feat(test_vector_handlers): TestVectors test with MPL constructs

.github/workflows/ci_tests.yaml

@@ -30,7 +30,7 @@ jobs:
           # (i.e. doo files, per-package module names)
           # Disable for now
           # - windows-latest
-          - macos-latest
+          - macos-12
         python:
           - 3.7
           - 3.8

codebuild/py312/awses_local_mpl.yml

@@ -1,3 +1,5 @@
+# Runs the same tests as awses_local in an environment with the MPL installed.
+# This asserts existing tests continue to pass with the MPL installed.
 version: 0.2
 
 env:
@@ -21,6 +23,11 @@ phases:
       python: 3.12
   build:
     commands:
+      - cd /root/.pyenv/plugins/python-build/../.. && git pull && cd -
+      - pyenv install --skip-existing 3.12.0
+      - pyenv local 3.12.0
+      - pip install --upgrade pip
+      - pip install setuptools
       - pip install "tox < 4.0"
       - cd test_vector_handlers
       - tox

codebuild/py312/examples_mpl.yml

@@ -1,3 +1,6 @@
+# Runs the same tests as examples in an environment with the MPL installed
+# to assert existing tests continue to pass with the MPL installed.
+# Then, run MPL-specific tests.
 version: 0.2
 
 env:
@@ -19,6 +22,11 @@ phases:
       python: 3.12
   build:
     commands:
+      - cd /root/.pyenv/plugins/python-build/../.. && git pull && cd -
+      - pyenv install --skip-existing 3.12.0
+      - pyenv local 3.12.0
+      - pip install --upgrade pip
+      - pip install setuptools
       - pip install "tox < 4.0"
       # Run non-MPL-specific tests with the MPL installed
       - tox -e py312-examples-mpl
@@ -31,4 +39,3 @@ phases:
       - aws sts get-caller-identity
       # Run MPL-specific tests with special role
       - tox -e py312-mplexamples-mpl
-

codebuild/py312/integ_mpl.yml

@@ -1,3 +1,5 @@
+# Runs the same tests as integ in an environment with the MPL installed.
+# This asserts existing tests continue to pass with the MPL installed.
 version: 0.2
 
 env:
@@ -19,5 +21,10 @@ phases:
       python: 3.12
   build:
     commands:
+      - cd /root/.pyenv/plugins/python-build/../.. && git pull && cd -
+      - pyenv install --skip-existing 3.12.0
+      - pyenv local 3.12.0
+      - pip install --upgrade pip
+      - pip install setuptools
       - pip install "tox < 4.0"
       - tox

examples/src/keyrings/hierarchical_keyring.py

@@ -26,7 +26,7 @@
 
 This example requires access to the DDB Table where you are storing the Branch Keys. This
 table must be configured with the following primary key configuration: - Partition key is named
-"partition_key" with type (S) - Sort key is named "sort_key" with type (S)
+"partition_key" with type (S) - Sort key is named "sort_key" with type (S).
 
 This example also requires using a KMS Key. You need the following access on this key: -
 GenerateDataKeyWithoutPlaintext - Decrypt
@@ -55,7 +55,7 @@
 
 from .example_branch_key_id_supplier import ExampleBranchKeyIdSupplier
 
-# TODO-MPL: Remove this as part of removing PYTHONPATH hacks
+# TODO-MPL: Remove this as part of removing PYTHONPATH hacks.
 module_root_dir = '/'.join(__file__.split("/")[:-1])
 
 sys.path.append(module_root_dir)
@@ -154,7 +154,7 @@ def encrypt_and_decrypt_with_keyring(
         "the data you are handling": "is what you think it is",
     }
 
-    # 8. Encrypt the data for encryptionContextA & encryptionContextB
+    # 8. Encrypt the data with encryptionContextA & encryptionContextB
     ciphertext_A, _ = client.encrypt(
         source=EXAMPLE_DATA,
         keyring=hierarchical_keyring,

examples/src/keyrings/required_encryption_context_cmm.py

@@ -115,14 +115,44 @@ def encrypt_and_decrypt_with_keyring(
     )
     assert plaintext_bytes_A == EXAMPLE_DATA
 
