Skip to content

Commit 1c329e0

Browse files
smswzsmswz
committed
Address PR comments
1 parent a668527 commit 1c329e0

File tree

4 files changed

+26
-44
lines changed

4 files changed

+26
-44
lines changed

‎src/main/java/software/amazon/encryption/s3/algorithms/AlgorithmSuite.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
public enum AlgorithmSuite {
55
ALG_AES_256_GCM_IV12_TAG16_NO_KDF(0x0078,
6-
true,
6+
false,
77
"AES",
88
256,
99
"AES/GCM/NoPadding",
@@ -12,7 +12,7 @@ public enum AlgorithmSuite {
1212
128,
1313
AlgorithmConstants.GCM_MAX_CONTENT_LENGTH_BITS),
1414
ALG_AES_256_CBC_IV16_NO_KDF(0x0070,
15-
false,
15+
true,
1616
"AES",
1717
256,
1818
"AES/CBC/PKCS5Padding",
@@ -22,7 +22,7 @@ public enum AlgorithmSuite {
2222
AlgorithmConstants.CBC_MAX_CONTENT_LENGTH_BYTES);
2323

2424
private int _id;
25-
private boolean _isActive;
25+
private boolean _isLegacy;
2626
private String _dataKeyAlgorithm;
2727
private int _dataKeyLengthBits;
2828
private String _cipherName;
@@ -32,7 +32,7 @@ public enum AlgorithmSuite {
3232
private long _cipherMaxContentLengthBits;
3333

3434
AlgorithmSuite(int id,
35-
boolean isActive,
35+
boolean isLegacy,
3636
String dataKeyAlgorithm,
3737
int dataKeyLengthBits,
3838
String cipherName,
@@ -42,7 +42,7 @@ public enum AlgorithmSuite {
4242
long cipherMaxContentLengthBits
4343
) {
4444
this._id = id;
45-
this._isActive = isActive;
45+
this._isLegacy = isLegacy;
4646
this._dataKeyAlgorithm = dataKeyAlgorithm;
4747
this._dataKeyLengthBits = dataKeyLengthBits;
4848
this._cipherName = cipherName;
@@ -57,7 +57,7 @@ public int id() {
5757
}
5858

5959
public boolean isLegacy() {
60-
return !_isActive;
60+
return _isLegacy;
6161
}
6262

6363
public String dataKeyAlgorithm() {

‎src/main/java/software/amazon/encryption/s3/internal/GetEncryptedObjectPipeline.java‎

Lines changed: 6 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,12 @@ public class GetEncryptedObjectPipeline {
2323

2424
final private S3Client _s3Client;
2525
final private CryptographicMaterialsManager _cryptoMaterialsManager;
26-
final private ContentDecryptionStrategy _contentDecryptionStrategy;
27-
final private ContentMetadataDecodingStrategy _contentMetadataDecodingStrategy;
2826

2927
public static Builder builder() { return new Builder(); }
3028

3129
private GetEncryptedObjectPipeline(Builder builder) {
3230
this._s3Client = builder._s3Client;
3331
this._cryptoMaterialsManager = builder._cryptoMaterialsManager;
34-
this._contentDecryptionStrategy = builder._contentDecryptionStrategy;
35-
this._contentMetadataDecodingStrategy = builder._contentMetadataDecodingStrategy;
3632
}
3733

3834
public <T> T getObject(GetObjectRequest getObjectRequest,
@@ -47,8 +43,13 @@ public <T> T getObject(GetObjectRequest getObjectRequest,
4743
}
4844

4945
GetObjectResponse response = objectStream.response();
46+
5047
// TODO: Need to differentiate metadata decoding strategy here
51-
ContentMetadata contentMetadata = _contentMetadataDecodingStrategy.decodeMetadata(response);
48+
ContentMetadataDecodingStrategy contentMetadataDecodingStrategy = S3ObjectMetadataStrategy
49+
.builder()
50+
.build();
51+
52+
ContentMetadata contentMetadata = contentMetadataDecodingStrategy.decodeMetadata(response);
5253

