Skip to content

Commit aff10d9

Browse files
author
Anirav Kareddy
committed
Add validation tests to demonstrate that setting enableLegacyWrappingAlgorithms
on the S3 Encryption Client while passing in a keyring that does not have it enabled will fail
1 parent d217f60 commit aff10d9

File tree

1 file changed

+257
-0
lines changed

1 file changed

+257
-0
lines changed

‎src/test/java/software/amazon/encryption/s3/S3EncryptionClientCompatibilityTest.java‎

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
import com.amazonaws.services.s3.model.KMSEncryptionMaterials;
1919
import com.amazonaws.services.s3.model.KMSEncryptionMaterialsProvider;
2020
import com.amazonaws.services.s3.model.StaticEncryptionMaterialsProvider;
21+
import org.bouncycastle.jcajce.provider.symmetric.AES;
2122
import org.junit.jupiter.api.BeforeAll;
2223
import org.junit.jupiter.api.Test;
2324
import software.amazon.awssdk.core.ResponseBytes;
@@ -28,6 +29,10 @@
2829
import software.amazon.awssdk.services.s3.model.MetadataDirective;
2930
import software.amazon.awssdk.services.s3.model.PutObjectRequest;
3031
import software.amazon.encryption.s3.internal.InstructionFileConfig;
32+
import software.amazon.encryption.s3.materials.AesKeyring;
33+
import software.amazon.encryption.s3.materials.KmsKeyring;
34+
import software.amazon.encryption.s3.materials.PartialRsaKeyPair;
35+
import software.amazon.encryption.s3.materials.RsaKeyring;
3136

3237
import javax.crypto.KeyGenerator;
3338
import javax.crypto.SecretKey;
@@ -42,6 +47,7 @@
4247

4348
import static org.junit.jupiter.api.Assertions.assertEquals;
4449
import static org.junit.jupiter.api.Assertions.assertThrows;
50+
import static org.junit.jupiter.api.Assertions.assertTrue;
4551
import static software.amazon.encryption.s3.S3EncryptionClient.withAdditionalConfiguration;
4652
import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.BUCKET;
4753
import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.KMS_KEY_ID;
@@ -962,4 +968,255 @@ public void nullMaterialDescriptionV3() {
962968
v3Client.close();
963969

