout from 3 to 4 (#607 (https://github.com/josecorella/aws-encryption-sdk-python/issues/607)) (e5c331b (https://github.com/josecorella/aws-encryption-sdk-python/commit/e5c331b68590825b55b5300ffab6dc80fbd20818))
30+
* deps: bump actions/setup-python from 2 to 4.2.0 (#491 (https://github.com/josecorella/aws-encryption-sdk-python/issues/491)) (d064bf8 (https://github.com/josecorella/aws-encryption-sdk-python/commit/d064bf8813d25e1ba4a8cce7269b8ee48acfd79a))
31+
* deps: bump cryptography from 39.0.0 to 39.0.1 in /test (#559 (https://github.com/josecorella/aws-encryption-sdk-python/issues/559)) (6468137 (https://github.com/josecorella/aws-encryption-sdk-python/commit/646813786c6250a525afb67bebc486eda206edd8))
32+
* deps: bump cryptography from 39.0.1 to 41.0.2 in /test (#592 (https://github.com/josecorella/aws-encryption-sdk-python/issues/592)) (3ba8019 (https://github.com/josecorella/aws-encryption-sdk-python/commit/3ba8019681ed95c41bb9448f0c3897d1aecc7559))
33+
* deps: bump cryptography from 41.0.2 to 41.0.6 in /test (#626 (https://github.com/josecorella/aws-encryption-sdk-python/issues/626)) (c67e6bd (https://github.com/josecorella/aws-encryption-sdk-python/commit/c67e6bd471b30e13cc7f1b724ce7d19df2380c22))
34+
* deps: bump dependabot/fetch-metadata from 1.3.0 to 1.3.6 (#549 (https://github.com/josecorella/aws-encryption-sdk-python/issues/549)) (2a6bd9d (https://github.com/josecorella/aws-encryption-sdk-python/commit/2a6bd9d70c779655077985c544df3db6a3518443))
35+
* deps: bump flake8-bugbear in /dev_requirements (#512 (https://github.com/josecorella/aws-encryption-sdk-python/issues/512)) (93f01d6 (https://github.com/josecorella/aws-encryption-sdk-python/commit/93f01d655d6bce704bd8779cc9c4acb5f96b980c))
36+
* deps: bump flake8-docstrings in /dev_requirements (#555 (https://github.com/josecorella/aws-encryption-sdk-python/issues/555)) (bd8f270 (https://github.com/josecorella/aws-encryption-sdk-python/commit/bd8f270c8717e5d4a787d33bcfda8b53bbe7751e))
37+
* deps: bump flake8-print from 4.0.0 to 5.0.0 in /dev_requirements (#554 (https://github.com/josecorella/aws-encryption-sdk-python/issues/554)) (2326531 (https://github.com/josecorella/aws-encryption-sdk-python/commit/232653188558379bceeb884b3f74b56b07560f62))
38+
* deps: bump isort from 5.10.1 to 5.11.4 in /dev_requirements (#551 (https://github.com/josecorella/aws-encryption-sdk-python/issues/551)) (36a0ea2 (https://github.com/josecorella/aws-encryption-sdk-python/commit/36a0ea2199872d6590691b53fbea7aee2236a99e))
39+
* deps: bump pytest from 7.0.1 to 7.2.0 in /dev_requirements (#524 (https://github.com/josecorella/aws-encryption-sdk-python/issues/524)) (af98302 (https://github.com/josecorella/aws-encryption-sdk-python/commit/af983024fdd800e6b2c4ae41cdf1617c982e4916))
40+
* deps: bump pytest from 7.2.0 to 7.2.1 in /dev_requirements (#553 (https://github.com/josecorella/aws-encryption-sdk-python/issues/553)) (48f96d5 (https://github.com/josecorella/aws-encryption-sdk-python/commit/48f96d58eeb712a5faa631ce4f4930d5d23bb649))
41+
* deps: bump pytest-cov from 3.0.0 to 4.0.0 in /dev_requirements (#550 (https://github.com/josecorella/aws-encryption-sdk-python/issues/550)) (6e436e1 (https://github.com/josecorella/aws-encryption-sdk-python/commit/6e436e13ce250759a499c3d9c820384cfc26283c))
42+
