Skip to content

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In DDBEC, we commit the cipher text then decrypt it in test vector

Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"TableName": [
{
"hashKey": {
"S": "test😀Ψkey"
},
"*amzn-ddb-map-desc*": {
"B": "AAAAAAAAABBhbXpuLWRkYi1lbnYta2V5AAAA4EFRRUJBSGhBODR3blhqRUpkQmJCQnlsUlVGY1paSzJqN3h3aDZVeUxvTDI4blErMEZBQUFBSDR3ZkFZSktvWklodmNOQVFjR29HOHdiUUlCQURCb0Jna3Foa2lHOXcwQkJ3RXdIZ1lKWUlaSUFXVURCQUV1TUJFRUREWlBYZGxDVHY2VlBCVUNFZ0lCRUlBN045Q1RjRHowSzd1RVNUUGxxU3MxdjRZQTVEU2tJQmVWc0lpN2FQTllVeW9xMm4xazZJUUlINnZGc3pmeFZSeFdLdUhxejZ0MkNtV1BlUFU9AAAAD2F3cy1rbXMtZWMtYXR0cgAAAAYqa2V5cyoAAAAQYW16bi1kZGItZW52LWFsZwAAAAdBRVMvMjU2AAAAEGFtem4tZGRiLXNpZy1hbGcAAAAOSG1hY1NIQTI1Ni8yNTYAAAARYW16bi1kZGItd3JhcC1hbGcAAAADa21zAAAAFWFtem4tZGRiLW1hcC1zeW0tbW9kZQAAABEvQ0JDL1BLQ1M1UGFkZGluZw=="
},
"*amzn-ddb-map-sig*": {
"B": "+01tpVk8ZvuIFh+ZA02PkhFhEBs2vYePEgcM/qZ6JFw="
}
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
{
"TableName": [
{
"rangeKey": {
"N": "7"
},
"hashKey": {
"N": "5"
},
"stringValue": {
"B": "leseMgRescbtfi/CZCmfW0Lk1jkv6Md5cqAtBTEP1AQyTB25+xVF7UjWR1DbeA8Y"
},
"*amzn-ddb-map-desc*": {
"B": "AAAAAAAAABVhbXpuLWRkYi1tYXAtc3ltLW1vZGUAAAARL0NCQy9QS0NTNVBhZGRpbmc="
},
"intSet": {
"B": "rf/00OwnLb/FlqMWDjvcdiX1AqzRQfLOuSSaTDZX7nSQrkDyqyxHxKYPWGnZOPOI3P2fOjVvYV0BSlmCIvP5kQ=="
},
"byteArrayValue": {
"B": "DwzxA9QJrucdFE8nPIEaiAdggInKUH4CvumuBNZxcQc="
},
"intValue": {
"B": "b6tg6Vm7pzdcmlT0pc/4q/cecHZaiENJG/Hv+IU+6Lg="
},
"stringSet": {
"B": "HHIUXDDb2gMeGMfUs9cW0CtvPohceTRyOQ1GI/voY6vImFe1AJKNCy5Shx/PmMYH+rEzjryVsd8EVmcCco0PGA=="
},
"version": {
"N": "0"
},
"*amzn-ddb-map-sig*": {
"B": "EQXY4c3O2NSyRpPPuR9RzZ+CnLxn7jgb12RRmivNYZA="
}
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
{
"TableName": [
{
"rangeKey": {
"N": "7"
},
"hashKey": {
"N": "5"
},
"stringValue": {
"B": "6Z0SJgkzw3Ij0RNpHzrdH5o9+3tGJVVr3G66OL4+q7nfh/7AEg3wHnRuBiO2z3F/"
},
"*amzn-ddb-map-desc*": {
"B": "AAAAAAAAABVhbXpuLWRkYi1tYXAtc3ltLW1vZGUAAAARL0NCQy9QS0NTNVBhZGRpbmc="
},
"intSet": {
"B": "E2PmJ8DFDYXCYlAssQzJCFPkeoZqyDDpXI0qJe5iXIIkGE1Ltn+J++OzKDZ+Gvkvno1eNERWplptL22HH2+kjQ=="
},
"byteArrayValue": {
"B": "263KRNe2DxnFKltNMXgxr95crOtbOziyqaI2rVdiUco="
},
"intValue": {
"B": "5rYFQHJpwVusKp4zIcJkNgQpzrz3Gwk+sb3aQsmJWRs="
},
"stringSet": {
"B": "Yii7PxCMKEefXMIEXeLl20YMm7WhKxxNlCJzv18QCLhmrVEL15xvTzAkcPMXVud7YIJFx1XzcVTjK0wwn5htSw=="
},
"version": {
"N": "0"
},
"*amzn-ddb-map-sig*": {
"B": "I/fHzON+4U01BsJA8hU6ebKn+TftiuaVAGDsn/ykAO8="
}
}
]
}
Original file line number Diff line number Diff line change
Expand Up @@ -397,6 +397,47 @@ public static BaseClass attributeMapToBaseClass(
return value;
}

public static Map<String, AttributeValue> baseClassToV1AttrMap(

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is reverse of the function attributeMapToBaseClass which is right above

