feat: Enforce Rotation Functionality for ReEncrypt-feature #474

akareddy04 · 2025-07-16T22:30:50Z

Description of changes:

I implemented the Enforce Rotation check for the ReEncrypt feature and I also wrote some test cases to test this logic.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Check any applicable:

Were any files moved? Moving files changes their URL, which breaks all hyperlinks to the files.

…file implementation

…metadata

…stom instruction file suffix if specified

…on files with AES + RSA keyrings and both of these tests pass

… third-party client is unable toretrieve the encrypted object in s3 if they do not include the overrideConfiguration with their custom instruction file suffix since it will by default use the original instruction file, not theirs.:

…yrings

…ionFile

…ds compatability

…ion object, not the object itself. Also reworded one of the exception messages to be clearer for when instruction file suffix request is specified for AES keyring (which should not happen)

…MaterialsDescription class

…file suffix

…N_FILE_SUFFIX

…text()

…ataKeyMatDescOrContext()

… support both the default and custom instruction file suffixes

… since secureRandom should now be initialized by default. I also removed all the unused imports

…SA keyrings in all of the test cases

….encryptedDataKeyMatDescOrContext()

…r enforceRotation in javadoc

…file suffix + legacy wrapping algorithm upgrades from V1/V2 to V3

…eSuffix to mention that the . prefix is automatically added to the suffix + in reEncryptInstructionFileResponse, the . prefix will be removed from the suffix and return what the user requested the suffix be

…odified test cases to illustrate this

…t-case

…Functionality

kessplas · 2025-07-18T19:15:46Z

src/main/java/software/amazon/encryption/s3/S3EncryptionClient.java

+ DecryptionMaterials decryptedMaterials = this._cryptoMaterialsManager.decryptMaterials(
+ DecryptMaterialsRequest.builder()
+ .algorithmSuite(newEncryptionMaterials.algorithmSuite())
+ .encryptedDataKeys(Collections.singletonList(newEncryptionMaterials.encryptedDataKeys()).get(0))


Suggested change

.encryptedDataKeys(Collections.singletonList(newEncryptionMaterials.encryptedDataKeys()).get(0))

.encryptedDataKeys(newEncryptionMaterials.encryptedDataKeys())

kessplas · 2025-07-18T19:21:01Z

src/main/java/software/amazon/encryption/s3/S3EncryptionClient.java

+ } catch (S3EncryptionClientException e) {
+ return;
+ }
+ throw new S3EncryptionClientException("Key rotation is not enforced! Old keyring is still able to decrypt the newly encrypted data key");


I'd change this a bit. Instead of Key rotation is not enforced! (this kind of implies that enforceRotation is not set), maybe say Re-encryption failed due to enforced rotation! (then the second sentence).

kessplas · 2025-07-18T19:24:01Z

src/main/java/software/amazon/encryption/s3/internal/ReEncryptInstructionFileRequest.java

 }

+ /**
+ * Sets whether to enforce rotation for the re-encrypted instruction file.


Let's give a bit more info here:

When enabled, the client will attempt to decrypt the re-encrypted instruction file with the old key material and throw an exception when decryption succeeds. This is a stronger level of validation that the wrapping key has been rotated than the standard assertion that the materials descriptions are different.

kessplas · 2025-07-18T19:27:07Z