用KMS， Node解密来自S3的SES消息

Question

我无法解密从S3存储桶收到的消息。它们用KMS密钥加密。我使用Node和Typescript。

我已经尝试了一些东西，但并不能使它工作。查看此链接：https://github.com/gilt/node-s3-encryption-client/issues/3和https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SES.html

我的代码现在是这样的：

import * as AWS from 'aws-sdk';
import * as crypto from 'crypto';    

const s3 = new AWS.S3({ apiVersion: '2006-03-01', region: 'eu-west-1' });
const kms = new AWS.KMS({ apiVersion: '2014-11-01', region: 'eu-west-1' });

export const handler = LambdaUtils.lambdaHandler( 'onebox-email-service-SendMailToL4PFunction', async (event) => {
    const record = event.Records[0];

    const request = {
      Bucket: record.s3.bucket.name,
      Key: record.s3.object.key
    };

    const data = await s3.getObject(request).promise();
    const decryptData = await decryptSES(data);

    return decryptData;
  }
);

export const decryptSES = async (objectData) => {
  const metadata = objectData.Metadata || {};
  const kmsKeyBase64 = metadata['x-amz-key-v2'];
  const iv = metadata['x-amz-iv'];
  const tagLen = (metadata['x-amz-tag-len'] || 0) / 8;
  let algo = metadata['x-amz-cek-alg'];
  const encryptionContext = JSON.parse(metadata['x-amz-matdesc']);

  switch (algo) {
    case 'AES/GCM/NoPadding':
      algo = 'aes-256-gcm';
      break;
    case 'AES/CBC/PKCS5Padding':
      algo = 'aes-256-cbc';
      break;
    default:
      log.error({Message: 'Unsupported algorithm: ' + algo});
      return;
  }

 if (typeof (kmsKeyBase64) === 'undefined') {
   log.error('Error');
 }

 const kmsKeyBuffer = new Buffer(kmsKeyBase64, 'base64');
 const returnValue = await kms.decrypt({ CiphertextBlob: kmsKeyBuffer, EncryptionContext: encryptionContext }, (err, kmsData) => {
    if (err) {
      log.error({err});
      return null;
    } else {
      const data = objectData.Body.slice(0, -tagLen);
      const decipher = crypto.createDecipheriv( algo, kmsKeys.Plaintext[0], new Buffer(iv, 'base64'));
      if (tagLen !== 0) {
        const tag = objectData.Body.slice(-tagLen);
        decipher.setAuthTag(tag);
      }
        let dec = decipher.update(data, 'binary', 'utf8');
        dec += decipher.final('utf8');
        return dec;
      }
    }).promise();

    return returnValue;
  };

我得到错误在我的lambda看起来像这样：

2019-02-05T17:06:19.015Z d9593ef7-635b-47b2-b881-ede2a396f88e错误：在Response.l.decrypt（/var/任务/<--plhd）时，新的分词器（crypto.js:267： 16）的密钥长度无效bject.create分词器（crypto.js:627： 10）/var/runtime/node_modules/AWS-sdk/lib/request.js:364： 18）在Request.call监听器（/var/runtime/node_modules/AWS-sdk/lib/sequential_executor.js:105： 20）在Request.emit（/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77： 10）在Request.emit（/var/runtime/node_modules/AWS-sdk/lib/request.js:683： 14）在Request.transition（/var/runtime/node_modules/AWS-sdk/lib/request.js:22： 10）在接受器状态achine.run到（/var/runtime/node_modules/AWS-sdk/lib/state_machine.js:14： 12）在 /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26： 10在请求。（/var/runtime/node_modules/AWS-sdk/lib/request.js:38： 9）在请求。（/var/runtime/node_modules/aws-sdk/lib/request.js:685： 12）在Request.call监听器（/var/runtime/node_modules/aws-sdk/lib/sequential_executor. js： 115:18）在请求. emit（/var/runtime/node_modules/aws-sdk/lib/sequential_executor. js： 77:10）在请求. emit（/var/runtime/node_modules/aws-sdk/lib/请求. js： 683:14）在请求.转换（/var/runtime/node_modules/aws-sdk/lib/请求. js： 22:10）

我可以在我的日志中看到我从我的s3桶中得到加密的消息，但是这样就不可能解密它。

有人能帮我吗？我使用节点和打字稿。

Answer 1

我从同事那里得到了一些帮助，我们可以解决这个问题。问题出在

常量破译=crypto.create破译（algo， kmsKeys.纯文本[0]，新缓冲区（iv，'bas64'））；

我们需要更改kms。纯文本到kms。纯文本作为缓冲区，它开始工作。如果有人以后需要，我会把我的洞放在这里。

import * as AWS from 'aws-sdk';
import * as crypto from 'crypto';

const kms = new AWS.KMS({ apiVersion: '2014-11-01', region: 'eu-west-1' });

export const decryptS3Message = async (objectData) => {
  const metadata = objectData.Metadata || {};
  const kmsKeyBase64 = metadata['x-amz-key-v2'];
  const iv = metadata['x-amz-iv'];
  const tagLen = (metadata['x-amz-tag-len'] || 0) / 8;
  let algo = metadata['x-amz-cek-alg'];
  const encryptionContext = JSON.parse(metadata['x-amz-matdesc']);

  switch (algo) {
    case 'AES/GCM/NoPadding':
      algo = `aes-256-gcm`;
      break;
    case 'AES/CBC/PKCS5Padding':
      algo = `aes-256-cbc`;
      break;
    default:
      throw new ErrorUtils.NotFoundError('Unsupported algorithm: ' + algo);
  }

  if (typeof (kmsKeyBase64) === 'undefined') {
    return null;
  }

  const kmsKeyBuffer = Buffer.from(kmsKeyBase64, 'base64');

  const returnValue = await kms.decrypt({ CiphertextBlob: kmsKeyBuffer, EncryptionContext: encryptionContext }).promise()
    .then((res) => {
      const data = objectData.Body.slice(0, -tagLen);
      const decipher = crypto.createDecipheriv( algo, res.Plaintext as Buffer, Buffer.from(iv, 'base64'));
      if (tagLen !== 0) {
        const tag = objectData.Body.slice(-tagLen);
        decipher.setAuthTag(tag);
      }
      let dec = decipher.update(data, 'binary', 'utf8');
      dec += decipher.final('utf8');
      return dec;
    }).catch((err) => {
      throw new ErrorUtils.InternalServerError('Not able to decrypt message: ', err);
    });

  return returnValue;
};