* deps: bump readme-renderer from 34.0 to 37.3 in /dev_requirements (#526 (https://github.com/josecorella/aws-encryption-sdk-python/issues/526)) (38aa063 (https://github.com/josecorella/aws-encryption-sdk-python/commit/38aa06309ad8ad709044c86ac6b4951739fbf996))
43+
* deps: bump setuptools from 62.0.0 to 66.1.1 in /dev_requirements (#547 (https://github.com/josecorella/aws-encryption-sdk-python/issues/547)) (04e8c16 (https://github.com/josecorella/aws-encryption-sdk-python/commit/04e8c167273357a9548ff474c527805d8764a661))
44+
* deps: bump sphinx from 4.4.0 to 5.3.0 in /dev_requirements (#523 (https://github.com/josecorella/aws-encryption-sdk-python/issues/523)) (51cb2ce (https://github.com/josecorella/aws-encryption-sdk-python/commit/51cb2ce148bc7e048587b013337f2440b53c1387))
45+
* deps: bump tox from 3.24.5 to 3.27.1 in /dev_requirements (#528 (https://github.com/josecorella/aws-encryption-sdk-python/issues/528)) (e2c834a (https://github.com/josecorella/aws-encryption-sdk-python/commit/e2c834ac5c4a9ca65db2b225e794f7ddf4d89cc4))
46+
* deps: bump urllib3 from 1.26.14 to 1.26.18 in /test (#618 (https://github.com/josecorella/aws-encryption-sdk-python/issues/618)) (bbb2281 (https://github.com/josecorella/aws-encryption-sdk-python/commit/bbb2281ed61f8fc8700e31d9828753531c8e586f))
47+
* deps: bump vulture from 2.3 to 2.6 in /dev_requirements (#533 (https://github.com/josecorella/aws-encryption-sdk-python/issues/533)) (2822364 (https://github.com/josecorella/aws-encryption-sdk-python/commit/28223646b4c48b2508ca46e3084689988abd2d27))
48+
* deps: bump wheel from 0.37.1 to 0.38.4 in /dev_requirements (#536 (https://github.com/josecorella/aws-encryption-sdk-python/issues/536)) (1922650 (https://github.com/josecorella/aws-encryption-sdk-python/commit/19226506ad33f5b964fe6632604425923f6ba8c1))
49+
* drop py3.6 from Oracle & Test Vectors (#529 (https://github.com/josecorella/aws-encryption-sdk-python/issues/529)) (8b6a493 (https://github.com/josecorella/aws-encryption-sdk-python/commit/8b6a49388c85785a22d59430007b7873ac8acf96))
50+
* drop py36 support (#530 (https://github.com/josecorella/aws-encryption-sdk-python/issues/530)) (a753ff8 (https://github.com/josecorella/aws-encryption-sdk-python/commit/a753ff884fe3000881c7d3a2392a0b5d65cfa138))
51+
* release: add api token to prod release process (#503 (https://github.com/josecorella/aws-encryption-sdk-python/issues/503)) (333c85b (https://github.com/josecorella/aws-encryption-sdk-python/commit/333c85b40b8ee20ed6303b9775e7fb9a6c6d2c63))
52+
* release: add api token to staging release process (#502 (https://github.com/josecorella/aws-encryption-sdk-python/issues/502)) (78e43b3 (https://github.com/josecorella/aws-encryption-sdk-python/commit/78e43b38a5b9df9a925084242a230fccf91476f2))
53+
* rm upstream-py27 (#564 (https://github.com/josecorella/aws-encryption-sdk-python/issues/564)) (b378508 (https://github.com/josecorella/aws-encryption-sdk-python/commit/b3785085b7c00fef27a250abf78549d6e7928802))
54+
* SupportPolicy: Mark 1.x & 2.x End-of-Support (#501 (https://github.com/josecorella/aws-encryption-sdk-python/issues/501)) (ca58e5e (https://github.com/josecorella/aws-encryption-sdk-python/commit/ca58e5e0ce373e9ae5132bb5ce95b6886a0a37d3))
55+
56+
557
3.1.1 -- 2022-06-20
658
===================
759

