AwsEncryptionSdk.Encrypt (AWS Encryption SDK v1.2.2)

Message encryption operations.

Encrypts plaintext into AWS Encryption SDK message format using provided encryption materials. This is a non-streaming implementation that requires the entire plaintext in memory.

Algorithm Suite Selection

Uses the algorithm suite from the provided encryption materials. For committed suites (recommended), the message will use format version 2.

Summary

Types

encrypt_opts()

encrypt_result()

Functions

encrypt(materials, plaintext, opts \\ [])

Encrypts plaintext into an AWS Encryption SDK message.

Types

encrypt_opts()

@type encrypt_opts() :: [{:frame_length, pos_integer()}]

encrypt_result()

@type encrypt_result() :: %{
  ciphertext: binary(),
  header: AwsEncryptionSdk.Format.Header.t(),
  encryption_context: map(),
  algorithm_suite: AwsEncryptionSdk.AlgorithmSuite.t()
}

Functions

encrypt(materials, plaintext, opts \\ [])

@spec encrypt(
  AwsEncryptionSdk.Materials.EncryptionMaterials.t(),
  binary(),
  encrypt_opts()
) ::
  {:ok, encrypt_result()} | {:error, term()}

Encrypts plaintext into an AWS Encryption SDK message.

Parameters

materials - Encryption materials containing algorithm suite, data key, and EDKs
plaintext - Data to encrypt
opts - Options:
- :frame_length - Frame size in bytes (default: 4096)

Returns

{:ok, result} - Encryption succeeded; result contains ciphertext, header, etc.
{:error, :max_frames_exceeded} - The plaintext would need more than 2^32 - 1 frames of :frame_length bytes, the specification's limit for one message; nothing is encrypted
{:error, reason} - Encryption failed

Raises

ArgumentError - The suite is signed and the materials' :signing_key is not a private key for the curve the suite signs on (P-256 for 0x0214, P-384 for 0x0346, 0x0378 and 0x0578): it has the size of a private key on the other curve. The message names the suite, its curve and the key's size; nothing is encrypted. The Default CMM generates the signing key on the suite's curve, so this is reached only through materials a caller assembles and passes here.