gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-19 02:56:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(kms): unify persisted SSE data key envelopes (#5343)

Browse Source 
* feat(kms): implement secure handling of static KMS secret keys and enhance encryption context validation

* feat: enhance local SSE DEK handling with JSON envelope format and versioning
This commit is contained in:
唐小鸭
2026-07-28 17:02:18 +08:00
committed by GitHub
parent fd2a87d47e
commit 2216f00cfd
14 changed files with 499 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/kms/src/service.rs
+2 -10
View File
@@ -350,11 +350,7 @@ impl ObjectEncryptionService {
encryption_context: context.clone(),
};
let data_key = self
.kms_manager
.generate_data_key(request)
.await
.map_err(|e| KmsError::backend_error(format!("Failed to generate data key: {e}")))?;
let data_key = self.kms_manager.generate_data_key(request).await?;
let plaintext_key = data_key.plaintext_key;
@@ -431,11 +427,7 @@ impl ObjectEncryptionService {
grant_tokens: Vec::new(),
};
let decrypt_response = self
.kms_manager
.decrypt(decrypt_request)
.await
.map_err(|e| KmsError::backend_error(format!("Failed to decrypt data key: {e}")))?;
let decrypt_response = self.kms_manager.decrypt(decrypt_request).await?;
// Create cipher
let cipher = create_cipher(&algorithm, &decrypt_response.plaintext)?;