Encrypt support

[edwardysun]

I noticed that the kmstool-enclave-cli only supports a decrypt, genkey, and genrandom. Is there a reason why encrypt is not supported? I'd like to call a KMS encrypt operation on a plaintext inside the enclave. What is the best approach for doing that?

Thank you

[richardfan1126]

Hi @edwardysun

The KMS encrypt action doesn't support attestation document. So we cannot implement it

https://docs.aws.amazon.com/enclaves/latest/user/kms.html

[edwardysun]

I see. Would an alternate approach like this be valid?

1. Generate a data key (using kmstool's genkey) - creating (Plaintext, Ciphertext) pair
2. Encrypt the value I intend to keep secret with the Plaintext from above. Store this encrypted value and the Ciphertext from above. Do this encryption outside of KMS
3. When I need to decrypt, call kmstool decrypt with Ciphertext from step 1 to receive Plaintext. Use this to decrypt the encrypted value in step 2

Feels like a bit of a workaround. Am I not considering something that would cause this approach to be insecure?

[richardfan1126]

I see. Would an alternate approach like this be valid?

1. Generate a data key (using kmstool's genkey) - creating (Plaintext, Ciphertext) pair
2. Encrypt the value I intend to keep secret with the Plaintext from above. Store this encrypted value and the Ciphertext from above. Do this encryption outside of KMS
3. When I need to decrypt, call kmstool decrypt with Ciphertext from step 1 to receive Plaintext. Use this to decrypt the encrypted value in step 2

Feels like a bit of a workaround. Am I not considering something that would cause this approach to be insecure?

@edwardysun Correct, this is actually what Genkey is intended to achieve.

Just make sure the "Plaintext" is properly discarded after the encryption

[edwardysun]

Got it, thank you!

I just tried this out, but the cli appears to not be returning any response in stdout or stderr. I've verified the KMS key ID, region, credentials, and the access policy of the key contains kms:GenerateDataKey for the enclave. What scenario does the cli not return a response?