AwsEncryptionSdk.Crypto.AesGcm (AWS Encryption SDK v1.0.0)

View Source

AES-GCM encryption and decryption operations.

Wraps Erlang :crypto functions for AES-GCM with 128, 192, or 256-bit keys. All operations use 12-byte IVs and 16-byte authentication tags as required by the AWS Encryption SDK.

Summary

Types

cipher()

AES-GCM cipher type for :crypto module

Functions

decrypt(cipher, key, iv, ciphertext, aad, auth_tag)

Decrypts ciphertext using AES-GCM.

encrypt(cipher, key, iv, plaintext, aad)

Encrypts plaintext using AES-GCM.

iv_length()

Returns the IV length (always 12 bytes for AES-GCM).

key_length(atom)

Returns the required key length in bytes for a cipher.

sequence_number_to_iv(sequence_number)

Constructs an IV from a sequence number.

tag_length()

Returns the authentication tag length (always 16 bytes).

zero_iv()

Returns a zero IV (12 zero bytes).

Types

cipher()

@type cipher() :: :aes_128_gcm | :aes_192_gcm | :aes_256_gcm

AES-GCM cipher type for :crypto module

Functions

decrypt(cipher, key, iv, ciphertext, aad, auth_tag)

@spec decrypt(cipher(), binary(), binary(), binary(), binary(), binary()) ::
  {:ok, binary()} | {:error, :authentication_failed}

Decrypts ciphertext using AES-GCM.

Parameters

  • cipher - :aes_128_gcm, :aes_192_gcm, or :aes_256_gcm
  • key - Decryption key (16, 24, or 32 bytes)
  • iv - Initialization vector (12 bytes)
  • ciphertext - Data to decrypt
  • aad - Additional authenticated data
  • auth_tag - Authentication tag (16 bytes)

Returns

  • {:ok, plaintext} on successful decryption and authentication
  • {:error, :authentication_failed} if tag verification fails

encrypt(cipher, key, iv, plaintext, aad)

@spec encrypt(cipher(), binary(), binary(), binary(), binary()) ::
  {binary(), binary()}

Encrypts plaintext using AES-GCM.

Parameters

  • cipher - :aes_128_gcm, :aes_192_gcm, or :aes_256_gcm
  • key - Encryption key (16, 24, or 32 bytes)
  • iv - Initialization vector (12 bytes)
  • plaintext - Data to encrypt
  • aad - Additional authenticated data

Returns

{ciphertext, auth_tag} tuple where auth_tag is 16 bytes.

iv_length()

@spec iv_length() :: 12

Returns the IV length (always 12 bytes for AES-GCM).

key_length(atom)

@spec key_length(cipher()) :: 16 | 24 | 32

Returns the required key length in bytes for a cipher.

sequence_number_to_iv(sequence_number)

@spec sequence_number_to_iv(non_neg_integer()) :: binary()

Constructs an IV from a sequence number.

The IV is the sequence number padded to 12 bytes (big-endian). Used for frame encryption/decryption.

tag_length()

@spec tag_length() :: 16

Returns the authentication tag length (always 16 bytes).

zero_iv()

@spec zero_iv() :: binary()

Returns a zero IV (12 zero bytes).

Used for header authentication tag computation.