‎cfn/ESDK-Python.yml

Lines changed: 74 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -170,10 +170,15 @@ Resources:
170170
AssumeRolePolicyDocument: "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"codebuild.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"
171171
MaxSessionDuration: 3600
172172
ManagedPolicyArns:
173+
# Ideally we would add GeneratedVectorsArtifactsS3BucketPolicy to run test vectors.
174+
# However, this role would then have 11 managed policies.
175+
# IAM has a limit of 10 managed policies per role.
176+
# If we need to add more policies here, we should increase this limit.
173177
- !Ref CryptoToolsKMS
174178
- !Ref CodeBuildBatchPolicy
175179
- !Ref CodeBuildBasePolicy
176180
- !Ref SecretsManagerPolicy
181+
- !Ref CodeBuildCISTSAllow
177182

178183
CodeBuildCIServiceRole:
179184
Type: "AWS::IAM::Role"
@@ -186,6 +191,9 @@ Resources:
186191
- !Ref CryptoToolsKMS
187192
- !Ref CodeBuildCIBatchPolicy
188193
- !Ref CodeBuildBasePolicy
194+
- !Ref SecretsManagerCIPolicy
195+
- !Ref CodeBuildCISTSAllow
196+
- !Ref GeneratedVectorsArtifactsS3BucketPolicy
189197

190198
CodeBuildBatchPolicy:
191199
Type: "AWS::IAM::ManagedPolicy"
@@ -229,7 +237,8 @@ Resources:
229237
"Action": [
230238
"codebuild:StartBuild",
231239
"codebuild:StopBuild",
232-
"codebuild:RetryBuild"
240+
"codebuild:RetryBuild",
241+
"codebuild:BatchGetBuilds"
233242
]
234243
}
235244
]
@@ -257,7 +266,8 @@ Resources:
257266
"Action": [
258267
"logs:CreateLogGroup",
259268
"logs:CreateLogStream",
260-
"logs:PutLogEvents"
269+
"logs:PutLogEvents",
270+
"logs:GetLogEvents"
261271
]
262272
},
263273
{
@@ -308,6 +318,26 @@ Resources:
308318
}
309319
]
310320
}
321+
322+
SecretsManagerCIPolicy:
323+
Type: "AWS::IAM::ManagedPolicy"
324+
Properties:
325+
ManagedPolicyName: !Sub "CryptoTools-SecretsManagerCI-${ProjectName}-release"
326+
Path: "/service-role/"
327+
# Policy: Allow access to a Github fine-grained PAT that can read ESDK-Dafny "Daily CI" artifacts
328+
PolicyDocument: !Sub |
329+
{
330+
"Version": "2012-10-17",
331+
"Statement": [
332+
{
333+
"Effect": "Allow",
334+
"Resource": [
335+
"arn:aws:secretsmanager:us-west-2:587316601012:secret:Github/lucasmcdonald3-fgpat-1aAsdO"
336+
],
337+
"Action": "secretsmanager:GetSecretValue"
338+
}
339+
]
340+
}
311341
312342
# There exist public AWS KMS CMKs that are used for testing
313343
# Take care with these CMKs they are **ONLY** for testing!!!
@@ -339,3 +369,45 @@ Resources:
339369
}
340370
]
341371
}
372+
373+
CodeBuildCISTSAllow:
374+
Type: "AWS::IAM::ManagedPolicy"
375+
Properties:
376+
ManagedPolicyName: !Sub CodeBuildCISTSAllow-${ProjectName}
377+
Path: /service-role/
378+
PolicyDocument: |
379+
{
380+
"Version": "2012-10-17",
381+
"Statement": [
382+
{
383+
"Effect": "Allow",
384+
"Action": "sts:AssumeRole",
385+
"Resource": "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Python-Role-us-west-2"
386+
}
387+
]
388+
}
389+
390+
GeneratedVectorsArtifactsS3Bucket:
391+
Type: 'AWS::S3::Bucket'
392+
Properties:
393+
BucketName: generated-vectors-artifacts-bucket
394+
LifecycleConfiguration:
395+
Rules:
396+
- Id: Expire artifacts in 14 days
397+
Status: Enabled
398+
ExpirationInDays: 14
399+
400+
GeneratedVectorsArtifactsS3BucketPolicy:
401+
Type: 'AWS::IAM::ManagedPolicy'
402+
Properties:
403+
ManagedPolicyName: Generated-Vectors-Artifacts-S3-Bucket-Policy
404+
PolicyDocument:
405+
Version: 2012-10-17
406+
Statement:
407+
- Effect: Allow
408+
Action:
409+
- 's3:PutObject'
410+
- 's3:GetObject'
411+
- 's3:DeleteObject'
412+
Resource:
413+
- !Join [ "", [ !GetAtt GeneratedVectorsArtifactsS3Bucket.Arn, '/*'] ]