964970
}
971+
972+
@Test
973+
public void validateAgainstSettingLegacyWrappingOnClientWithAesKeyringPassedV1toV3() {
974+
final String objectKey = appendTestSuffix("validate-against-setting-legacy-wrapping-on-client-with-aes-keyring-v1-to-v3");
975+
final String input = "Validate Against Setting Legacy Wrapping On Client With AES Keyring V1 to V3";
976+
977+
EncryptionMaterialsProvider materialsProvider =
978+
new StaticEncryptionMaterialsProvider(new EncryptionMaterials(AES_KEY));
979+
CryptoConfiguration v1CryptoConfig =
980+
new CryptoConfiguration(CryptoMode.AuthenticatedEncryption);
981+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
982+
.withCryptoConfiguration(v1CryptoConfig)
983+
.withEncryptionMaterials(materialsProvider)
984+
.build();
985+
986+
v1Client.putObject(BUCKET, objectKey, input);
987+
988+
AesKeyring aesKeyring = AesKeyring.builder()
989+
.wrappingKey(AES_KEY)
990+
.build();
991+
992+
S3Client wrappedClient = S3Client.create();
993+
S3Client v3Client = S3EncryptionClient.builder()
994+
.keyring(aesKeyring)
995+
.wrappedClient(wrappedClient)
996+
.enableLegacyUnauthenticatedModes(true)
997+
.enableLegacyWrappingAlgorithms(true)
998+
.build();
999+
1000+
try {
1001+
ResponseBytes<GetObjectResponse> output = v3Client.getObjectAsBytes(builder -> builder
1002+
.bucket(BUCKET)
1003+
.key(objectKey));
1004+
throw new RuntimeException("Expected failure");
1005+
} catch (Exception e) {
1006+
assertTrue(e.getMessage().contains("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: AESWrap"));
1007+
}
1008+
1009+
deleteObject(BUCKET, objectKey, v3Client);
1010+
v3Client.close();
1011+
}
1012+
1013+
@Test
1014+
public void validateAgainstSettingLegacyWrappingOnClientWithAesKeyringPassedV1toV3EncryptionOnly() {
1015+
final String objectKey = appendTestSuffix("validate-against-setting-legacy-wrapping-on-client-with-aes-keyring-v1-to-v3-encryption-only");
1016+
final String input = "Validate Against Setting Legacy Wrapping On Client With AES Keyring V1 to V3";
1017+
1018+
EncryptionMaterialsProvider materialsProvider =
1019+
new StaticEncryptionMaterialsProvider(new EncryptionMaterials(AES_KEY));
1020+
CryptoConfiguration v1CryptoConfig =
1021+
new CryptoConfiguration(CryptoMode.EncryptionOnly);
1022+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
1023+
.withCryptoConfiguration(v1CryptoConfig)
1024+
.withEncryptionMaterials(materialsProvider)
1025+
.build();
1026+
1027+
v1Client.putObject(BUCKET, objectKey, input);
1028+
1029+
AesKeyring aesKeyring = AesKeyring.builder()
1030+
.wrappingKey(AES_KEY)
1031+
.build();
1032+
1033+
S3Client wrappedClient = S3Client.create();
1034+
S3Client v3Client = S3EncryptionClient.builder()
1035+
.keyring(aesKeyring)
1036+
.wrappedClient(wrappedClient)
1037+
.enableLegacyUnauthenticatedModes(true)
1038+
.enableLegacyWrappingAlgorithms(true)
1039+
.build();
1040+
1041+
try {
1042+
ResponseBytes<GetObjectResponse> output = v3Client.getObjectAsBytes(builder -> builder
1043+
.bucket(BUCKET)
1044+
.key(objectKey));
1045+
throw new RuntimeException("Expected failure");
1046+
} catch (Exception e) {
1047+
assertTrue(e.getMessage().contains("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: AES"));
1048+
}
1049+
1050+
deleteObject(BUCKET, objectKey, v3Client);
1051+
v3Client.close();
1052+
}
1053+
1054+
@Test
1055+
public void validateAgainstSettingLegacyWrappingOnClientWithRsaKeyringPassedV1toV3() {
1056+
final String objectKey = appendTestSuffix("validate-against-setting-legacy-wrapping-on-client-with-rsa-keyring-v1-to-v3");
1057+
final String input = "Validate Against Setting Legacy Wrapping On Client With RSA Keyring V1 to V3";
1058+
1059+
EncryptionMaterialsProvider materialsProvider =
1060+
new StaticEncryptionMaterialsProvider(new EncryptionMaterials(RSA_KEY_PAIR));
1061+
CryptoConfiguration v1CryptoConfig =
1062+
new CryptoConfiguration(CryptoMode.StrictAuthenticatedEncryption);
1063+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
1064+
.withCryptoConfiguration(v1CryptoConfig)
1065+
.withEncryptionMaterials(materialsProvider)
1066+
.build();
1067+
1068+
v1Client.putObject(BUCKET, objectKey, input);
1069+
1070+
PartialRsaKeyPair partialRsaKeyPair = PartialRsaKeyPair.builder()
1071+
.publicKey(RSA_KEY_PAIR.getPublic())
1072+
.privateKey(RSA_KEY_PAIR.getPrivate())
1073+
.build();
1074+
1075+
RsaKeyring rsaKeyring = RsaKeyring.builder()
1076+
.wrappingKeyPair(partialRsaKeyPair)
1077+
.build();
1078+
1079+
S3Client wrappedClient = S3Client.create();
1080+
S3Client v3Client = S3EncryptionClient.builder()
1081+
.keyring(rsaKeyring)
1082+
.wrappedClient(wrappedClient)
1083+
.enableLegacyUnauthenticatedModes(true)
1084+
.enableLegacyWrappingAlgorithms(true)
1085+
.build();
1086+
1087+
try {
1088+
ResponseBytes<GetObjectResponse> output = v3Client.getObjectAsBytes(builder -> builder
1089+
.bucket(BUCKET)
1090+
.key(objectKey));
1091+
throw new RuntimeException("Expected failure");
1092+
} catch (Exception e) {
1093+
assertTrue(e.getMessage().contains("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: RSA/ECB/OAEPWithSHA-256AndMGF1Padding"));
1094+
}
1095+
1096+
deleteObject(BUCKET, objectKey, v3Client);
1097+
v3Client.close();
1098+
}
1099+
1100+
@Test
1101+
public void validateAgainstSettingLegacyWrappingOnClientWithRsaKeyringPassedV1toV3EncryptionOnly() {
1102+
final String objectKey = appendTestSuffix("validate-against-setting-legacy-wrapping-on-client-with-rsa-keyring-v1-to-v3-encryption-only");
1103+
final String input = "Validate Against Setting Legacy Wrapping On Client With RSA Keyring V1 to V3";
1104+
1105+
EncryptionMaterialsProvider materialsProvider =
1106+
new StaticEncryptionMaterialsProvider(new EncryptionMaterials(RSA_KEY_PAIR));
1107+
CryptoConfiguration v1CryptoConfig =
1108+
new CryptoConfiguration(CryptoMode.EncryptionOnly);
1109+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
1110+
.withCryptoConfiguration(v1CryptoConfig)
1111+
.withEncryptionMaterials(materialsProvider)
1112+
.build();
1113+
1114+
v1Client.putObject(BUCKET, objectKey, input);
1115+
1116+
PartialRsaKeyPair partialRsaKeyPair = PartialRsaKeyPair.builder()
1117+
.publicKey(RSA_KEY_PAIR.getPublic())
1118+
.privateKey(RSA_KEY_PAIR.getPrivate())
1119+
.build();
1120+
1121+
RsaKeyring rsaKeyring = RsaKeyring.builder()
1122+
.wrappingKeyPair(partialRsaKeyPair)
1123+
.build();
1124+
1125+
S3Client wrappedClient = S3Client.create();
1126+
S3Client v3Client = S3EncryptionClient.builder()
1127+
.keyring(rsaKeyring)
1128+
.wrappedClient(wrappedClient)
1129+
.enableLegacyUnauthenticatedModes(true)
1130+
.enableLegacyWrappingAlgorithms(true)
1131+
.build();
1132+
1133+
try {
1134+
ResponseBytes<GetObjectResponse> output = v3Client.getObjectAsBytes(builder -> builder
1135+
.bucket(BUCKET)
1136+
.key(objectKey));
1137+
throw new RuntimeException("Expected failure");
1138+
} catch (Exception e) {
1139+
assertTrue(e.getMessage().contains("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: RSA"));
1140+
}
1141+
1142+
deleteObject(BUCKET, objectKey, v3Client);
1143+
v3Client.close();
1144+
}
1145+
1146+
@Test
1147+
public void validateAgainstSettingLegacyWrappingOnClientWithKmsKeyringPassedV1toV3EncryptionOnly() {
1148+
final String objectKey = appendTestSuffix("validate-against-setting-legacy-wrapping-on-client-with-kms-keyring-v1-to-v3-encryption-only");
1149+
final String input = "Validate Against Setting Legacy Wrapping On Client With KMS Keyring V1 to V3";
1150+
1151+
KMSEncryptionMaterials kmsMaterials = new KMSEncryptionMaterials(KMS_KEY_ID);
1152+
kmsMaterials.addDescription("user-metadata-key", "user-metadata-value-v1-to-v3");
1153+
EncryptionMaterialsProvider materialsProvider = new KMSEncryptionMaterialsProvider(kmsMaterials);
1154+
1155+
CryptoConfiguration v1CryptoConfig =
1156+
new CryptoConfiguration(CryptoMode.EncryptionOnly);
1157+
1158+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
1159+
.withCryptoConfiguration(v1CryptoConfig)
1160+
.withEncryptionMaterials(materialsProvider)
1161+
.build();
1162+
1163+
v1Client.putObject(BUCKET, objectKey, input);
1164+
S3Client wrappedClient = S3Client.create();
1165+
S3Client v3Client = S3EncryptionClient.builder()
1166+
.keyring(KmsKeyring.builder()
1167+
.wrappingKeyId(KMS_KEY_ID)
1168+
.build())
1169+
.wrappedClient(wrappedClient)
1170+
.enableLegacyUnauthenticatedModes(true)
1171+
.enableLegacyWrappingAlgorithms(true)
1172+
.build();
1173+
1174+
try {
1175+
ResponseBytes<GetObjectResponse> output = v3Client.getObjectAsBytes(builder -> builder
1176+
.bucket(BUCKET)
1177+
.key(objectKey));
1178+
throw new RuntimeException("Expected failure");
1179+
} catch (Exception e) {
1180+
assertTrue(e.getMessage().contains("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: kms"));
1181+
}
1182+
}
1183+
1184+
@Test
1185+
public void validateAgainstSettingLegacyWrappingOnClientWithKmsKeyringPassedV1toV3() {
1186+
final String objectKey = appendTestSuffix("validate-against-setting-legacy-wrapping-on-client-with-kms-keyring-v1-to-v3");
1187+
final String input = "Validate Against Setting Legacy Wrapping On Client With KMS Keyring V1 to V3";
1188+
1189+
KMSEncryptionMaterials kmsMaterials = new KMSEncryptionMaterials(KMS_KEY_ID);
1190+
kmsMaterials.addDescription("user-metadata-key", "user-metadata-value-v1-to-v3");
1191+
EncryptionMaterialsProvider materialsProvider = new KMSEncryptionMaterialsProvider(kmsMaterials);
1192+
1193+
CryptoConfiguration v1CryptoConfig =
1194+
new CryptoConfiguration(CryptoMode.AuthenticatedEncryption);
1195+
1196+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
1197+
.withCryptoConfiguration(v1CryptoConfig)
1198+
.withEncryptionMaterials(materialsProvider)
1199+
.build();
1200+
1201+
v1Client.putObject(BUCKET, objectKey, input);
1202+
S3Client wrappedClient = S3Client.create();
1203+
S3Client v3Client = S3EncryptionClient.builder()
1204+
.keyring(KmsKeyring.builder()
1205+
.wrappingKeyId(KMS_KEY_ID)
1206+
.build())
1207+
.wrappedClient(wrappedClient)
1208+
.enableLegacyUnauthenticatedModes(true)
1209+
.enableLegacyWrappingAlgorithms(true)
1210+
.build();
1211+
1212+
try {
1213+
ResponseBytes<GetObjectResponse> output = v3Client.getObjectAsBytes(builder -> builder
1214+
.bucket(BUCKET)
1215+
.key(objectKey));
1216+
throw new RuntimeException("Expected failure");
1217+
} catch (Exception e) {
1218+
assertTrue(e.getMessage().contains("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: kms"));
1219+
}
1220+
}
1221+
9651222
}

0 commit comments

Comments
 (0)