5354
AlgorithmSuite algorithmSuite = contentMetadata.algorithmSuite();
5455
List<EncryptedDataKey> encryptedDataKeys = Collections.singletonList(contentMetadata.encryptedDataKey());
@@ -83,14 +84,6 @@ public <T> T getObject(GetObjectRequest getObjectRequest,
8384
public static class Builder {
8485
private S3Client _s3Client;
8586
private CryptographicMaterialsManager _cryptoMaterialsManager;
86-
private ContentDecryptionStrategy _contentDecryptionStrategy =
87-
AesGcmContentStrategy
88-
.builder()
89-
.build();
90-
private ContentMetadataDecodingStrategy _contentMetadataDecodingStrategy =
91-
S3ObjectMetadataStrategy
92-
.builder()
93-
.build();
9487

9588
private Builder() {}
9689

@@ -104,17 +97,6 @@ public Builder cryptoMaterialsManager(CryptographicMaterialsManager cryptoMateri
10497
return this;
10598
}
10699

107-
// TODO: these should be determined automatically based on inputs
108-
public Builder contentDecryptionStrategy(ContentDecryptionStrategy strategy) {
109-
this._contentDecryptionStrategy = strategy;
110-
return this;
111-
}
112-
113-
public Builder metadataDecodingStrategy(ContentMetadataDecodingStrategy strategy) {
114-
this._contentMetadataDecodingStrategy = strategy;
115-
return this;
116-
}
117-
118100
public GetEncryptedObjectPipeline build() {
119101
return new GetEncryptedObjectPipeline(this);
120102
}

src/main/java/software/amazon/encryption/s3/internal/MetadataKey.java renamed to src/main/java/software/amazon/encryption/s3/internal/MetadataKeyConstants.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package software.amazon.encryption.s3.internal;
22

3-
public class MetadataKey {
3+
public class MetadataKeyConstants {
44
public static final String ENCRYPTED_DATA_KEY_V1 = "x-amz-key";
55
public static final String ENCRYPTED_DATA_KEY_V2 = "x-amz-key-v2";
66
// This is the name of the keyring/algorithm e.g. AES/GCM or kms+context

‎src/main/java/software/amazon/encryption/s3/internal/S3ObjectMetadataStrategy.java‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,11 @@ public PutObjectRequest encodeMetadata(
4040
PutObjectRequest request) {
4141
Map<String,String> metadata = new HashMap<>(request.metadata());
4242
EncryptedDataKey edk = materials.encryptedDataKeys().get(0);
43-
metadata.put(MetadataKey.ENCRYPTED_DATA_KEY_V2, _encoder.encodeToString(edk.ciphertext()));
44-
metadata.put(MetadataKey.CONTENT_NONCE, _encoder.encodeToString(encryptedContent.nonce));
45-
metadata.put(MetadataKey.CONTENT_CIPHER, materials.algorithmSuite().cipherName());
46-
metadata.put(MetadataKey.CONTENT_CIPHER_TAG_LENGTH, Integer.toString(materials.algorithmSuite().cipherTagLengthBits()));
47-
metadata.put(MetadataKey.ENCRYPTED_DATA_KEY_ALGORITHM, new String(edk.keyProviderInfo(), StandardCharsets.UTF_8));
43+
metadata.put(MetadataKeyConstants.ENCRYPTED_DATA_KEY_V2, _encoder.encodeToString(edk.ciphertext()));
44+
metadata.put(MetadataKeyConstants.CONTENT_NONCE, _encoder.encodeToString(encryptedContent.nonce));
45+
metadata.put(MetadataKeyConstants.CONTENT_CIPHER, materials.algorithmSuite().cipherName());
46+
metadata.put(MetadataKeyConstants.CONTENT_CIPHER_TAG_LENGTH, Integer.toString(materials.algorithmSuite().cipherTagLengthBits()));
47+
metadata.put(MetadataKeyConstants.ENCRYPTED_DATA_KEY_ALGORITHM, new String(edk.keyProviderInfo(), StandardCharsets.UTF_8));
4848

4949
try (JsonWriter jsonWriter = JsonWriter.create()) {
5050
jsonWriter.writeStartObject();
@@ -54,7 +54,7 @@ public PutObjectRequest encodeMetadata(
5454
jsonWriter.writeEndObject();
5555

