AwsEncryptionSdk.Stream (AWS Encryption SDK v1.2.2)

View Source

Streaming encryption and decryption APIs.

Provides Stream-compatible functions for processing large data incrementally.

Example

# Encrypt a file stream
File.stream!("input.bin", [], 4096)
|> AwsEncryptionSdk.Stream.encrypt(client)
|> Stream.into(File.stream!("output.encrypted"))
|> Stream.run()

# Decrypt a file stream
File.stream!("output.encrypted", [], 4096)
|> AwsEncryptionSdk.Stream.decrypt(client)
|> Stream.map(fn {plaintext, _status} -> plaintext end)
|> Stream.into(File.stream!("decrypted.bin"))
|> Stream.run()

Summary

Functions

decrypt(ciphertext_stream, client, opts \\ [])

Creates a stream that decrypts ciphertext chunks.

encrypt(plaintext_stream, client, opts \\ [])

Creates a stream that encrypts plaintext chunks.

Functions

decrypt(ciphertext_stream, client, opts \\ [])

@spec decrypt(Enumerable.t(), AwsEncryptionSdk.Client.t(), keyword()) ::
  Enumerable.t()

Creates a stream that decrypts ciphertext chunks.

Returns a Stream that emits {plaintext, status} tuples where status is :verified or :unverified.

Framed and non-framed messages are both read. A non-framed message's plaintext is emitted whole, as one :verified tuple, once the body's authentication tag (and, on a signed suite, the signature) verifies; see AwsEncryptionSdk.Stream.Decryptor.

Options

  • :encryption_context - Reproduced context to validate (optional)
  • :fail_on_signed - Fail immediately on signed suites (default: false)

encrypt(plaintext_stream, client, opts \\ [])

@spec encrypt(Enumerable.t(), AwsEncryptionSdk.Client.t(), keyword()) ::
  Enumerable.t()

Creates a stream that encrypts plaintext chunks.

Returns a Stream that emits ciphertext binaries.

Options

  • :encryption_context - Encryption context (default: %{})
  • :frame_length - Frame size in bytes (default: 4096)
  • :algorithm_suite - Algorithm suite to use (default: the CMM's default for the client's commitment policy). Checked against the commitment policy before the CMM is called, as AwsEncryptionSdk.Client.encrypt/3 checks it; a suite the policy forbids raises the RuntimeError the stream raises for any initialization error, naming the reason Client.encrypt/3 returns.
  • :plaintext_length - Total plaintext size in bytes, when known upfront. Required for the Caching CMM to cache materials for this stream: without it the max_bytes limit cannot be enforced, so a Caching CMM bypasses its cache and fetches fresh materials from the underlying CMM. Other CMMs ignore this option.