Error: unencryptedDataKey has not been set

[zemacnica]

Problem:

I'm trying to decrypt kinesis RDS activity stream event enrypted with simple KMS

but it is failing with error 'unencryptedDataKey has not been set'
i'm not able to find, what's the problem

Code snippet:

     console.log('Record: ', kinesis, rest);
      const data = JSON.parse(Buffer.from(kinesis.data, 'base64').toString());
      console.log('Record DATA: ', data);

      const kms = new KMSClient({ region: awsRegion });

      const params = {
        CiphertextBlob: Buffer.from(data.key, 'base64'),
        EncryptionContext: {
          'aws:rds:dbc-id': [CLIENT-ID],
        },
      };

      const command = new DecryptCommand(params);
      const response = await kms.send(command);

      console.log('Decrypted KEY: ', response);

      const { decrypt } = buildClient(
        CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT,
      );

      const keyring = new KmsKeyringNode({
        generatorKeyId: [ALIAS-ARN],
        keyIds: [response.KeyId],
      });

      console.log('Key ring: ', keyring);

      const decryptedData = await decrypt(keyring, data.databaseActivityEvents, { encoding: 'base64' }); <<------ FAILING with error unencryptedDataKey has not been set

      console.log('Decrypted DATA: ', decryptedData);

lambda policy with granted decrypt permision for kms ARN

KMS - symetric default / encrypt decrypt
KMS policy :

{
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "lambda.amazonaws.com"
                ]
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:Describe*"
            ],
            "Resource": "*"
 }

node 18
aws-crypto 4.0.0

[kessplas]

Hi, thanks for reaching out!

Could you provide a full stack trace of this error? That will help us with debugging.

One possibility is that your generator key is not valid. The stack trace will help to confirm or deny this. Thanks!

[zemacnica]

Hi, thanks for reaching out!

Could you provide a full stack trace of this error? That will help us with debugging.

One possibility is that your generator key is not valid. The stack trace will help to confirm or deny this. Thanks!

Error: unencryptedDataKey has not been set
at needs (/var/task/index.js:74:15)
at NodeDecryptionMaterial.getUnencryptedDataKey (/var/task/index.js:8502:27)
at NodeDefaultCryptographicMaterialsManager.decryptMaterials (/var/task/index.js:9913:51)
at runMicrotasks ()
at processTicksAndRejections (node:internal/process/task_queues:96:5)
2023-08-04T15:19:42.513Z 6142c7c4-49c4-4169-ad2f-778534da9a96 INFO Error: Error: unencryptedDataKey has not been set at needs (/var/task/index.js:74:15) at NodeDecryptionMaterial.getUnencryptedDataKey (/var/task/index.js:8502:27) at NodeDefaultCryptographicMaterialsManager.decryptMaterials (/var/task/index.js:9913:51) at runMicrotasks () at processTicksAndRejections (node:internal/process/task_queues:96:5)

[kessplas]

Hey, it seems like you're facing a similar issue as #1194.
You'll need to use RawAesKeyringNode instead, making sure to set the key namespace and name accordingly.

[zemacnica]

Hey, it seems like you're facing a similar issue as #1194. You'll need to use RawAesKeyringNode instead, making sure to set the key namespace and name accordingly.

Actually i was able to create and run python version successfully (even thou example is outdated https://github.com/aws-samples/aurora-das-processing/blob/main/lambda_function.py)

I found only this part of documentation somehow mentioning keyname and keynamespace https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/use-raw-aes-keyring.html which is not much helpful as encyption is done by service

with setting of this 2 values helped python example, where keynamespace is hardcoded value as "BC" (?)

okay I changed the approach, with the same result:

 console.log('Record: ', kinesis, rest);
  const data = JSON.parse(Buffer.from(kinesis.data, 'base64').toString());
  console.log('Record DATA: ', data);

  const kms = new KMSClient({ region: awsRegion });

  const params = {
    CiphertextBlob: Buffer.from(data.key, 'base64'),
    EncryptionContext: {
      'aws:rds:dbc-id': [CLIENT-ID],
    },
  };

  const command = new DecryptCommand(params);
  const response = await kms.send(command);

  console.log('Decrypted KEY: ', response);

  const { decrypt } = buildClient(CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT)