5656
String jsonEncryptionContext = new String(jsonWriter.getBytes(), StandardCharsets.UTF_8);
57-
metadata.put(MetadataKey.ENCRYPTED_DATA_KEY_CONTEXT, jsonEncryptionContext);
57+
metadata.put(MetadataKeyConstants.ENCRYPTED_DATA_KEY_CONTEXT, jsonEncryptionContext);
5858
} catch (JsonGenerationException e) {
5959
throw new S3EncryptionClientException("Cannot serialize encryption context to JSON.", e);
6060
}
@@ -67,7 +67,7 @@ public ContentMetadata decodeMetadata(GetObjectResponse response) {
6767
Map<String, String> metadata = response.metadata();
6868

6969
// Get algorithm suite
70-
final String contentEncryptionAlgorithm = metadata.get(MetadataKey.CONTENT_CIPHER);
70+
final String contentEncryptionAlgorithm = metadata.get(MetadataKeyConstants.CONTENT_CIPHER);
7171
AlgorithmSuite algorithmSuite;
7272
if (contentEncryptionAlgorithm == null
7373
|| contentEncryptionAlgorithm.equals(AlgorithmSuite.ALG_AES_256_CBC_IV16_NO_KDF.cipherName())) {
@@ -89,24 +89,24 @@ public ContentMetadata decodeMetadata(GetObjectResponse response) {
8989
switch (algorithmSuite) {
9090
case ALG_AES_256_CBC_IV16_NO_KDF:
9191
// Extract encrypted data key ciphertext
92-
edkCiphertext = _decoder.decode(metadata.get(MetadataKey.ENCRYPTED_DATA_KEY_V1));
92+
edkCiphertext = _decoder.decode(metadata.get(MetadataKeyConstants.ENCRYPTED_DATA_KEY_V1));
9393

9494
// Hardcode the key provider id to match what V1 does
9595
keyProviderInfo = "AES";
9696

9797
break;
9898
case ALG_AES_256_GCM_IV12_TAG16_NO_KDF:
9999
// Check tag length
100-
final int tagLength = Integer.parseInt(metadata.get(MetadataKey.CONTENT_CIPHER_TAG_LENGTH));
100+
final int tagLength = Integer.parseInt(metadata.get(MetadataKeyConstants.CONTENT_CIPHER_TAG_LENGTH));
101101
if (tagLength != algorithmSuite.cipherTagLengthBits()) {
102102
throw new S3EncryptionClientException("Expected tag length (bits) of: "
103103
+ algorithmSuite.cipherTagLengthBits()
104104
+ ", got: " + tagLength);
105105
}
106106

107107
// Extract encrypted data key ciphertext and provider id
108-
edkCiphertext = _decoder.decode(metadata.get(MetadataKey.ENCRYPTED_DATA_KEY_V2));
109-
keyProviderInfo = metadata.get(MetadataKey.ENCRYPTED_DATA_KEY_ALGORITHM);
108+
edkCiphertext = _decoder.decode(metadata.get(MetadataKeyConstants.ENCRYPTED_DATA_KEY_V2));
109+
keyProviderInfo = metadata.get(MetadataKeyConstants.ENCRYPTED_DATA_KEY_ALGORITHM);
110110

111111
break;
112112
default:
@@ -123,7 +123,7 @@ public ContentMetadata decodeMetadata(GetObjectResponse response) {
123123

124124
// Get encrypted data key encryption context
125125
final Map<String, String> encryptionContext = new HashMap<>();
126-
final String jsonEncryptionContext = metadata.get(MetadataKey.ENCRYPTED_DATA_KEY_CONTEXT);
126+
final String jsonEncryptionContext = metadata.get(MetadataKeyConstants.ENCRYPTED_DATA_KEY_CONTEXT);
127127
try {
128128
JsonNodeParser parser = JsonNodeParser.create();
129129
JsonNode objectNode = parser.parse(jsonEncryptionContext);
@@ -136,7 +136,7 @@ public ContentMetadata decodeMetadata(GetObjectResponse response) {
136136
}
137137

138138
// Get content nonce
139-
byte[] nonce = _decoder.decode(metadata.get(MetadataKey.CONTENT_NONCE));
139+
byte[] nonce = _decoder.decode(metadata.get(MetadataKeyConstants.CONTENT_NONCE));
140140

141141
return ContentMetadata.builder()
142142
.algorithmSuite(algorithmSuite)

0 commit comments

Comments
 (0)