‎cfn/Public-ESDK-Python-CI.yml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: "IAM Managed Policies/Role for AWS KMS Hierarchical Keyring Testing"
3+
4+
Parameters:
5+
ProjectName:
6+
Type: String
7+
Description: A prefix that will be applied to any resource names
8+
Default: Public-ESDK-Python
9+
GitHubRepo:
10+
Type: String
11+
Description: GitHub Repo that invokes CI
12+
Default: aws/aws-encryption-sdk-python
13+
14+
Resources:
15+
GitHubCIRole:
16+
Type: 'AWS::IAM::Role'
17+
Properties:
18+
RoleName: !Sub "GitHub-CI-${ProjectName}-Role-${AWS::Region}"
19+
Description: "Access DDB, KMS, Resources for CI from GitHub"
20+
ManagedPolicyArns:
21+
- "arn:aws:iam::370957321024:policy/ESDK-Dafny-DDB-ReadWriteDelete-us-west-2"
22+
- "arn:aws:iam::370957321024:policy/Hierarchical-GitHub-KMS-Key-Policy"
23+
- "arn:aws:iam::370957321024:policy/KMS-Public-CMK-EncryptDecrypt-Key-Access"
24+
- "arn:aws:iam::370957321024:policy/RSA-GitHub-KMS-Key-Policy"
25+
AssumeRolePolicyDocument: !Sub |
26+
{
27+
"Version": "2012-10-17",
28+
"Statement": [
29+
{
30+
"Effect": "Allow",
31+
"Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com" },
32+
"Action": "sts:AssumeRoleWithWebIdentity",
33+
"Condition": {
34+
"StringEquals": {
35+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
36+
},
37+
"StringLike": {
38+
"token.actions.githubusercontent.com:sub": "repo:${GitHubRepo}:*"
39+
}
40+
}
41+
},
42+
{
43+
"Effect": "Allow",
44+
"Principal": {
45+
"AWS": "*"
46+
},
47+
"Action": "sts:AssumeRole",
48+
"Condition": {
49+
"StringEquals": {
50+
"aws:PrincipalArn": [
51+
"arn:aws:iam::587316601012:role/service-role/codebuild-python-esdk-CI-service-role",
52+
"arn:aws:iam::587316601012:role/service-role/codebuild-python-esdk-service-role",
53+
"arn:aws:iam::${AWS::AccountId}:role/ToolsDevelopment"
54+
]
55+
}
56+
}
57+
}
58+
]
59+
}

‎examples/src/keyrings/required_encryption_context_cmm.py

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,14 +115,44 @@ def encrypt_and_decrypt_with_keyring(
115115
)
116116
assert plaintext_bytes_A == EXAMPLE_DATA
117117

