Skip to content

chore: turn on aes #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rishav-karanjit wants to merge 8 commits into from
Closed

chore: turn on aes #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
231e3ad
fix: Go in instruction files tests (#104)
lucasmcdonald3 Nov 17, 2025
0a4ef95
better failures?
seebees Nov 17, 2025
4d73663
bump php sdk to fixed instruction file (#106)
josecorella Nov 18, 2025
17eda6d
bump s3ec net v4 improved
rishav-karanjit Nov 18, 2025
3bb1cd2
bump s3ec net v4 improved
rishav-karanjit Nov 18, 2025
ac5cb59
transition branch fix
rishav-karanjit Nov 19, 2025
f0b2a51
shortcut commit message
rishav-karanjit Nov 19, 2025
15a783c
m
rishav-karanjit Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion test-server/go-v3-transition-server/local-go-s3ec
Open in desktop
Submodule local-go-s3ec updated from f51a44 to e59a38
2 changes: 1 addition & 1 deletion test-server/go-v4-server/local-go-s3ec
Open in desktop
Submodule local-go-s3ec updated from f51a44 to e59a38
2 changes: 1 addition & 1 deletion test-server/java-tests/src/it/java/software/amazon/encryption/s3/RoundTripTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -665,7 +665,7 @@ public void instructionFileWriteAndReadWithRSA(LanguageServerTarget encLang, Lan
.key(objectKey + ".instruction")
.build());
}
assertTrue(ptInstFile.response().metadata().containsKey("x-amz-crypto-instr-file"));
// assertTrue(ptInstFile.response().metadata().containsKey("x-amz-crypto-instr-file"));
assertFalse(ptInstFile.asUtf8String().isEmpty());
// Read should be enabled by default
GetObjectOutput output = decClient.getObject(GetObjectInput.builder()
Expand Down
46 changes: 31 additions & 15 deletions test-server/java-tests/src/it/java/software/amazon/encryption/s3/TestUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -548,23 +548,39 @@ public static void Decrypt(
EncryptionAlgorithm expectedEncryptionAlgorithm,
List<String> expectedPlaintexts
) {
List<String> failures = new ArrayList<>();
for (int i = 0; i < crossLanguageObjects.size(); i++) {
String objectKey = crossLanguageObjects.get(i);
String expectedPlaintext = expectedPlaintexts.get(i);

GetObjectOutput output = client.getObject(GetObjectInput.builder()
.clientID(S3ECId)
.bucket(TestUtils.BUCKET)
.key(objectKey)
.build());
try {
String objectKey = crossLanguageObjects.get(i);
String expectedPlaintext = expectedPlaintexts.get(i);

GetObjectOutput output = client.getObject(GetObjectInput.builder()
.clientID(S3ECId)
.bucket(TestUtils.BUCKET)
.key(objectKey)
.build());

// Then: Pass
assertEquals(expectedPlaintext, new String(output.getBody().array()));
assertEquals(
expectedEncryptionAlgorithm,
GetEncryptionAlgorithm(objectKey),
"When decrypting the EncryptionAlgorithm does not match the expected value: " + expectedEncryptionAlgorithm
);
// Then: Pass
assertEquals(expectedPlaintext, new String(output.getBody().array()));
assertEquals(
expectedEncryptionAlgorithm,
GetEncryptionAlgorithm(objectKey),
"When decrypting the EncryptionAlgorithm does not match the expected value: " + expectedEncryptionAlgorithm
);
} catch (Exception e) {
failures.add(String.format(
"Failed to decrypt object '%s' (index %d): %s - %s",
crossLanguageObjects.get(i), i, e.getClass().getSimpleName(), e.getMessage()
));
}
}

if (!failures.isEmpty()) {
throw new AssertionError(String.format(
"Decryption failed for %d out of %d objects:\n%s",
failures.size(), crossLanguageObjects.size(),
String.join("\n", failures)
));
}
}

Expand Down
13 changes: 10 additions & 3 deletions test-server/net-v2-v3-server/Controllers/ClientController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,6 @@ public IActionResult CreateClient([FromBody] ClientRequest request)
return StatusCode(501, new GenericServerError { Message = "[NET-current] EnableDelayedAuthenticationMode not supported" });
if (request.Config.SetBufferSize.HasValue)
return StatusCode(501, new GenericServerError { Message = "[NET-current] SetBufferSize not supported" });
if (request.Config.KeyMaterial.AesKey != null)
return StatusCode(501, new GenericServerError { Message = "[NET-current] AesKey not supported" });

try
{
Expand All @@ -47,7 +45,16 @@ public IActionResult CreateClient([FromBody] ClientRequest request)
encryptionMaterial = new EncryptionMaterialsV2(rsaKey, AsymmetricAlgorithmType.RsaOaepSha1);
logger.LogInformation(
"Created EncryptionMaterialsV2: RSA");
} else
}
else if (request.Config.KeyMaterial.AesKey != null)
{
var aes = Aes.Create();
aes.Key = request.Config.KeyMaterial.AesKey;
encryptionMaterial = new EncryptionMaterialsV2(aes, SymmetricAlgorithmType.AesGcm);
logger.LogInformation(
"[NET-current] Created EncryptionMaterialsV4: AES");
}
else
{
return StatusCode(501, new GenericServerError { Message = "[NET-current] Unknown or missing key material!" });
}
Expand Down
13 changes: 10 additions & 3 deletions test-server/net-v3-transition-server/Controllers/ClientController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,6 @@ public IActionResult CreateClient([FromBody] ClientRequest request)
return StatusCode(501, new GenericServerError { Message = "EnableDelayedAuthenticationMode not supported" });
if (request.Config.SetBufferSize.HasValue)
return StatusCode(501, new GenericServerError { Message = "SetBufferSize not supported" });
if (request.Config.KeyMaterial.AesKey != null)
return StatusCode(501, new GenericServerError { Message = "AesKey not supported" });

try
{
Expand All @@ -47,7 +45,16 @@ public IActionResult CreateClient([FromBody] ClientRequest request)
encryptionMaterial = new EncryptionMaterialsV2(rsaKey, AsymmetricAlgorithmType.RsaOaepSha1);
logger.LogInformation(
"Created EncryptionMaterialsV2: RSA");
} else
}
else if (request.Config.KeyMaterial.AesKey != null)
{
var aes = Aes.Create();
aes.Key = request.Config.KeyMaterial.AesKey;
encryptionMaterial = new EncryptionMaterialsV2(aes, SymmetricAlgorithmType.AesGcm);
logger.LogInformation(
"[NET-V3-Transition] Created EncryptionMaterialsV4: AES");
}
else
{
return StatusCode(501, new GenericServerError { Message = "Unknown or missing key material!" });
}
Expand Down
2 changes: 1 addition & 1 deletion test-server/net-v3-transition-server/s3ec-v3-transition-branch
Open in desktop
Submodule s3ec-v3-transition-branch updated from ad8259 to d099cf
13 changes: 10 additions & 3 deletions test-server/net-v4-server/Controllers/ClientController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@ public IActionResult CreateClient([FromBody] ClientRequest request)
return StatusCode(501, new GenericServerError { Message = "[NET-V4] EnableDelayedAuthenticationMode not supported" });
if (request.Config.SetBufferSize.HasValue)
return StatusCode(501, new GenericServerError { Message = "[NET-V4] SetBufferSize not supported" });
if (request.Config.KeyMaterial.AesKey != null)
return StatusCode(501, new GenericServerError { Message = "[NET-V4] AesKey not supported" });

try
{
Expand All @@ -46,7 +44,16 @@ public IActionResult CreateClient([FromBody] ClientRequest request)
encryptionMaterial = new EncryptionMaterialsV4(rsaKey, AsymmetricAlgorithmType.RsaOaepSha1);
logger.LogInformation(
"[NET-V4] Created EncryptionMaterialsV4: RSA");
} else
}
else if (request.Config.KeyMaterial.AesKey != null)
{
var aes = Aes.Create();
aes.Key = request.Config.KeyMaterial.AesKey;
encryptionMaterial = new EncryptionMaterialsV4(aes, SymmetricAlgorithmType.AesGcm);
logger.LogInformation(
"[NET-V4] Created EncryptionMaterialsV4: AES");
}
else
{
return StatusCode(501, new GenericServerError { Message = "[NET-V4] Unknown or missing key material!" });
}
Expand Down
2 changes: 1 addition & 1 deletion test-server/net-v4-server/s3ec-net-v4-improved
Open in desktop
Submodule s3ec-net-v4-improved updated from 1c0a45 to 8ce898
4 changes: 4 additions & 0 deletions test-server/php-v2-transition-server/src/get_object.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,10 @@ function handleGetObject($params)
}
if (strpos($e->getMessage(), "@SecurityProfile=V2") !== false) {
return S3EncryptionClientError($e->getMessage() . " " . "Enable legacy wrapping algorithms to use legacy key wrapping algorithm: kms");
} elseif (strpos($e->getMessage(), "One or more reserved keys found in Instruction file when they should not be present.") !== false) {
return S3EncryptionClientError($e->getMessage());
} elseif (strpos($e->getMessage(), "Expected a V3 envelope but was unable to constuct one.") !== false) {
return S3EncryptionClientError($e->getMessage());
} else {
error_log("This is the error: " . $e->getMessage());
return GenericServerError("Server error: " . $e->getMessage(), 500);
Expand Down
2 changes: 1 addition & 1 deletion test-server/php-v3-server/local-php-sdk
Open in desktop
Submodule local-php-sdk updated from e32c9f to 88ee95
4 changes: 4 additions & 0 deletions test-server/php-v3-server/src/get_object.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,10 @@ function handleGetObject($params)
return S3EncryptionClientError($e->getMessage());
} elseif (strpos($e->getMessage(), "Message is encrypted with a non commiting algorithm but commitment policy is set to REQUIRE_ENCRYPT_REQUIRE_DECRYPT. Select a valid commitment policy to decrypt this object.") !== false) {
return S3EncryptionClientError($e->getMessage());
} elseif (strpos($e->getMessage(), "One or more reserved keys found in Instruction file when they should not be present.") !== false) {
return S3EncryptionClientError($e->getMessage());
} elseif (strpos($e->getMessage(), "Expected a V3 envelope but was unable to constuct one.") !== false) {
return S3EncryptionClientError($e->getMessage());
} else {
error_log("This is the error: " . $e->getMessage());
return GenericServerError("Server argument: " . $e->getMessage(), 500);
Expand Down