Unsupported Algorithm Suite

[dnovicki]

Attempting to use decrypt() with cipherText originally encrypted using AWS Encryption SDK Java with Algorithm Suite (ALG_AES_256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384) throws the below error. Am I doing something wrong?

const keyring = new awsCrypto.KmsKeyringNode({ keyIds: ['<insert key>'] });
 const decryptedText = await awsCrypto.decrypt(
    keyring,
    cipherText
  );

While debugging suiteId in source, the UInt16 value is 16708 instead of intended 888

2019-09-12T20:14:38.764Z 6edd46cd-74ce-40b2-9a59-4d764d17d4b2 INFO Error: Unsupported algorithm suite.
at Object.needs (/var/task/node_modules/@aws-crypto/material-management/build/main/needs.js:29:15)
at Object.deserializeMessageHeader (/var/task/node_modules/@aws-crypto/serialize/build/main/deserialize_factory.js:67:27)
at ParseHeaderStream._transform (/var/task/node_modules/@aws-crypto/decrypt-node/build/main/parse_header_stream.js:37:40)
at ParseHeaderStream.Transform._read (/var/task/node_modules/readable-stream/lib/_stream_transform.js:177:10)
at ParseHeaderStream.Transform._write (/var/task/node_modules/readable-stream/lib/_stream_transform.js:164:83)
at doWrite (/var/task/node_modules/readable-stream/lib/_stream_writable.js:405:139)
at writeOrBuffer (/var/task/node_modules/readable-stream/lib/_stream_writable.js:394:5)
at ParseHeaderStream.Writable.write (/var/task/node_modules/readable-stream/lib/_stream_writable.js:303:11)
at Duplexify._write (/var/task/node_modules/duplexify/index.js:212:22)
at doWrite (/var/task/node_modules/readable-stream/lib/_stream_writable.js:405:139)

[seebees]

Hi, how was this data encrypted in Java? Was it encrypted encryptData or encryptString?

[dnovicki]

encryptString

[dnovicki]

I might add the the Java implementation decrypts with no issues using decryptString. I am attempting to replicate this implementation in JS

[seebees]

Excellent. These functions in Java add a base64 encode/decode step. I assume that in your example cipherText is a string? If this is the case, then you need to pass an encoding.

const decryptedText = await awsCrypto.decrypt(
  keyring,
  cipherText,
  { encoding: 'base64' }
)

If you want to not involve the base64 encoding,
then you can use the encryptData function to just use bytes.

See: https://aws.github.io/aws-encryption-sdk-java/javadoc/com/amazonaws/encryptionsdk/AwsCrypto.html#encryptString(com.amazonaws.encryptionsdk.MasterKeyProvider,java.lang.String,java.util.Map)

[dnovicki]

This resolved my error thanks. I do now have a new error that I am unfamiliar with, is it related?

2019-09-12T23:22:01.759Z c90856a8-baf2-4640-995b-34791e9f2dd5 INFO Error: unencryptedDataKey has not been set
at Object.needs (/var/task/node_modules/@aws-crypto/material-management/build/main/needs.js:29:15)
at NodeDecryptionMaterial.getUnencryptedDataKey (/var/task/node_modules/@aws-crypto/material-management/build/main/cryptographic_material.js:206:17)
at NodeDefaultCryptographicMaterialsManager.decryptMaterials (/var/task/node_modules/@aws-crypto/material-management-node/build/main/node_cryptographic_materials_manager.js:50:46)
at process._tickCallback (internal/process/next_tick.js:68:7)

[seebees]

My guess is that they Keyring was not able to decrypt the data key. Are you using AWS KMS? How are you configuring your keyrings?

[dnovicki]

@seebees Are you an AWS Employee? If so maybe we can take this offline. I cannot find your handle internally, message me?

Closing issue as my original issue has been solved.

[dnovicki]

Summary of original issue:
When decrypting cipher text encrypted using decryptString() in the AWS Encryption Java SDK without passing { encoding: 'base64' } as a option to the decrypt() function will cause the algorithm suite mapping to fail. Base64 encoding is required in the Java implementation.

Summary of follow up issue:
If correct KMS IAM policies are not set on invoking context or KMS account or the key does not exist in the same region, the error unencryptedDataKey has not been set will throw. This seems to be caused by KMS not giving back a data key used in decryption. It turns out I just needed to double check the correct IAM policies on my Lambda to allow access to the cross-account key in KMS