BaseClass obj
) {
Map<String, AttributeValue> map = new HashMap<>();
map.put(
HASH_KEY,
new AttributeValue().withN(String.valueOf(obj.getHashKey()))
);
map.put(
RANGE_KEY,
new AttributeValue().withN(String.valueOf(obj.getRangeKey()))
);
map.put(
"version",
new AttributeValue().withN(String.valueOf(obj.getVersion()))
);
map.put(
"intValue",
new AttributeValue().withN(String.valueOf(obj.getIntValue()))
);
map.put("stringValue", new AttributeValue().withS(obj.getStringValue()));
map.put(
"byteArrayValue",
new AttributeValue()
.withB(java.nio.ByteBuffer.wrap(obj.getByteArrayValue()))
);
map.put("stringSet", new AttributeValue().withSS(obj.getStringSet()));
map.put(
"intSet",
new AttributeValue()
.withNS(
obj
.getIntSet()
.stream()
.map(String::valueOf)
.collect(java.util.stream.Collectors.toList())
)
);
return map;
}

public static Map<
String,
software.amazon.awssdk.services.dynamodb.model.AttributeValue
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
// SPDX-License-Identifier: Apache-2.0
package com.amazonaws.services.dynamodbv2.datamodeling;

import static com.amazonaws.services.dynamodbv2.datamodeling.LegacyTestVectors.baseClassToV1AttrMap;
import static org.testng.AssertJUnit.assertEquals;
import static org.testng.AssertJUnit.assertFalse;
import static org.testng.AssertJUnit.assertNull;
Expand Down Expand Up @@ -107,18 +108,18 @@ public class TransformerHolisticIT {
private static final PrivateKey rsaPriv;
private static final PublicKey rsaPub;
private static final KeyPair rsaPair;
private static final EncryptionMaterialsProvider symProv;

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to make public as I created a Helper class because this file is getting too long

public static final EncryptionMaterialsProvider symProv;
private static final EncryptionMaterialsProvider asymProv;
private static final EncryptionMaterialsProvider symWrappedProv;
protected static final String HASH_KEY = "hashKey";
protected static final String RANGE_KEY = "rangeKey";
protected static final String BASE_CLASS_TABLE_NAME = "TableName";
public static final String BASE_CLASS_TABLE_NAME = "TableName";
private static final String RSA = "RSA";

private AmazonDynamoDB client;
private static AWSKMS kmsClient = AWSKMSClientBuilder.standard().build();
public static AWSKMS kmsClient = AWSKMSClientBuilder.standard().build();

private static Map<String, KeyData> keyDataMap = new HashMap<>();
public static Map<String, KeyData> keyDataMap = new HashMap<>();

// AttributeEncryptor *must* be used with SaveBehavior.CLOBBER to avoid the risk of data
// corruption.
Expand All @@ -127,7 +128,7 @@ public class TransformerHolisticIT {
.builder()
.withSaveBehavior(SaveBehavior.CLOBBER)
.build();
private static final BaseClass ENCRYPTED_TEST_VALUE = new BaseClass();
public static final BaseClass ENCRYPTED_TEST_VALUE = new BaseClass();
private static final Mixed MIXED_TEST_VALUE = new Mixed();
private static final SignOnly SIGNED_TEST_VALUE = new SignOnly();
private static final Untouched UNTOUCHED_TEST_VALUE = new Untouched();
Expand All @@ -139,7 +140,7 @@ public class TransformerHolisticIT {

private static final String TEST_VECTOR_MANIFEST_DIR =
"/vectors/encrypted_item/";
private static final String SCENARIO_MANIFEST_PATH =
public static final String SCENARIO_MANIFEST_PATH =
TEST_VECTOR_MANIFEST_DIR + "scenarios.json";
private static final String JAVA_DIR = "java";

Expand Down Expand Up @@ -326,6 +327,28 @@ public void setUp() {
createCiphertextTables(client);
}

// This test configures EC with various combination. This is different from other tests as other test run in same hardcoded EC.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other test reads scenarios.json then decrypts but the code is not setup to read encryption context from scenarios.json and assumes same encryption context. Its a large refactoring to make scenarios.json do it. imo writing scenarios.json and thinking it will work for all configuration is no viable. So, I wrote this test.

@Test
public void decryptWithECConfigTest()
throws IOException, GeneralSecurityException {
final String nullTableNameInECCipherFile =
"file://ciphertext/java/static-aes-hmac-null-table-1.json";
final String nonBMPinECCipherFile =
"file://ciphertext/java/kms-nonbmp-hashkey-1.json";
final String nonAsciiTableInECCipherFile =
"file://ciphertext/java/static-aes-hmac-nonascii-table-1.json";

TransformerHolisticITHelper.decryptNullTableNameInEC(
nullTableNameInECCipherFile
);
TransformerHolisticITHelper.decryptNonBmpHashKeyVector(
nonBMPinECCipherFile
);
TransformerHolisticITHelper.decryptNonAsciiTableNameVector(
nonAsciiTableInECCipherFile
);
}

@Test(dataProvider = "getDecryptTestVectors")
public void decryptTestVector(Scenario scenario) throws IOException {
client = DynamoDBEmbedded.create().amazonDynamoDB();
Expand Down Expand Up @@ -1353,7 +1376,7 @@ private void putDataFromFile(AmazonDynamoDB client, String filename)
}
}

private Map<
public static Map<
String,
List<Map<String, AttributeValue>>
> getCiphertextManifestFromFile(String filename) throws IOException {
Expand All @@ -1365,7 +1388,7 @@ > getCiphertextManifestFromFile(String filename) throws IOException {
);
}

private static <T> T getManifestFromFile(
public static <T> T getManifestFromFile(
String filename,
TypeReference typeRef
) throws IOException {
Expand All @@ -1380,7 +1403,7 @@ private static <T> T getManifestFromFile(
return (T) manifestMapper.readValue(manifestFile, typeRef);
}

private static void loadKeyData(String filename) throws IOException {
static void loadKeyData(String filename) throws IOException {
keyDataMap =
getManifestFromFile(
TEST_VECTOR_MANIFEST_DIR + stripFilePath(filename),
Expand Down
Loading
Loading