Skip to content

Latest commit

 

History

History
110 lines (79 loc) · 6.18 KB

commitment-policy.md

File metadata and controls

110 lines (79 loc) · 6.18 KB

Commitment Policy

Version

0.3.0

Changelog

  • 0.3.0

    • Add commitment policy for DBE.

Implementations

Language Confirmed Compatible with Spec Version Minimum Version Confirmed Implementation
C 0.1.0 0.1.0 session.c
NodeJS 0.1.0 0.1.0 index.ts
Browser JS 0.1.0 0.1.0 index.ts
Python 0.1.0 0.1.0 __init__.py
Java 0.1.0 0.1.0 AwsCrypto.java

Overview

This document describes the the Commitment Policy for the Material Providers Library.

The top level client supports configuration settings that need to be coordinated between encrypt and decrypt. Coordinating static settings between encrypt and decrypt across hosts is complicated. It is important that all messages that could be sent to a host can be decrypted by that host. A top level client makes such settings hard to misuse because anything a client encrypts can be decrypted by the same client.

Supported Format Commitment Policy ENUM

The following tables include the commitment policies supported by the Material Providers Library for each supported format.

The Material Providers Library MUST provide a distinct commitment policy ENUM for each format. The Format Commitment Policy ENUM, where Format is a value from supported format short name. This ENUM can be used to configure which Commitment Policies it supports.

ESDK Commitment Policy ENUM
FORBID_ENCRYPT_ALLOW_DECRYPT
REQUIRE_ENCRYPT_ALLOW_DECRYPT
REQUIRE_ENCRYPT_REQUIRE_DECRYPT
DBE Commitment Policy ENUM
REQUIRE_ENCRYPT_REQUIRE_DECRYPT

Supported Commitment Policy ENUM

The Material Providers Library also MUST provide a union ENUM for all distinct commitment policy ENUMs called the Commitment Policy ENUM. In this specification this union Commitment Policy ENUM will be denoted as Format.FormatENUM to uniquely identify an Commitment Policy ENUM across all supported formats. For example ESDK.FORBID_ENCRYPT_ALLOW_DECRYPT is the Commitment Policy ENUM for the ESDK Commitment Policy ENUM FORBID_ENCRYPT_ALLOW_DECRYPT. This means that different formats MAY have duplicate Format Commitment Policy ENUM.

Algorithm Suite ENUM
ESDK.FORBID_ENCRYPT_ALLOW_DECRYPT
ESDK.REQUIRE_ENCRYPT_ALLOW_DECRYPT
ESDK.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
DBE.REQUIRE_ENCRYPT_REQUIRE_DECRYPT

ESDK.FORBID_ENCRYPT_ALLOW_DECRYPT

When the commitment policy ESDK.FORBID_ENCRYPT_ALLOW_DECRYPT is configured:

ESDK.REQUIRE_ENCRYPT_ALLOW_DECRYPT

When the commitment policy ESDK.REQUIRE_ENCRYPT_ALLOW_DECRYPT is configured:

ESDK.REQUIRE_ENCRYPT_REQUIRE_DECRYPT

When the commitment policy ESDK.REQUIRE_ENCRYPT_REQUIRE_DECRYPT is configured:

DBE.REQUIRE_ENCRYPT_REQUIRE_DECRYPT

The commitment policy ESDK.REQUIRE_ENCRYPT_REQUIRE_DECRYPT is always configured for DBE, and results in the following requirements: