Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(examples): Raw ECDH and KMS ECDH #692

Draft
wants to merge 3 commits into
base: rkapila/rust-reviewed
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
.await?;

// 4. Encrypt the data with the encryptionContext using the encrypt_keyring.
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(mrk_keyring_with_client_supplier)
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -87,7 +87,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 5. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 6. Create a MRK discovery multi-keyring with a custom client supplier.
Expand Down Expand Up @@ -137,7 +137,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 8. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// 9. Test the Missing Region Exception
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,10 @@ pub async fn encrypt_and_decrypt_with_cmm(
// NOTE: the keys "requiredKey1", and "requiredKey2"
// WILL NOT be stored in the message header, but "encryption", "is not",
// "but adds", "that can help you", and "the data you are handling" WILL be stored.
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.materials_manager(required_ec_cmm.clone())
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -99,7 +99,7 @@ pub async fn encrypt_and_decrypt_with_cmm(

// 8. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 9. Decrypt your encrypted data using the same keyring you used on encrypt.
Expand All @@ -117,7 +117,7 @@ pub async fn encrypt_and_decrypt_with_cmm(

// 10. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// 11. Attempt to decrypt your encrypted data using the same cryptographic material manager
Expand Down Expand Up @@ -159,7 +159,7 @@ pub async fn encrypt_and_decrypt_with_cmm(

// Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext_with_reproduced_ec, plaintext,
assert_eq!(decrypted_plaintext_with_reproduced_ec, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// 13. You can decrypt the ciphertext using the underlying cmm, but not providing the
Expand All @@ -181,7 +181,7 @@ pub async fn encrypt_and_decrypt_with_cmm(

// Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext_with_ec_underlying_cmm, plaintext,
assert_eq!(decrypted_plaintext_with_ec_underlying_cmm, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// This will fail
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -62,10 +62,10 @@ pub async fn encrypt_and_decrypt_with_cmm(
};

// 5. Encrypt the data with the encryption_context
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.materials_manager(signing_suite_only_cmm_ref.clone())
.encryption_context(encryption_context.clone())
.algorithm_suite_id(EsdkAlgorithmSuiteId::AlgAes256GcmHkdfSha512CommitKeyEcdsaP384)
Expand All @@ -78,7 +78,7 @@ pub async fn encrypt_and_decrypt_with_cmm(

// 6. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 7. Decrypt your encrypted data using the same keyring you used on encrypt.
Expand All @@ -96,13 +96,13 @@ pub async fn encrypt_and_decrypt_with_cmm(

// 8. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// 9. Demonstrate that a Non Signing Algorithm Suite will be rejected
// by the CMM.
let encryption_response_non_signing = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.materials_manager(signing_suite_only_cmm_ref)
.encryption_context(encryption_context.clone())
.algorithm_suite_id(EsdkAlgorithmSuiteId::AlgAes256GcmHkdfSha512CommitKey)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -87,10 +87,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
.await?;

// 5. Encrypt the data with the encryption_context
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(encrypt_kms_keyring)
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -102,7 +102,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 6. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 7. Now create a Discovery keyring to use for decryption. We'll add a discovery filter
Expand Down Expand Up @@ -147,7 +147,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 9. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// 10. Demonstrate that if a different discovery keyring (Bob's) doesn't have the correct
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -85,10 +85,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
.await?;

// 5. Encrypt the data with the encryption_context
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(encrypt_kms_keyring)
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -100,7 +100,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 6. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 7. Now create a Discovery Multi keyring to use for decryption. We'll add a discovery filter
Expand Down Expand Up @@ -147,7 +147,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 9. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

println!("KMS Discovery Multi Keyring Example Completed Successfully");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -139,10 +139,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
]);

// 8. Encrypt the data with encryptionContextA & encryptionContextB
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response_a = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(hierarchical_keyring.clone())
.encryption_context(encryption_context_a.clone())
.send()
Expand All @@ -153,7 +153,7 @@ pub async fn encrypt_and_decrypt_with_keyring(
.expect("Unable to unwrap ciphertext from encryption response");

let encryption_response_b = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(hierarchical_keyring.clone())
.encryption_context(encryption_context_b.clone())
.send()
Expand All @@ -165,10 +165,10 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 9. Demonstrate that the ciphertexts and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext_a, plaintext,
assert_ne!(ciphertext_a, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

assert_ne!(ciphertext_b, plaintext,
assert_ne!(ciphertext_b, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 10. To attest that TenantKeyB cannot decrypt a message written by TenantKeyA,
Expand Down Expand Up @@ -244,7 +244,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext_a, plaintext,
assert_eq!(decrypted_plaintext_a, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// Similarly for TenantB
Expand All @@ -262,7 +262,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext_b, plaintext,
assert_eq!(decrypted_plaintext_b, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

println!("Hierarchical Keyring Example Completed Successfully");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -179,10 +179,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
]);

// 7. Encrypt the data for encryption_context using keyring1
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response1 = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(keyring1.clone())
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -194,7 +194,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 8. Demonstrate that the ciphertexts and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext1, plaintext,
assert_ne!(ciphertext1, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 9. Decrypt your encrypted data using the same keyring HK1 you used on encrypt.
Expand All @@ -212,7 +212,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 10. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext1, plaintext,
assert_eq!(decrypted_plaintext1, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

// 11. Through the above encrypt and decrypt roundtrip, the cache will be populated and
Expand Down Expand Up @@ -259,7 +259,7 @@ pub async fn encrypt_and_decrypt_with_keyring(
// 13. This encrypt-decrypt roundtrip with HK2 will experience Cache HITS from previous HK1 roundtrip
// Encrypt the data for encryption_context using keyring2
let encryption_response2 = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(keyring2.clone())
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -271,7 +271,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 14. Demonstrate that the ciphertexts and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext2, plaintext,
assert_ne!(ciphertext2, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 15. Decrypt your encrypted data using the same keyring HK2 you used on encrypt.
Expand All @@ -289,7 +289,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 10. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext2, plaintext,
assert_eq!(decrypted_plaintext2, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

println!("Shared Cache Across Hierarchical Keyrings Example Completed Successfully");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
.await?;

// 5. Encrypt the data with the encryption_context
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(kms_keyring.clone())
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -82,7 +82,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 6. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 7. Decrypt your encrypted data using the same keyring you used on encrypt.
Expand All @@ -100,7 +100,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 8. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

println!("KMS Keyring Example Completed Successfully");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -95,10 +95,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
.await?;

// 4. Encrypt the data with the encryptionContext using the encrypt_keyring.
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(encrypt_kms_keyring)
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -110,7 +110,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 5. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 6. Now create a Discovery keyring to use for decryption.
Expand Down Expand Up @@ -153,7 +153,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 8. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

println!("KMS MRK Discovery Keyring Example Completed Successfully");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -97,10 +97,10 @@ pub async fn encrypt_and_decrypt_with_keyring(
.await?;

// 4. Encrypt the data with the encryptionContext using the encrypt_keyring.
let plaintext = aws_smithy_types::Blob::new(example_data);
let plaintext = example_data.as_bytes();

let encryption_response = esdk_client.encrypt()
.plaintext(plaintext.clone())
.plaintext(plaintext)
.keyring(encrypt_kms_keyring)
.encryption_context(encryption_context.clone())
.send()
Expand All @@ -112,7 +112,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 5. Demonstrate that the ciphertext and plaintext are different.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_ne!(ciphertext, plaintext,
assert_ne!(ciphertext, aws_smithy_types::Blob::new(plaintext),
"Ciphertext and plaintext data are the same. Invalid encryption");

// 6. Now create a MRK Discovery Multi Keyring to use for decryption.
Expand Down Expand Up @@ -163,7 +163,7 @@ pub async fn encrypt_and_decrypt_with_keyring(

// 8. Demonstrate that the decrypted plaintext is identical to the original plaintext.
// (This is an example for demonstration; you do not need to do this in your own code.)
assert_eq!(decrypted_plaintext, plaintext,
assert_eq!(decrypted_plaintext, aws_smithy_types::Blob::new(plaintext),
"Decrypted plaintext should be identical to the original plaintext. Invalid decryption");

println!("KMS MRK Discovery Multi Keyring Example Completed Successfully");
Expand Down
Loading
Loading