118-
# 9. Extra: Demonstrate that if we don't provide the required encryption context,
118+
# We can also decrypt using the underlying CMM,
119+
# but must also provide the reproduced encryption context
120+
plaintext_bytes_A, _ = client.decrypt(
121+
source=ciphertext,
122+
materials_manager=underlying_cmm,
123+
encryption_context=reproduced_encryption_context
124+
)
125+
assert plaintext_bytes_A == EXAMPLE_DATA
126+
127+
# 9. Extra: Demonstrate that if we don't provide the reproduced encryption context,
119128
# decryption will fail.
120129
try:
121130
plaintext_bytes_A, _ = client.decrypt(
122131
source=ciphertext,
123132
materials_manager=required_ec_cmm,
124-
# No encryption context while using required encryption context CMM makes decryption fail.
133+
# No reproduced encryption context for required EC CMM-produced message makes decryption fail.
134+
)
135+
raise Exception("If this exception is raised, decryption somehow succeeded!")
136+
except AWSEncryptionSDKClientError:
137+
# Swallow specific expected exception.
138+
# We expect decryption to fail with an AWSEncryptionSDKClientError
139+
# since we did not provide reproduced encryption context when decrypting
140+
# a message encrypted with the requried encryption context CMM.
141+
pass
142+
143+
# Same for the default CMM;
144+
# If we don't provide the reproduced encryption context, decryption will fail.
145+
try:
146+
plaintext_bytes_A, _ = client.decrypt(
147+
source=ciphertext,
148+
materials_manager=required_ec_cmm,
149+
# No reproduced encryption context for required EC CMM-produced message makes decryption fail.
125150
)
126151
raise Exception("If this exception is raised, decryption somehow succeeded!")
127152
except AWSEncryptionSDKClientError:
153+
# Swallow specific expected exception.
154+
# We expect decryption to fail with an AWSEncryptionSDKClientError
155+
# since we did not provide reproduced encryption context when decrypting
156+
# a message encrypted with the requried encryption context CMM,
157+
# even though we are using a default CMM on decrypt.
128158
pass

‎setup.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ def get_requirements():
4040
license="Apache License 2.0",
4141
install_requires=get_requirements(),
4242
# pylint: disable=fixme
43-
# TODO: Point at MPL main branch once Python MPL is merged into main.
43+
# TODO-MPL: Point at PyPI once MPL is released.
44+
# This blocks releasing ESDK-Python MPL integration.
4445
extras_require={
4546
"MPL": ["aws-cryptographic-material-providers @" \
4647
"git+https://github.com/aws/aws-cryptographic-material-providers-library.git@" \

‎src/aws_encryption_sdk/__init__.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -186,8 +186,8 @@ def decrypt(self, **kwargs):
186186
to the end of the stream and tell() to find the length of source data.
187187
188188
:param dict encryption_context: Dictionary defining encryption context to validate
189-
on decrypt. This is ONLY validated on decrypt if using the required encryption
190-
context CMM from the aws-cryptographic-materialproviders library.
189+
on decrypt. This is ONLY validated on decrypt if using a CMM from the
190+
aws-cryptographic-material-providers library.
191191
:param int max_body_length: Maximum frame size (or content length for non-framed messages)
192192
in bytes to read from ciphertext message.
193193
:returns: Tuple containing the decrypted plaintext and the message header object

‎src/aws_encryption_sdk/identifiers.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
# We only actually need these imports when running the mypy checks
2828
pass
2929

30-
__version__ = "3.1.1"
30+
__version__ = "3.2.0"
3131
USER_AGENT_SUFFIX = "AwsEncryptionSdkPython/{}".format(__version__)
3232

3333

‎src/aws_encryption_sdk/materials_managers/__init__.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,7 @@ class DecryptionMaterialsRequest(object):
9090
:type encrypted_data_keys: set of `aws_encryption_sdk.structures.EncryptedDataKey`
9191
:param dict encryption_context: Encryption context to provide to master keys for underlying decrypt requests
9292
:param dict reproduced_encryption_context: Encryption context to provide on decrypt.
93-
This is ONLY processed if using the required encryption context CMM from the
94-
aws-cryptographic-materialproviders library.
93+
This is ONLY processed if using a CMM from the aws-cryptographic-materialproviders library.
9594
"""
9695

9796
algorithm = attr.ib(validator=attr.validators.instance_of(Algorithm))

‎src/aws_encryption_sdk/materials_managers/mpl/cmm.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ class CryptoMaterialsManagerFromMPL(CryptoMaterialsManager):
3636
"""
3737
In instances where encryption materials are provided by an implementation of the MPL's
3838
`aws_cryptographic_materialproviders.mpl.references.MPL_ICryptographicMaterialsManager`,
39-
this maps the ESDK CMM interfaces to the MPL CMM.
39+
this maps the ESDK-Python CMM interfaces to the MPL CMM.
4040
"""
4141

4242
mpl_cmm: 'MPL_ICryptographicMaterialsManager'