-    # 9. Extra: Demonstrate that if we don't provide the required encryption context,
+    # We can also decrypt using the underlying CMM,
+    # but must also provide the reproduced encryption context
+    plaintext_bytes_A, _ = client.decrypt(
+        source=ciphertext,
+        materials_manager=underlying_cmm,
+        encryption_context=reproduced_encryption_context
+    )
+    assert plaintext_bytes_A == EXAMPLE_DATA
+
+    # 9. Extra: Demonstrate that if we don't provide the reproduced encryption context,
     #    decryption will fail.
     try:
         plaintext_bytes_A, _ = client.decrypt(
             source=ciphertext,
             materials_manager=required_ec_cmm,
-            # No encryption context while using required encryption context CMM makes decryption fail.
+            # No reproduced encryption context for required EC CMM-produced message makes decryption fail.
+        )
+        raise Exception("If this exception is raised, decryption somehow succeeded!")
+    except AWSEncryptionSDKClientError:
+        # Swallow specific expected exception.
+        # We expect decryption to fail with an AWSEncryptionSDKClientError
+        # since we did not provide reproduced encryption context when decrypting
+        # a message encrypted with the requried encryption context CMM.
+        pass
+
+    # Same for the default CMM;
+    # If we don't provide the reproduced encryption context, decryption will fail.
+    try:
+        plaintext_bytes_A, _ = client.decrypt(
+            source=ciphertext,
+            materials_manager=required_ec_cmm,
+            # No reproduced encryption context for required EC CMM-produced message makes decryption fail.
         )
         raise Exception("If this exception is raised, decryption somehow succeeded!")
     except AWSEncryptionSDKClientError:
+        # Swallow specific expected exception.
+        # We expect decryption to fail with an AWSEncryptionSDKClientError
+        # since we did not provide reproduced encryption context when decrypting
+        # a message encrypted with the requried encryption context CMM,
+        # even though we are using a default CMM on decrypt.
         pass

examples/test/keyrings/test_i_hierarchical_keyring.py

@@ -9,6 +9,7 @@
 
 
 def test_encrypt_and_decrypt_with_keyring():
+    """Test function for encrypt and decrypt using the AWS KMS Hierarchical Keyring example."""
     key_store_table_name = "KeyStoreDdbTable"
-    key_arn = "arn:aws:kms:us-west-2:370957321024:key/9d989aa2-2f9c-438c-a745-cc57d3ad0126"
-    encrypt_and_decrypt_with_keyring(key_store_table_name, key_store_table_name, key_arn)
+    kms_key_id = "arn:aws:kms:us-west-2:370957321024:key/9d989aa2-2f9c-438c-a745-cc57d3ad0126"
+    encrypt_and_decrypt_with_keyring(key_store_table_name, key_store_table_name, kms_key_id)

setup.py

@@ -40,7 +40,8 @@ def get_requirements():
     license="Apache License 2.0",
     install_requires=get_requirements(),
     # pylint: disable=fixme
-    # TODO: Point at MPL main branch once Python MPL is merged into main.
+    # TODO-MPL: Point at PyPI once MPL is released.
+    # This blocks releasing ESDK-Python MPL integration.
     extras_require={
         "MPL": ["aws-cryptographic-material-providers @" \
                 "git+https://github.com/aws/aws-cryptographic-material-providers-library.git@" \

src/aws_encryption_sdk/__init__.py

@@ -186,8 +186,8 @@ def decrypt(self, **kwargs):
                 to the end of the stream and tell() to find the length of source data.
 
         :param dict encryption_context: Dictionary defining encryption context to validate
-            on decrypt. This is ONLY validated on decrypt if using the required encryption
-            context CMM from the aws-cryptographic-materialproviders library.
+            on decrypt. This is ONLY validated on decrypt if using a CMM from the
+            aws-cryptographic-material-providers library.
         :param int max_body_length: Maximum frame size (or content length for non-framed messages)
             in bytes to read from ciphertext message.
         :returns: Tuple containing the decrypted plaintext and the message header object

src/aws_encryption_sdk/internal/crypto/wrapping_keys.py

@@ -98,9 +98,12 @@ def decrypt(self, encrypted_wrapped_data_key, encryption_context):
         if self.wrapping_key_type is EncryptionKeyType.PUBLIC:
             raise IncorrectMasterKeyError("Public key cannot decrypt")
         if self.wrapping_key_type is EncryptionKeyType.PRIVATE:
-            return self._wrapping_key.decrypt(
-                ciphertext=encrypted_wrapped_data_key.ciphertext, padding=self.wrapping_algorithm.padding
-            )
+            try:
+                return self._wrapping_key.decrypt(
+                    ciphertext=encrypted_wrapped_data_key.ciphertext, padding=self.wrapping_algorithm.padding
+                )
+            except ValueError:
+                raise IncorrectMasterKeyError("_wrapping_key cannot decrypt provided ciphertext")
         serialized_encryption_context = serialize_encryption_context(encryption_context=encryption_context)
         return decrypt(
             algorithm=self.wrapping_algorithm.algorithm,

