Amazon Encryption SDK Concepts: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
|||
| Line 10: | Line 10: | ||
The library uses an [[Symmetric_Cryptography#AES-GCM|AES-GCM]] encryption algorithm with 256-bit, 192-bit and 128-bit encryption keys. The length of the [[Symmetric_Cryptography#Initialization_Vector_.28IV.29|Initialization Vector]] is 12 bytes. The length of the authentication tag is 16 bytes. By default, the SDK uses the data key as an input to the HMAC-based extract-and-expand key derivation function (HKDF) to derive the AES-GCM encryption key, and also adds an Elliptic Curve Digital Signature Algorithm (ECDSA) signature. | The library uses an [[Symmetric_Cryptography#AES-GCM|AES-GCM]] encryption algorithm with 256-bit, 192-bit and 128-bit encryption keys. The length of the [[Symmetric_Cryptography#Initialization_Vector_.28IV.29|Initialization Vector]] is 12 bytes. The length of the authentication tag is 16 bytes. By default, the SDK uses the data key as an input to the HMAC-based extract-and-expand key derivation function (HKDF) to derive the AES-GCM encryption key, and also adds an Elliptic Curve Digital Signature Algorithm (ECDSA) signature. | ||
=Data Key Caching= | =Data Key Management= | ||
By default, the SDK uses AWS KMS as the [[Amazon_KMS_Concepts#Master_Key_Provider|master key provider]]. | |||
==Data Key Caching== | |||
<font color=darkgray>TODO: | <font color=darkgray>TODO: | ||
Revision as of 23:09, 12 December 2018
Internal
Supported Algorithms
The library uses an AES-GCM encryption algorithm with 256-bit, 192-bit and 128-bit encryption keys. The length of the Initialization Vector is 12 bytes. The length of the authentication tag is 16 bytes. By default, the SDK uses the data key as an input to the HMAC-based extract-and-expand key derivation function (HKDF) to derive the AES-GCM encryption key, and also adds an Elliptic Curve Digital Signature Algorithm (ECDSA) signature.
Data Key Management
By default, the SDK uses AWS KMS as the master key provider.
Data Key Caching
TODO:
- https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html
- https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/faq.html