‎src/aws_encryption_sdk/streaming_client.py

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -890,17 +890,17 @@ class DecryptorConfig(_ClientConfig):
890890
:param int max_body_length: Maximum frame size (or content length for non-framed messages)
891891
in bytes to read from ciphertext message.
892892
:param dict encryption_context: Dictionary defining encryption context to validate
893-
on decrypt. This is ONLY validated on decrypt if using the required encryption
894-
context CMM from the aws-cryptographic-materialproviders library.
893+
on decrypt. This is ONLY validated on decrypt if using a CMM
894+
from the aws-cryptographic-material-providers library.
895895
"""
896896

897897
max_body_length = attr.ib(
898898
hash=True, default=None, validator=attr.validators.optional(attr.validators.instance_of(six.integer_types))
899899
)
900900
encryption_context = attr.ib(
901901
hash=False, # dictionaries are not hashable
902-
default=attr.Factory(dict),
903-
validator=attr.validators.instance_of(dict),
902+
default=None,
903+
validator=attr.validators.optional(attr.validators.instance_of(dict)),
904904
)
905905

906906

@@ -958,18 +958,24 @@ def _create_decrypt_materials_request(self, header):
958958
"""
959959
Create a DecryptionMaterialsRequest based on whether
960960
the StreamDecryptor was provided encryption_context on decrypt
961-
(i.e. expects to use required encryption context CMM from the MPL).
961+
(i.e. expects to use a CMM from the MPL).
962962
"""
963963
# If encryption_context is provided on decrypt,
964964
# pass it to the DecryptionMaterialsRequest as reproduced_encryption_context
965-
if hasattr(self.config, "encryption_context"):
966-
return DecryptionMaterialsRequest(
967-
encrypted_data_keys=header.encrypted_data_keys,
968-
algorithm=header.algorithm,
969-
encryption_context=header.encryption_context,
970-
commitment_policy=self.config.commitment_policy,
971-
reproduced_encryption_context=self.config.encryption_context
972-
)
965+
if hasattr(self.config, "encryption_context") \
966+
and self.config.encryption_context is not None:
967+
if (_HAS_MPL
968+
and isinstance(self.config.materials_manager, CryptoMaterialsManagerFromMPL)):
969+
return DecryptionMaterialsRequest(
970+
encrypted_data_keys=header.encrypted_data_keys,
971+
algorithm=header.algorithm,
972+
encryption_context=header.encryption_context,
973+
commitment_policy=self.config.commitment_policy,
974+
reproduced_encryption_context=self.config.encryption_context
975+
)
976+
else:
977+
raise TypeError("encryption_context on decrypt is only supported for CMMs and keyrings "
978+
"from the aws-cryptographic-material-providers library.")
973979
return DecryptionMaterialsRequest(
974980
encrypted_data_keys=header.encrypted_data_keys,
975981
algorithm=header.algorithm,

‎test/unit/test_streaming_client_configs.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,13 @@ def test_client_configs_with_mpl(
245245
assert test.key_provider == kwargs["key_provider"]
246246
assert isinstance(test.materials_manager, DefaultCryptoMaterialsManager)
247247

248+
# If MPL keyring was provided, it should be wrapped in MPL materials manager
249+
elif "keyring" in kwargs:
250+
assert test.keyring is not None
251+
assert test.keyring == kwargs["keyring"]
252+
assert isinstance(test.keyring, IKeyring)
253+
assert isinstance(test.materials_manager, CryptoMaterialsManagerFromMPL)
254+
248255
else:
249256
raise ValueError(f"Test did not find materials_manager or key_provider. {kwargs}")
250257

‎test/unit/test_streaming_client_stream_decryptor.py

Lines changed: 139 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,8 @@ def test_read_header(self, mock_derive_datakey, mock_decrypt_materials_request,
195195
test_decryptor._stream_length = len(VALUES["data_128"])
196196

197197
# Mock: hasattr(self.config, "encryption_context") returns False
198-
del test_decryptor.config.encryption_context
198+
if hasattr(test_decryptor.config, "encryption_context"):
199+
del test_decryptor.config.encryption_context
199200

200201
test_header, test_header_auth = test_decryptor._read_header()
201202

@@ -234,6 +235,136 @@ def test_read_header(self, mock_derive_datakey, mock_decrypt_materials_request,
234235
assert test_header is self.mock_header
235236
assert test_header_auth is sentinel.header_auth
236237

