AwsEncryptionSdk.Crypto.Commitment (AWS Encryption SDK v1.0.0)

View Source

Key commitment verification operations.

Verifies that the commitment key stored in the message header matches the commitment key derived from the plaintext data key. This prevents key commitment attacks on committed algorithm suites.

Summary

Functions

verify_commitment(materials, header)

Verifies key commitment for committed algorithm suites.

Functions

verify_commitment(materials, header)

@spec verify_commitment(
  AwsEncryptionSdk.Materials.DecryptionMaterials.t(),
  AwsEncryptionSdk.Format.Header.t()
) :: :ok | {:error, term()}

Verifies key commitment for committed algorithm suites.

For non-committed suites (commitment_length = 0), returns :ok immediately. For committed suites, derives the commitment key and compares it to the stored value in the header.

Returns :ok if verification succeeds, {:error, :commitment_mismatch} otherwise.