src/aws_encryption_sdk/materials_managers/__init__.py

@@ -90,8 +90,7 @@ class DecryptionMaterialsRequest(object):
     :type encrypted_data_keys: set of `aws_encryption_sdk.structures.EncryptedDataKey`
     :param dict encryption_context: Encryption context to provide to master keys for underlying decrypt requests
     :param dict reproduced_encryption_context: Encryption context to provide on decrypt.
-        This is ONLY processed if using the required encryption context CMM from the
-        aws-cryptographic-materialproviders library.
+        This is ONLY processed if using a CMM from the aws-cryptographic-materialproviders library.
     """
 
     algorithm = attr.ib(validator=attr.validators.instance_of(Algorithm))

src/aws_encryption_sdk/materials_managers/mpl/cmm.py

@@ -7,7 +7,10 @@
 # pylint should pass even if the MPL isn't installed
 # Also thinks these imports aren't used if it can't import them
 # noqa pylint: disable=import-error,unused-import
-from aws_cryptographic_materialproviders.mpl.errors import AwsCryptographicMaterialProvidersException
+from aws_cryptographic_materialproviders.mpl.errors import (
+    AwsCryptographicMaterialProvidersException,
+    CollectionOfErrors,
+)
 from aws_cryptographic_materialproviders.mpl.models import (
     AlgorithmSuiteIdESDK as MPL_AlgorithmSuiteIdESDK,
     CommitmentPolicyESDK as MPL_CommitmentPolicyESDK,
@@ -36,7 +39,7 @@ class CryptoMaterialsManagerFromMPL(CryptoMaterialsManager):
     """
     In instances where encryption materials are provided by an implementation of the MPL's
     `aws_cryptographic_materialproviders.mpl.references.MPL_ICryptographicMaterialsManager`,
-    this maps the ESDK CMM interfaces to the MPL CMM.
+    this maps the ESDK-Python CMM interfaces to the MPL CMM.
     """
 
     mpl_cmm: 'MPL_ICryptographicMaterialsManager'
@@ -78,27 +81,24 @@ def get_encryption_materials(
     def _native_to_mpl_get_encryption_materials(
         request: EncryptionMaterialsRequest
     ) -> 'MPL_GetEncryptionMaterialsInput':
-        commitment_policy = CryptoMaterialsManagerFromMPL._native_to_mpl_commmitment_policy(
-            request.commitment_policy
-        )
-        mpl_input_kwargs = {
+        output_kwargs = {
             "encryption_context": request.encryption_context,
-            "commitment_policy": commitment_policy,
             "max_plaintext_length": request.plaintext_length,
+            "commitment_policy": CryptoMaterialsManagerFromMPL._native_to_mpl_commitment_policy(
+                request.commitment_policy
+            )
         }
+
         if request.algorithm is not None:
-            mpl_input_kwargs["algorithm_suite_id"] = \
+            output_kwargs["algorithm_suite_id"] = \
                 CryptoMaterialsManagerFromMPL._native_algorithm_id_to_mpl_algorithm_id(
                     request.algorithm.algorithm_id
             )
 
-        output: MPL_GetEncryptionMaterialsInput = MPL_GetEncryptionMaterialsInput(
-            **mpl_input_kwargs
-        )
-        return output
+        return MPL_GetEncryptionMaterialsInput(**output_kwargs)
 
     @staticmethod
-    def _native_to_mpl_commmitment_policy(
+    def _native_to_mpl_commitment_policy(
         native_commitment_policy: CommitmentPolicy
     ) -> 'MPL_CommitmentPolicyESDK':
         if native_commitment_policy == CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT:
@@ -123,7 +123,7 @@ def decrypt_materials(
                 CryptoMaterialsManagerFromMPL._create_mpl_decrypt_materials_input_from_request(request)
             mpl_output: 'MPL_DecryptMaterialsOutput' = self.mpl_cmm.decrypt_materials(mpl_input)
             return DecryptionMaterialsFromMPL(mpl_output.decryption_materials)
-        except AwsCryptographicMaterialProvidersException as mpl_exception:
+        except (AwsCryptographicMaterialProvidersException, CollectionOfErrors) as mpl_exception:
             # Wrap MPL error into the ESDK error type
             # so customers only have to catch ESDK error types.
             raise AWSEncryptionSDKClientError(mpl_exception)
@@ -147,7 +147,7 @@ def _create_mpl_decrypt_materials_input_from_request(
             algorithm_suite_id=CryptoMaterialsManagerFromMPL._native_algorithm_id_to_mpl_algorithm_id(
                 request.algorithm.algorithm_id
             ),
-            commitment_policy=CryptoMaterialsManagerFromMPL._native_to_mpl_commmitment_policy(
+            commitment_policy=CryptoMaterialsManagerFromMPL._native_to_mpl_commitment_policy(
                 request.commitment_policy
             ),
             encrypted_data_keys=list_edks,