  // NEW LINES
  const keyAsUint = new Uint8Array(response.Plaintext);
  
  console.log("Test: ", typeof response.Plaintext, response.Plaintext);
  console.log("Test 2: ", typeof keyAsUint, keyAsUint);

  const wrappingSuite = RawAesWrappingSuiteIdentifier.AES256_GCM_IV12_TAG16_NO_PADDING
  let keyring;
  try {
    keyring = new RawAesKeyringNode({
      keyName: response.KeyId,
      keyNamespace: "BC",
      wrappingSuite,
      unencryptedMasterKey: response.Plaintext <<------ FAILING with error Unencrypted Master Key must be an isolated buffer, but as output values are identical
    })
  } catch(e) {
    console.log('Error in middle: ', e);
    keyring = new RawAesKeyringNode({
      keyName: response.KeyId,
      keyNamespace: "BC", (?)
      wrappingSuite,
      unencryptedMasterKey: keyAsUint
    })
  }
  // END OF NEW LINES
  console.log('Key ring: ', keyring);

  const decryptedData = await decrypt(keyring, data.databaseActivityEvents, { encoding: 'base64' }); <<------ FAILING with error unencryptedDataKey has not been set

  console.log('Decrypted DATA: ', decryptedData);

LOGS:

2023-08-09T16:11:34.820Z ac7926e6-74ec-47f0-aaa8-ee2384fd9d79 INFO Test: object Uint8Array(32) [
XX, XX, XX, 109, 242, 50, 245, 10,
120, 169, 88, 109, 242, 44, 239, 129,
250, 73, 118, 61, 35, 114, 83, 79,
81, 152, 223, 249, 239, XX, XX, XX
]

2023-08-09T16:11:34.820Z ac7926e6-74ec-47f0-aaa8-ee2384fd9d79 INFO Test 2: object Uint8Array(32) [
XX, XX, XX, 109, 242, 50, 245, 10,
120, 169, 88, 109, 242, 44, 239, 129,
250, 73, 118, 61, 35, 114, 83, 79,
81, 152, 223, 249, 239, XX, XX, XX
]
2023-08-09T16:11:34.820Z ac7926e6-74ec-47f0-aaa8-ee2384fd9d79 INFO Error in middle: Error: Unencrypted Master Key must be an isolated buffer.
at needs (/var/task/index.js:74:15)
at verifyUnencryptedDataKeyForSet (/var/task/index.js:8537:27)
at NodeRawAesMaterial.setUnencryptedDataKey (/var/task/index.js:8495:9)
at new RawAesKeyringNode2 (/var/task/index.js:42466:86)
at /var/task/index.js:42778:19
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async asyncForEach (/var/task/index.js:42750:5)
at async Runtime.exports.handler (/var/task/index.js:42757:5)

2023-08-09T16:05:47.256Z 35232949-89e0-43cd-a6c5-8e718d780979 INFO Error: Error: unencryptedDataKey has not been set
at needs (/var/task/index.js:74:15)
at NodeDecryptionMaterial.getUnencryptedDataKey (/var/task/index.js:8502:27)
at NodeDefaultCryptographicMaterialsManager.decryptMaterials (/var/task/index.js:9913:51)
at runMicrotasks ()
at processTicksAndRejections (node:internal/process/task_queues:96:5)
2023-08-09T16:05:47.256Z 35232949-89e0-43cd-a6c5-8e718d780979 INFO Error: Error: unencryptedDataKey has not been set at needs (/var/task/index.js:74:15) at NodeDecryptionMaterial.getUnencryptedDataKey (/var/task/index.js:8502:27) at NodeDefaultCryptographicMaterialsManager.decryptMaterials (/var/task/index.js:9913:51) at runMicrotasks () at processTicksAndRejections (node:internal/process/task_queues:96:5)

[zemacnica]

as this issue is stated as closed #1195

[zemacnica]

Okay I didn't noticed in python was LITERALLY used these 2 values
keyName: "DataKey",
keyNamespace: "BC",