AwsEncryptionSdk.Decrypt (AWS Encryption SDK v1.2.1)

View Source

Message decryption operations.

Decrypts AWS Encryption SDK messages using provided decryption materials. This is a non-streaming implementation that requires the entire ciphertext in memory.

Security

This module NEVER releases unauthenticated plaintext. All authentication checks (header auth tag, frame auth tags, key commitment, signature) must pass before any plaintext is returned.

Summary

Types

decrypt_result()

The result of a successful decryption.

Functions

decrypt(ciphertext, materials)

Decrypts an AWS Encryption SDK message.

Types

decrypt_result()

@type decrypt_result() :: %{
  plaintext: binary(),
  header: AwsEncryptionSdk.Format.Header.t(),
  encryption_context: map()
}

The result of a successful decryption.

:encryption_context is the context stored in the message header. Required encryption context pairs are authenticated but not stored (messages written by 1.1.0 and later), so they are absent from it; they are the pairs the caller reproduced, and the caller already holds them. Messages written by earlier versions stored them, and for those they appear here.

Functions

decrypt(ciphertext, materials)

@spec decrypt(binary(), AwsEncryptionSdk.Materials.DecryptionMaterials.t()) ::
  {:ok, decrypt_result()} | {:error, term()}

Decrypts an AWS Encryption SDK message.

Parameters

  • ciphertext - Complete encrypted message (header + body + optional footer)
  • materials - Decryption materials containing the plaintext data key

Returns

  • {:ok, result} - Decryption succeeded; result contains plaintext, header, and the stored encryption context (see decrypt_result/0)
  • {:error, reason} - Decryption failed

Errors

  • :base64_encoded_message - Message appears to be Base64 encoded
  • :header_authentication_failed - Header auth tag verification failed
  • :commitment_mismatch - Key commitment verification failed
  • :body_authentication_failed - Frame auth tag verification failed
  • :signature_verification_failed - Footer signature verification failed
  • :trailing_bytes - Bytes follow the end of the message