Comments (11)
Thanks for the report.
@SalusaSecondus, you seem to work for AWS. Do you know what happened here? Thanks!
from tink.
@thaidn Glad to help here. I'm having some trouble navigating this project. Can you point me to where the AWSKMS client is actually constructed? I'll still keep poking, but that would save me some time.
from tink.
Thanks SalusaSecondus!
The AWS client is in https://github.com/google/tink/blob/master/java/src/main/java/com/google/crypto/tink/integration/awskms/AwsKmsClient.java.
from tink.
I ended up finding it. Thank you.
That construction will always point to a "default" region and in many cases that will just be "us-east-1". My recommendation is that you look at how we create clients in the KmsMasterKeyProvider
in the aws-encryption-sdk-java.
Specific things which are likely to be helpful:
- getStartingRegion
- Our use of the client builder to spin off multiple clients for different regions (or with different credentials)
from tink.
Thanks SalusaSecondus.
While this looks easy to fix, and I'll fix it in our code, if the region is encoded in the key arn, why doesn't AWS KMS library automatically choose the right region?
from tink.
Generally the Java clients are relatively thin and are configured to speak with exactly one region. Having one automatically figure out the proper region in general is a hard problem. This is made worse because not every call has an explicit region in it (unlike the encrypt call). How should the client behave then?
For calls without an explicit region, should it go to the configured one at creation or the region specified by the most recently used explicit region? Now when you make a bunch of calls, some might go to different regions, and thus the results won't properly work between the calls. I agree that it causes confusion and can create issues, but we don't (currently) have a better way to handle this. Our regions are very strongly isolated and we do require developers to know which region they are interacting with.
from tink.
Thanks for the explanation. For KMS the region is embedded in the key arn, thus I thought that it should be easy for the KMS client to figure out which region it should talk to. But what you said made me realize that this is KMS specific, and might not work for other services.
@kevur fixing this turns out is harder than expected because one of our existing clients is using a quite old version of AWS SDK. I'm upgrading them now, but it might take a few more days. Sorry for the delay!
from tink.
@thaidn no problem or pressure whatsoever, I was able to have a hacky workaround for now (I'm on a groovy project, and groovy makes accessing the private AWSKMS client easier than it should be...). But thank you for your quick response and effort! Makes me more confident in having chosen google tink, and I look forward to not having to rely on said hacky hack.
from tink.
Thanks for choosing Tink. Just for your information, though Tink started as a personal project of the initial maintainers, we now have a dedicated team working full time on it (and Wycheproof). Our goal is to help everyone use crypto correctly everywhere. So if there's anything we can do, please let us know.
from tink.
Just a quick update: we may not be able to fix this post 1.2.0 launch. I still haven't figured out how to upgrade the AWS KMS client library in our internal repository.
I'll keep you posted on my progress.
from tink.
Please use https://github.com/google/tink/releases/tag/v1.2.1 which should fix this issue. Sorry again for the long delay.
from tink.
Related Issues (20)
- AES-SIV (EncryptDeterministically) doesn't match OpenSSL and jacobsa/crypto HOT 10
- tink cannot be installed on arm64 linux HOT 9
- Cannot install it with googleapis-common-protos and other related libs in python HOT 7
- Envelope AEAD Performance with GCP KMS HOT 1
- java tink library is not scaling with java threads HOT 1
- Tink installation on bazel and pip3 fail HOT 4
- Missing classes dectected while running R8 HOT 11
- Is Tink for Objective-C buildable via Bazel? HOT 9
- Recommendation on the best approach for rotation HOT 1
- tink 1.7.0 depends on protobuf 3.20.1 which has a security vulnerability patched in a newer version HOT 4
- Windows OS Support HOT 4
- Cannot download tinkey - The project to be billed is associated with a closed billing account. HOT 2
- cannot verify signature HOT 3
- java.security.GeneralSecurityException: cannot verify signature HOT 1
- No manager for type 'type.googleapis.com/google.crypto.tink.HpkePrivateKey' has been registered HOT 2
- H HOT 1
- compile tink cpp library for ios HOT 4
- OSS-Fuzz issue 66058 HOT 1
- Intent to archive https://github.com/google/tink
- Duplicate class found in modules jetified-tink-1.8.0 and jetified-tink-android-1.8.0 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tink.