AwsEncryptionSdk.Cache.CacheEntry (AWS Encryption SDK v1.0.0)

View Source

Cache entry containing cryptographic materials with usage metadata.

Fields

  • :materials - EncryptionMaterials or DecryptionMaterials
  • :creation_time - Monotonic time when entry was created (seconds)
  • :expiry_time - Monotonic time when entry expires (seconds)
  • :messages_used - Number of messages encrypted with this entry
  • :bytes_used - Number of bytes encrypted with this entry

Summary

Types

materials()
t()

Functions

can_serve?(entry, request_bytes, max_messages, max_bytes)

Checks whether the entry may serve a request of request_bytes bytes without exceeding its usage limits.

expired?(cache_entry)

Checks if the cache entry has expired.

new(materials, max_age)

Creates a new cache entry with the given materials and TTL.

Types

materials()

@type materials() ::
  AwsEncryptionSdk.Materials.EncryptionMaterials.t()
  | AwsEncryptionSdk.Materials.DecryptionMaterials.t()

t()

@type t() :: %AwsEncryptionSdk.Cache.CacheEntry{
  bytes_used: non_neg_integer(),
  creation_time: integer(),
  expiry_time: integer(),
  materials: materials(),
  messages_used: non_neg_integer()
}

Functions

can_serve?(entry, request_bytes, max_messages, max_bytes)

@spec can_serve?(t(), non_neg_integer(), non_neg_integer(), non_neg_integer()) ::
  boolean()

Checks whether the entry may serve a request of request_bytes bytes without exceeding its usage limits.

The byte limit is checked against the prospective total, so an entry is never reused when doing so would push it past max_bytes. A freshly stored entry always serves the request that created it, even when that request alone exceeds max_bytes; the entry is then refused on the next lookup.

Parameters

  • entry - The cache entry
  • request_bytes - Bytes the pending request will encrypt
  • max_messages - Maximum messages allowed
  • max_bytes - Maximum bytes allowed

Examples

iex> alias AwsEncryptionSdk.Cache.CacheEntry
iex> alias AwsEncryptionSdk.Materials.EncryptionMaterials
iex> alias AwsEncryptionSdk.AlgorithmSuite
iex> suite = AlgorithmSuite.aes_256_gcm_hkdf_sha512_commit_key()
iex> materials = EncryptionMaterials.new_for_encrypt(suite, %{})
iex> entry = %CacheEntry{
...>   materials: materials,
...>   creation_time: 0,
...>   expiry_time: 1000,
...>   messages_used: 10,
...>   bytes_used: 900
...> }
iex> CacheEntry.can_serve?(entry, 100, 100, 1000)
true
iex> CacheEntry.can_serve?(entry, 101, 100, 1000)
false

expired?(cache_entry)

@spec expired?(t()) :: boolean()

Checks if the cache entry has expired.

Examples

iex> alias AwsEncryptionSdk.Cache.CacheEntry
iex> alias AwsEncryptionSdk.Materials.EncryptionMaterials
iex> alias AwsEncryptionSdk.AlgorithmSuite
iex> suite = AlgorithmSuite.aes_256_gcm_hkdf_sha512_commit_key()
iex> materials = EncryptionMaterials.new_for_encrypt(suite, %{})
iex> entry = CacheEntry.new(materials, 300)
iex> CacheEntry.expired?(entry)
false

new(materials, max_age)

@spec new(materials(), pos_integer()) :: t()

Creates a new cache entry with the given materials and TTL.

Parameters

  • materials - EncryptionMaterials or DecryptionMaterials
  • max_age - TTL in seconds

Examples

iex> alias AwsEncryptionSdk.Cache.CacheEntry
iex> alias AwsEncryptionSdk.Materials.EncryptionMaterials
iex> alias AwsEncryptionSdk.AlgorithmSuite
iex> suite = AlgorithmSuite.aes_256_gcm_hkdf_sha512_commit_key()
iex> materials = EncryptionMaterials.new_for_encrypt(suite, %{})
iex> entry = CacheEntry.new(materials, 300)
iex> entry.messages_used
0