Question

我无法解密从S3存储桶中收到的消息。它们使用KMS密钥加密。我使用Node和Typescript。

我已经尝试了一些方法，但是很可能使它起作用。查看以下链接：https://github.com/gilt/node-s3-encryption-client/issues/3和https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SES.html

我的代码现在看起来像这样：

import * as AWS from 'aws-sdk';
import * as crypto from 'crypto';    

const s3 = new AWS.S3({ apiVersion: '2006-03-01', region: 'eu-west-1' });
const kms = new AWS.KMS({ apiVersion: '2014-11-01', region: 'eu-west-1' });

export const handler = LambdaUtils.lambdaHandler( 'onebox-email-service-SendMailToL4PFunction', async (event) => {
    const record = event.Records[0];

    const request = {
      Bucket: record.s3.bucket.name,
      Key: record.s3.object.key
    };

    const data = await s3.getObject(request).promise();
    const decryptData = await decryptSES(data);

    return decryptData;
  }
);

export const decryptSES = async (objectData) => {
  const metadata = objectData.Metadata || {};
  const kmsKeyBase64 = metadata['x-amz-key-v2'];
  const iv = metadata['x-amz-iv'];
  const tagLen = (metadata['x-amz-tag-len'] || 0) / 8;
  let algo = metadata['x-amz-cek-alg'];
  const encryptionContext = JSON.parse(metadata['x-amz-matdesc']);

  switch (algo) {
    case 'AES/GCM/NoPadding':
      algo = 'aes-256-gcm';
      break;
    case 'AES/CBC/PKCS5Padding':
      algo = 'aes-256-cbc';
      break;
    default:
      log.error({Message: 'Unsupported algorithm: ' + algo});
      return;
  }

 if (typeof (kmsKeyBase64) === 'undefined') {
   log.error('Error');
 }

 const kmsKeyBuffer = new Buffer(kmsKeyBase64, 'base64');
 const returnValue = await kms.decrypt({ CiphertextBlob: kmsKeyBuffer, EncryptionContext: encryptionContext }, (err, kmsData) => {
    if (err) {
      log.error({err});
      return null;
    } else {
      const data = objectData.Body.slice(0, -tagLen);
      const decipher = crypto.createDecipheriv( algo, kmsKeys.Plaintext[0], new Buffer(iv, 'base64'));
      if (tagLen !== 0) {
        const tag = objectData.Body.slice(-tagLen);
        decipher.setAuthTag(tag);
      }
        let dec = decipher.update(data, 'binary', 'utf8');
        dec += decipher.final('utf8');
        return dec;
      }
    }).promise();

    return returnValue;
  };

我的lambda出现如下错误：

2019-02-05T17：06：19.015Z d9593ef7-635b-47b2-b881-ede2a396f88e错误：新的Decipheriv（crypto.js：267：16）处的密钥长度无效 Response.l.decrypt上的Object.createDecipheriv（crypto.js：627：10）（/var/task/email-from-s3.js:592:232696）。（/var/runtime/node_modules/aws-sdk/lib/request.js:364:18）在 Request.callListeners （/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20）在Request.emit （/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10）在Request.emit （/var/runtime/node_modules/aws-sdk/lib/request.js:683:14）在请求转换（/var/runtime/node_modules/aws-sdk/lib/request.js:22:10）在 AcceptorStateMachine.runTo （/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12）在 /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10 at 请求。（/var/runtime/node_modules/aws-sdk/lib/request.js:38:9）在请求。（/var/runtime/node_modules/aws-sdk/lib/request.js:685:12）在 Request.callListeners （/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18）在Request.emit （/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10）在Request.emit （/var/runtime/node_modules/aws-sdk/lib/request.js:683:14）在请求转换（/var/runtime/node_modules/aws-sdk/lib/request.js:22:10）

我在日志中看到的内容是从s3存储桶中获取加密的消息的，但是无法对其解密。

有人可以帮我吗？我使用Node和Typescript。

Answer 1

我从同事那里得到了一些帮助，我们可以找出答案。问题出在

* Indicates that an annotated class is a "component". * Such classes are considered as candidates for auto-detection * when using annotation-based configuration and classpath scanning. * * <p>Other class-level annotations may be considered as identifying * a component as well, typically a special kind of component: * e.g. the {@link Repository @Repository} annotation or AspectJ's * {@link org.aspectj.lang.annotation.Aspect @Aspect} annotation.

我们需要将const decipher = crypto.createDecipheriv( algo, kmsKeys.Plaintext[0], new Buffer(iv, 'base64'));更改为kms.Plaintext并开始工作。如果有人以后需要，我会在这里发布我的打孔功能。

kms.Plaintext as Buffer

使用KMS，节点

1 个答案: