aws-sdk-s3 1.136.0 → 1.208.0

data/lib/aws-sdk-s3/encryptionV2/kms_cipher_provider.rb

@@ -24,7 +24,7 @@ module Aws
         def encryption_cipher(options = {})
           validate_key_for_encryption
           encryption_context = build_encryption_context(@content_encryption_schema, options)
-          key_data = Aws::Plugins::UserAgent.feature('S3CryptoV2') do
+          key_data = Aws::Plugins::UserAgent.metric('S3_CRYPTO_V2') do
             @kms_client.generate_data_key(
               key_id: @kms_key_id,
               encryption_context: encryption_context,
@@ -33,6 +33,8 @@ module Aws
           end
           cipher = Utils.aes_encryption_cipher(:GCM)
           cipher.key = key_data.plaintext
+          ##= ../specification/s3-encryption/data-format/content-metadata.md#algorithm-suite-and-message-format-version-compatibility
+          ##% Objects encrypted with ALG_AES_256_GCM_IV12_TAG16_NO_KDF MUST use the V2 message format version only.
           envelope = {
             'x-amz-key-v2' => encode64(key_data.ciphertext_blob),
             'x-amz-iv' => encode64(cipher.iv = cipher.random_iv),
@@ -53,9 +55,15 @@ module Aws
 
           case envelope['x-amz-wrap-alg']
           when 'kms'
+            ##= ../specification/s3-encryption/client.md#enable-legacy-wrapping-algorithms
+            ##% The S3EC MUST support the option to enable or disable legacy wrapping algorithms.
             unless options[:security_profile] == :v2_and_legacy
+              ##= ../specification/s3-encryption/client.md#enable-legacy-wrapping-algorithms
+              ##% When disabled, the S3EC MUST NOT decrypt objects encrypted using legacy wrapping algorithms; it MUST throw an exception when attempting to decrypt an object encrypted with a legacy wrapping algorithm.
               raise Errors::LegacyDecryptionError
             end
+            ##= ../specification/s3-encryption/client.md#enable-legacy-wrapping-algorithms
+            ##% When enabled, the S3EC MUST be able to decrypt objects encrypted with all supported wrapping algorithms (both legacy and fully supported).
           when 'kms+context'
             if cek_alg != encryption_context['aws:x-amz-cek-alg']
               raise Errors::CEKAlgMismatchError
@@ -85,7 +93,7 @@ module Aws
             decrypt_options[:key_id] = @kms_key_id
           end
 
-          key = Aws::Plugins::UserAgent.feature('S3CryptoV2') do
+          key = Aws::Plugins::UserAgent.metric('S3_CRYPTO_V2') do
             @kms_client.decrypt(decrypt_options).plaintext
           end
           iv = decode64(envelope['x-amz-iv'])

data/lib/aws-sdk-s3/encryptionV2/utils.rb

@@ -80,6 +80,11 @@ module Aws
           # @param [OpenSSL::PKey::RSA, String, nil] key
           # @param [String, nil] iv The initialization vector
           def aes_cipher(mode, block_mode, key, iv)
+            ##= ../specification/s3-encryption/encryption.md#alg-aes-256-gcm-iv12-tag16-no-kdf
+            ##% The client MUST initialize the cipher,
+            ##% or call an AES-GCM encryption API, with the plaintext data key, the generated IV,
+            ##% and the tag length defined in the Algorithm Suite
+            ##% when encrypting with ALG_AES_256_GCM_IV12_TAG16_NO_KDF.
             cipher = key ?
               OpenSSL::Cipher.new("aes-#{cipher_size(key)}-#{block_mode.downcase}") :
               OpenSSL::Cipher.new("aes-256-#{block_mode.downcase}")