|
| 1 | +# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. |
| 2 | +# SPDX-License-Identifier: Apache-2.0 |
| 3 | +"""Example to create a custom crypto material manager class.""" |
| 4 | + |
| 5 | +import aws_encryption_sdk |
| 6 | +from aws_encryption_sdk import CommitmentPolicy |
| 7 | +from aws_encryption_sdk.materials_managers.base import CryptoMaterialsManager |
| 8 | + |
| 9 | + |
| 10 | +# Custom CMM implementation. |
| 11 | +# This CMM only allows encryption/decryption using signing algorithms. |
| 12 | +# It wraps an underlying CMM implementation and checks its materials |
| 13 | +# to ensure that it is only using signed encryption algorithms. |
| 14 | +class CustomSigningSuiteOnlyCMM(CryptoMaterialsManager): |
| 15 | + """Example custom crypto materials manager class.""" |
| 16 | + |
| 17 | + def __init__(self, cmm: CryptoMaterialsManager) -> None: |
| 18 | + super().__init__() |
| 19 | + self.underlying_cmm = cmm |
| 20 | + |
| 21 | + def get_encryption_materials(self, request): |
| 22 | + """Provides encryption materials appropriate for the request for the custom CMM. |
| 23 | +
|
| 24 | + :param EncryptionMaterialsRequest request: Request object to provide to a |
| 25 | + crypto material manager's `get_encryption_materials` method. |
| 26 | + :returns: Encryption materials |
| 27 | + :rtype: EncryptionMaterials |
| 28 | + """ |
| 29 | + materials = self.underlying_cmm.get_encryption_materials(request) |
| 30 | + if not materials.algorithm.is_signing(): |
| 31 | + raise AssertionError( |
| 32 | + "Algorithm provided to CustomSigningSuiteOnlyCMM" |
| 33 | + + " is not a supported signing algorithm: " + materials.algorithm |
| 34 | + ) |
| 35 | + return materials |
| 36 | + |
| 37 | + def decrypt_materials(self, request): |
| 38 | + """Provider decryption materials appropriate for the request. |
| 39 | +
|
| 40 | + :param DecryptionMaterialsRequest request: Request object to provide to a |
| 41 | + crypto material manager's `decrypt_materials` method. |
| 42 | + """ |
| 43 | + if not request.algorithm.is_signing(): |
| 44 | + raise AssertionError( |
| 45 | + "Algorithm provided to CustomSigningSuiteOnlyCMM" |
| 46 | + + " is not a supported signing algorithm: " + request.algorithm |
| 47 | + ) |
| 48 | + return self.underlying_cmm.decrypt_materials(request) |
| 49 | + |
| 50 | + |
| 51 | +def encrypt_decrypt_with_cmm( |
| 52 | + cmm: CryptoMaterialsManager, |
| 53 | + source_plaintext: str |
| 54 | +): |
| 55 | + """Encrypts and decrypts a string using a CMM. |
| 56 | +
|
| 57 | + :param CryptoMaterialsManager cmm: CMM to use for encryption and decryption |
| 58 | + :param bytes source_plaintext: Data to encrypt |
| 59 | + """ |
| 60 | + # Set up an encryption client with an explicit commitment policy. Note that if you do not explicitly choose a |
| 61 | + # commitment policy, REQUIRE_ENCRYPT_REQUIRE_DECRYPT is used by default. |
| 62 | + client = aws_encryption_sdk.EncryptionSDKClient(commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT) |
| 63 | + |
| 64 | + # Encrypt the plaintext source data |
| 65 | + ciphertext, encryptor_header = client.encrypt( |
| 66 | + source=source_plaintext, |
| 67 | + materials_manager=cmm |
| 68 | + ) |
| 69 | + |
| 70 | + # Decrypt the ciphertext |
| 71 | + cycled_plaintext, decrypted_header = client.decrypt( |
| 72 | + source=ciphertext, |
| 73 | + materials_manager=cmm |
| 74 | + ) |
| 75 | + |
| 76 | + # Verify that the "cycled" (encrypted, then decrypted) plaintext is identical to the source plaintext |
| 77 | + assert cycled_plaintext == source_plaintext |
| 78 | + |
| 79 | + # Verify that the encryption context used in the decrypt operation includes all key pairs from |
| 80 | + # the encrypt operation. (The SDK can add pairs, so don't require an exact match.) |
| 81 | + # |
| 82 | + # In production, always use a meaningful encryption context. In this sample, we omit the |
| 83 | + # encryption context (no key pairs). |
| 84 | + assert all( |
| 85 | + pair in decrypted_header.encryption_context.items() for pair in encryptor_header.encryption_context.items() |
| 86 | + ) |
0 commit comments