| 1 |
<?php |
| 2 |
|
| 3 |
namespace Dudlewebs\WPMCS\s3\Aws\Crypto; |
| 4 |
|
| 5 |
use Dudlewebs\WPMCS\s3\Aws\Kms\KmsClient; |
| 6 |
/** |
| 7 |
* Uses KMS to supply materials for encrypting and decrypting data. |
| 8 |
* |
| 9 |
* Legacy implementation that supports legacy S3EncryptionClient and |
| 10 |
* S3EncryptionMultipartUploader, which use an older encryption workflow. Use |
| 11 |
* KmsMaterialsProviderV2 with S3EncryptionClientV2 or |
| 12 |
* S3EncryptionMultipartUploaderV2 if possible. |
| 13 |
* |
| 14 |
* @deprecated |
| 15 |
*/ |
| 16 |
class KmsMaterialsProvider extends MaterialsProvider implements MaterialsProviderInterface |
| 17 |
{ |
| 18 |
const WRAP_ALGORITHM_NAME = 'kms'; |
| 19 |
private $kmsClient; |
| 20 |
private $kmsKeyId; |
| 21 |
/** |
| 22 |
* @param KmsClient $kmsClient A KMS Client for use encrypting and |
| 23 |
* decrypting keys. |
| 24 |
* @param string $kmsKeyId The private KMS key id to be used for encrypting |
| 25 |
* and decrypting keys. |
| 26 |
*/ |
| 27 |
public function __construct(KmsClient $kmsClient, $kmsKeyId = null) |
| 28 |
{ |
| 29 |
$this->kmsClient = $kmsClient; |
| 30 |
$this->kmsKeyId = $kmsKeyId; |
| 31 |
} |
| 32 |
public function fromDecryptionEnvelope(MetadataEnvelope $envelope) |
| 33 |
{ |
| 34 |
if (empty($envelope[MetadataEnvelope::MATERIALS_DESCRIPTION_HEADER])) { |
| 35 |
throw new \RuntimeException('Not able to detect the materials description.'); |
| 36 |
} |
| 37 |
$materialsDescription = \json_decode($envelope[MetadataEnvelope::MATERIALS_DESCRIPTION_HEADER], \true); |
| 38 |
if (empty($materialsDescription['kms_cmk_id']) && empty($materialsDescription['aws:x-amz-cek-alg'])) { |
| 39 |
throw new \RuntimeException('Not able to detect kms_cmk_id (legacy' . ' implementation) or aws:x-amz-cek-alg (current implementation)' . ' from kms materials description.'); |
| 40 |
} |
| 41 |
return new self($this->kmsClient, isset($materialsDescription['kms_cmk_id']) ? $materialsDescription['kms_cmk_id'] : null); |
| 42 |
} |
| 43 |
/** |
| 44 |
* The KMS key id for use in matching this Provider to its keys, |
| 45 |
* consistently with other SDKs as 'kms_cmk_id'. |
| 46 |
* |
| 47 |
* @return array |
| 48 |
*/ |
| 49 |
public function getMaterialsDescription() |
| 50 |
{ |
| 51 |
return ['kms_cmk_id' => $this->kmsKeyId]; |
| 52 |
} |
| 53 |
public function getWrapAlgorithmName() |
| 54 |
{ |
| 55 |
return self::WRAP_ALGORITHM_NAME; |
| 56 |
} |
| 57 |
/** |
| 58 |
* Takes a content encryption key (CEK) and description to return an encrypted |
| 59 |
* key by using KMS' Encrypt API. |
| 60 |
* |
| 61 |
* @param string $unencryptedCek Key for use in encrypting other data |
| 62 |
* that itself needs to be encrypted by the |
| 63 |
* Provider. |
| 64 |
* @param string $materialDescription Material Description for use in |
| 65 |
* encrypting the $cek. |
| 66 |
* |
| 67 |
* @return string |
| 68 |
*/ |
| 69 |
public function encryptCek($unencryptedCek, $materialDescription) |
| 70 |
{ |
| 71 |
$encryptedDataKey = $this->kmsClient->encrypt(['Plaintext' => $unencryptedCek, 'KeyId' => $this->kmsKeyId, 'EncryptionContext' => $materialDescription]); |
| 72 |
return \base64_encode($encryptedDataKey['CiphertextBlob']); |
| 73 |
} |
| 74 |
/** |
| 75 |
* Takes an encrypted content encryption key (CEK) and material description |
| 76 |
* for use decrypting the key by using KMS' Decrypt API. |
| 77 |
* |
| 78 |
* @param string $encryptedCek Encrypted key to be decrypted by the Provider |
| 79 |
* for use decrypting other data. |
| 80 |
* @param string $materialDescription Material Description for use in |
| 81 |
* encrypting the $cek. |
| 82 |
* |
| 83 |
* @return string |
| 84 |
*/ |
| 85 |
public function decryptCek($encryptedCek, $materialDescription) |
| 86 |
{ |
| 87 |
$result = $this->kmsClient->decrypt(['CiphertextBlob' => $encryptedCek, 'EncryptionContext' => $materialDescription]); |
| 88 |
return $result['Plaintext']; |
| 89 |
} |
| 90 |
} |
| 91 |
|