238+
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
239+
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
240+
@patch("aws_encryption_sdk.streaming_client.Verifier")
241+
# Given: no MPL
242+
@pytest.mark.skipif(HAS_MPL, reason="Test should only be executed without MPL in installation")
243+
def test_GIVEN_verification_key_AND_no_mpl_WHEN_read_header_THEN_calls_from_key_bytes(
244+
self,
245+
mock_verifier,
246+
*_,
247+
):
248+
# Given: verification key
249+
mock_verifier_instance = MagicMock()
250+
mock_verifier.from_key_bytes.return_value = mock_verifier_instance
251+
ct_stream = io.BytesIO(VALUES["data_128"])
252+
mock_commitment_policy = MagicMock(__class__=CommitmentPolicy)
253+
test_decryptor = StreamDecryptor(
254+
materials_manager=self.mock_materials_manager,
255+
source=ct_stream,
256+
commitment_policy=mock_commitment_policy,
257+
)
258+
test_decryptor.source_stream = ct_stream
259+
test_decryptor._stream_length = len(VALUES["data_128"])
260+
261+
# When: read header
262+
test_decryptor._read_header()
263+
264+
# Then: calls from_key_bytes
265+
mock_verifier.from_key_bytes.assert_called_once_with(
266+
algorithm=self.mock_header.algorithm, key_bytes=sentinel.verification_key
267+
)
268+
269+
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
270+
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
271+
@patch("aws_encryption_sdk.streaming_client.Verifier")
272+
# Given: has MPL
273+
@pytest.mark.skipif(not HAS_MPL, reason="Test should only be executed with MPL in installation")
274+
def test_GIVEN_verification_key_AND_has_mpl_AND_not_MPLCMM_WHEN_read_header_THEN_calls_from_key_bytes(
275+
self,
276+
mock_verifier,
277+
*_,
278+
):
279+
# Given: verification key
280+
mock_verifier_instance = MagicMock()
281+
mock_verifier.from_key_bytes.return_value = mock_verifier_instance
282+
ct_stream = io.BytesIO(VALUES["data_128"])
283+
mock_commitment_policy = MagicMock(__class__=CommitmentPolicy)
284+
test_decryptor = StreamDecryptor(
285+
# Given: native CMM
286+
materials_manager=self.mock_materials_manager,
287+
source=ct_stream,
288+
commitment_policy=mock_commitment_policy,
289+
)
290+
test_decryptor.source_stream = ct_stream
291+
test_decryptor._stream_length = len(VALUES["data_128"])
292+
293+
# When: read_header
294+
test_decryptor._read_header()
295+
296+
# Then: calls from_key_bytess
297+
mock_verifier.from_key_bytes.assert_called_once_with(
298+
algorithm=self.mock_header.algorithm, key_bytes=sentinel.verification_key
299+
)
300+
301+
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
302+
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
303+
@patch("aws_encryption_sdk.streaming_client.Verifier")
304+
# Given: no MPL
305+
@pytest.mark.skipif(HAS_MPL, reason="Test should only be executed without MPL in installation")
306+
def test_GIVEN_decrypt_config_has_ec_AND_no_mpl_WHEN_read_header_THEN_raise_TypeError(
307+
self,
308+
mock_verifier,
309+
mock_decrypt_materials_request,
310+
*_,
311+
):
312+
313+
mock_verifier_instance = MagicMock()
314+
mock_verifier.from_key_bytes.return_value = mock_verifier_instance
315+
ct_stream = io.BytesIO(VALUES["data_128"])
316+
mock_commitment_policy = MagicMock(__class__=CommitmentPolicy)
317+
test_decryptor = StreamDecryptor(
318+
materials_manager=self.mock_materials_manager,
319+
source=ct_stream,
320+
commitment_policy=mock_commitment_policy,
321+
)
322+
test_decryptor.source_stream = ct_stream
323+
test_decryptor._stream_length = len(VALUES["data_128"])
324+
# Given: self.config has "encryption_context"
325+
# (i.e. encryption context provided on decrypt)
326+
any_reproduced_ec = {"some": "ec"}
327+
test_decryptor.config.encryption_context = any_reproduced_ec
328+
329+
# Then: raise TypeError
330+
with pytest.raises(TypeError):
331+
# When: read header
332+
test_decryptor._read_header()
333+
334+
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
335+
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
336+
@patch("aws_encryption_sdk.streaming_client.Verifier")
337+
@patch("base64.b64encode")
338+
# Given: has MPL
339+
@pytest.mark.skipif(not HAS_MPL, reason="Test should only be executed with MPL in installation")
340+
def test_GIVEN_verification_key_AND_has_mpl_AND_has_MPLCMM_WHEN_read_header_THEN_calls_from_encoded_point(
341+
self,
342+
mock_b64encoding,
343+
mock_verifier,
344+
*_,
345+
):
346+
# Given: Verification key
347+
mock_verifier_instance = MagicMock()
348+
mock_verifier.from_key_bytes.return_value = mock_verifier_instance
349+
ct_stream = io.BytesIO(VALUES["data_128"])
350+
mock_commitment_policy = MagicMock(__class__=CommitmentPolicy)
351+
test_decryptor = StreamDecryptor(
352+
# Given: MPL CMM
353+
materials_manager=self.mock_mpl_materials_manager,
354+
source=ct_stream,
355+
commitment_policy=mock_commitment_policy,
356+
)
357+
test_decryptor.source_stream = ct_stream
358+
test_decryptor._stream_length = len(VALUES["data_128"])
359+
360+
# When: read header
361+
test_decryptor._read_header()
362+
363+
# Then: calls from_encoded_point
364+
mock_verifier.from_encoded_point.assert_called_once_with(
365+
algorithm=self.mock_header.algorithm, encoded_point=mock_b64encoding()
366+
)
367+
237368
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
238369
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
239370
@patch("aws_encryption_sdk.streaming_client.Verifier")
@@ -986,12 +1117,14 @@ def test_GIVEN_has_required_EC_WHEN_validate_parsed_header_THEN_validate_header_
9861117
data_key=sentinel.derived_data_key,
9871118
)
9881119

