jce KeyStoreProvider fails to properly decrypt data keys about aws-encryption-sdk-java

[johnwalker]

Hi! Thanks for the bug report, you're right and this is something we want to support, although we don't yet have a timeline yet for closing this gap. We're thinking about doing it by adding a replacement for JceMasterKey and KeyStoreProvider, which will come with support for symmetric master keys. Which keystore implementation are you using with the KeyStoreProvider?

[spickelmier]

I am currently using "BKS":
KeyStore.getInstance("BKS", "BC");
But an open to other options with what JCE/Bouncy Castle support.

My current hack is this (and fails for keys that begin with the same prefix... again, a hack):

USSFNRSPICKEL01:aws-encryption-sdk-java ricks$ git diff

diff --git a/src/main/java/com/amazonaws/encryptionsdk/jce/KeyStoreProvider.java b/src/main/java/com/amazonaws/encryptionsdk/jce/KeyStoreProvider.java
index 1e92cd2..5fd0553 100644
--- a/src/main/java/com/amazonaws/encryptionsdk/jce/KeyStoreProvider.java
+++ b/src/main/java/com/amazonaws/encryptionsdk/jce/KeyStoreProvider.java
@@ -178,6 +178,19 @@ public class KeyStoreProvider extends MasterKeyProvider<JceMasterKey> {
                             return result;
                         }
                     }
+                    // ugly hack, try to decrypt with each master key that matches the front...
+                    for (final String al : Collections.list(keystore_.aliases()))
+                    {
+                       if (alias.startsWith(al))
+                       {
+                               final DataKey<JceMasterKey> result = getMasterKey(al).decryptDataKey(algorithm,
+                                    Collections.singletonList(edk),
+                                    encryptionContext);
+                            if (result != null) {
+                                return result;
+                            }
+                       }
+                    }
                 }
             } catch (final Exception ex) {
                 exceptions.add(ex);

[spickelmier]

Easier to read, the full method:

    /**
     * Attempts to decrypts the {@code encryptedDataKeys} by first iterating through all
     * {@code aliasNames} specified in the constructor and then over
     * <em>all other compatible keys</em> in the {@link KeyStore}. This includes
     * {@code TrustedCertificates} as well as standard key entries.
     */
    @Override
    public DataKey<JceMasterKey> decryptDataKey(final CryptoAlgorithm algorithm,
            final Collection<? extends EncryptedDataKey> encryptedDataKeys,
            final Map<String, String> encryptionContext)
            throws UnsupportedProviderException, AwsCryptoException {
        final List<Exception> exceptions = new ArrayList<>();
        for (final EncryptedDataKey edk : encryptedDataKeys) {
            try {
                if (canProvide(edk.getProviderId())) {
                    final String alias = new String(edk.getProviderInformation(), StandardCharsets.UTF_8);
                    if (keystore_.isKeyEntry(alias)) {
                        final DataKey<JceMasterKey> result = getMasterKey(alias).decryptDataKey(algorithm,
                                Collections.singletonList(edk),
                                encryptionContext);
                        if (result != null) {
                            return result;
                        }
                    }
                    // ugly hack, try to decrypt with each master key that matches the front...
                    for (final String al : Collections.list(keystore_.aliases()))
                    {
                    	if (alias.startsWith(al))
                    	{
                    		final DataKey<JceMasterKey> result = getMasterKey(al).decryptDataKey(algorithm,
                                    Collections.singletonList(edk),
                                    encryptionContext);
                            if (result != null) {
                                return result;
                            }
                    	}
                    }
                }
            } catch (final Exception ex) {
                exceptions.add(ex);
            }
        }

        throw buildCannotDecryptDksException(exceptions);
    }
}

[karlw00t]

Thanks for the feedback. We’ll look into a way that we can support symmetric master keys in the future.

[bbeck10]

Is there a plan for fixing this? It's pretty weird that the JCE KeyStoreProvider doesn't work for symmetric keys when it seems it should be a drop in replacement for the KmsMasterKeyProvider-- trying to use it for local development setup instead of KmsMasterKeyProvider.

[farleyb-amazon]

Hey bbeck10,

We don't have a specific plan for updating Master Key Providers; instead, we plan to move the Java Encryption SDK to our new and improved way of specifying wrapping keys, Keyrings, which do support symmetric keys.

In the meantime, your best option for local development is likely to do some sort of mocking of KMS.

I'm going to close this out, but feel free to re-open or open another issue if you have any other questions.

Thanks,
Ben