Skip to content

[feature proposal] additional keyring trace entries #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
mattsb42-aws opened this issue Apr 24, 2020 · 0 comments · Fixed by #105
Closed

[feature proposal] additional keyring trace entries #97

mattsb42-aws opened this issue Apr 24, 2020 · 0 comments · Fixed by #105
Assignees
@mattsb42-aws
Labels
Doc impact Requires a change to AWS documentation enhancement New feature or request
Milestone
Spec 1.0 (Officia...

Comments

@mattsb42-aws
Copy link
Member

NOTE: I would argue that this is dependent on and blocked by #95.

Problem

One of the common challenges that users of the AWS Encryption SDK encounter is how to debug why an encryption or decryption did not work. The keyring trace can help to audit what worked but does not currently help determine if something did not work.

Type of Problem

feature

Actual Behavior

Keyrings currently only add entries to the trace on success.

Desired Behavior

Keyrings should add entries to the keyring trace that describe what they did for no-ops and failure as well as success.

Proposed Solution

In order to help close the debugging issue, this proposal is to add additional trace entry flags that keyrings SHOULD use in new trace entries.

  • SKIPPED : Keyring was engaged but did not attempt to decrypt any EDKs.
  • DECRYPT_FAILED : Keyring attempted to decrypt EDK but failed.

Open questions:

  • How many entries should a keyring add?
    • Trace entries do not contain any information about the EDK, each keyring should probably only add one trace entry.
@mattsb42-aws mattsb42-aws added Doc impact Requires a change to AWS documentation enhancement New feature or request labels Apr 24, 2020
seebees added a commit to seebees/aws-encryption-sdk-javascript that referenced this issue Apr 25, 2020
@seebees
fix: Better messages when no keyring succeded to decrypt
9909e24 
If no keyrings attempt to decrypt any encrypted data keys,
then the message can not be decrypted.
The code attempted to enforce this,
by retrieving the unencrypted data key in node.

There were two issues here

1. The check ensure the validity of the materials,
itself threw an error.
1. Had this check succeeded, the error message
`'Unencrypted data key is invalid.’` is not incredibly more helpful than
'unencryptedDataKey has not been set'

The error message has been updated,
and the tests have been updated
to verify _this_ error message.

On a related note
awslabs/aws-encryption-sdk-specification#97
starts to explore some additional possibilities.
The fullness of this issue is not only in failure,
but success can also have similar issues.
seebees added a commit to seebees/aws-encryption-sdk-javascript that referenced this issue Apr 25, 2020
@seebees
fix: Better messages when no keyring succeeded to decrypt
f2002c7 
If no keyrings attempt to decrypt any encrypted data keys,
then the message can not be decrypted.
The code attempted to enforce this,
by retrieving the unencrypted data key in node.

There were two issues here

1. The check ensure the validity of the materials,
itself threw an error.
1. Had this check succeeded, the error message
`'Unencrypted data key is invalid.’` is not incredibly more helpful than
'unencryptedDataKey has not been set'

The error message has been updated,
and the tests have been updated
to verify _this_ error message.

On a related note
awslabs/aws-encryption-sdk-specification#97
starts to explore some additional possibilities.
The fullness of this issue is not only in failure,
but success can also have similar issues.
This was referenced Apr 25, 2020
Closed
Closed
@mattsb42-aws mattsb42-aws mentioned this issue May 14, 2020
Merged
@mattsb42-aws mattsb42-aws added this to the keyrings milestone May 15, 2020
seebees added a commit to seebees/aws-encryption-sdk-javascript that referenced this issue Aug 7, 2020
@seebees
fix: Better messages when no keyring succeeded to decrypt
c82226a 
resolves: aws#152, aws#31
linked: awslabs/aws-encryption-sdk-specification#105

If no keyrings attempt to decrypt any encrypted data keys,
then the message can not be decrypted.
The code attempted to enforce this,
by retrieving the unencrypted data key in node.

There were two issues here

1. The check ensure the validity of the materials,
itself threw an error.
1. Had this check succeeded, the error message
`'Unencrypted data key is invalid.’` is not incredibly more helpful than
'unencryptedDataKey has not been set'

The error message has been updated,
and the tests have been updated
to verify _this_ error message.

On a related note
awslabs/aws-encryption-sdk-specification#97
starts to explore some additional possibilities.
The fullness of this issue is not only in failure,
but success can also have similar issues.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mattsb42-aws mattsb42-aws

Labels
Doc impact Requires a change to AWS documentation enhancement New feature or request
Projects
None yet
Milestone
Spec 1.0 (Official Keyring Release)
Development

Successfully merging a pull request may close this issue.

feat: remove keyring trace mattsb42-aws/aws-encryption-sdk-specification
1 participant
@mattsb42-aws