989-
def test_GIVEN_config_has_EC_WHEN_create_decrypt_materials_request_THEN_provide_reproduced_EC(
1120+
# Given: has MPL
1121+
@pytest.mark.skipif(not HAS_MPL, reason="Test should only be executed with MPL in installation")
1122+
def test_GIVEN_has_MPL_AND_config_has_EC_WHEN_create_decrypt_materials_request_THEN_provide_reproduced_EC(
9901123
self,
9911124
):
9921125
self.mock_header.content_type = ContentType.FRAMED_DATA
9931126
test_decryptor = StreamDecryptor(
994-
materials_manager=self.mock_materials_manager,
1127+
materials_manager=self.mock_mpl_materials_manager,
9951128
source=self.mock_input_stream,
9961129
commitment_policy=self.mock_commitment_policy,
9971130
)
@@ -1039,6 +1172,7 @@ def test_GIVEN_config_does_not_have_EC_WHEN_create_decrypt_materials_request_THE
10391172
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
10401173
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
10411174
@patch("aws_encryption_sdk.streaming_client.Verifier")
1175+
@pytest.mark.skipif(not HAS_MPL, reason="Test should only be executed with MPL in installation")
10421176
def test_GIVEN_materials_has_no_required_encryption_context_keys_attr_WHEN_read_header_THEN_required_EC_is_None(
10431177
self,
10441178
mock_verifier,
@@ -1067,6 +1201,8 @@ def test_GIVEN_materials_has_no_required_encryption_context_keys_attr_WHEN_read_
10671201
@patch("aws_encryption_sdk.streaming_client.derive_data_encryption_key")
10681202
@patch("aws_encryption_sdk.streaming_client.DecryptionMaterialsRequest")
10691203
@patch("aws_encryption_sdk.streaming_client.Verifier")
1204+
# Given: has MPL
1205+
@pytest.mark.skipif(not HAS_MPL, reason="Test should only be executed with MPL in installation")
10701206
def test_GIVEN_materials_has_required_encryption_context_keys_attr_WHEN_read_header_THEN_creates_correct_required_EC( # noqa pylint: disable=line-too-long
10711207
self,
10721208
mock_verifier,

0 commit comments

Comments
 (0)
Please sign in to comment.