Skip to content

Clarify if keyring trace entries are a hard requirement on Materials structures #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
robin-aws opened this issue Feb 20, 2020 · 2 comments · Fixed by #105
Closed

Clarify if keyring trace entries are a hard requirement on Materials structures #70

robin-aws opened this issue Feb 20, 2020 · 2 comments · Fixed by #105
Assignees

Comments

@robin-aws
Copy link
Contributor

The specification is very clear that if Keyrings perform operations such as the "generate data key" behaviour, they must also append the appropriate trace entries. Is it permissible for a CMM to exist that does not use Keyrings and that produces materials with data key values populated but no keyring trace entries?

@mattsb42-aws
Copy link
Member

Data for us to consider on this note: This is true of the default CMM in Java and Python when it is used with master key providers. Because master key providers do not emit keyring trace entries, there is no keyring trace for the default CMM to provide in this case.

@mattsb42-aws
Copy link
Member

On a more philosophical note, the way I have always thought of the keyring trace is that it is a record of what actions keyrings have performed. If you have a CMM that does not do anything with keyrings, then by this definition your keyring trace MUST be empty.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants