Skip to content

Commit 1d8341d

Browse files
author
awstools
committed
feat(client-kms): Added support for new ECC_NIST_EDWARDS25519 AWS KMS key spec
1 parent 5e1e54b commit 1d8341d

14 files changed

+190
-120
lines changed

‎clients/client-kms/src/commands/CreateKeyCommand.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
7272
* key never leaves KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key so it can be used
7373
* outside of KMS. Each KMS key can have only one key usage. KMS keys with RSA key pairs
7474
* can be used to encrypt and decrypt data or sign and verify messages (but not both). KMS
75-
* keys with NIST-recommended ECC key pairs can be used to sign and verify messages or
75+
* keys with NIST-standard ECC key pairs can be used to sign and verify messages or
7676
* derive shared secrets (but not both). KMS keys with <code>ECC_SECG_P256K1</code> can be
7777
* used only to sign and verify messages. KMS keys with ML-DSA key pairs can be used to
7878
* sign and verify messages. KMS keys with SM2 key pairs (China Regions only) can be used
@@ -212,7 +212,7 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
212212
* Description: "STRING_VALUE",
213213
* KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC" || "KEY_AGREEMENT",
214214
* CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
215-
* KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
215+
* KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87" || "ECC_NIST_EDWARDS25519",
216216
* Origin: "AWS_KMS" || "EXTERNAL" || "AWS_CLOUDHSM" || "EXTERNAL_KEY_STORE",
217217
* CustomKeyStoreId: "STRING_VALUE",
218218
* BypassPolicyLockoutSafetyCheck: true || false,
@@ -245,12 +245,12 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
245245
* // ExpirationModel: "KEY_MATERIAL_EXPIRES" || "KEY_MATERIAL_DOES_NOT_EXPIRE",
246246
* // KeyManager: "AWS" || "CUSTOMER",
247247
* // CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
248-
* // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
248+
* // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87" || "ECC_NIST_EDWARDS25519",
249249
* // EncryptionAlgorithms: [ // EncryptionAlgorithmSpecList
250250
* // "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE",
251251
* // ],
252252
* // SigningAlgorithms: [ // SigningAlgorithmSpecList
253-
* // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
253+
* // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256" || "ED25519_SHA_512" || "ED25519_PH_SHA_512",
254254
* // ],
255255
* // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
256256
* // "ECDH",

‎clients/client-kms/src/commands/DecryptCommand.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -83,12 +83,12 @@ export interface DecryptCommandOutput extends DecryptResponse, __MetadataBearer
8383
* particular trusted accounts. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policies-best-practices">Best practices for IAM
8484
* policies</a> in the <i>Key Management Service Developer Guide</i>.</p>
8585
* <p>
86-
* <code>Decrypt</code> also supports <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html">Amazon Web Services Nitro Enclaves</a> and NitroTPM, which provide
87-
* attested environments in Amazon EC2. To call <code>Decrypt</code> for a Nitro enclave or NitroTPM, use
88-
* the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK. Use the <code>Recipient</code> parameter to provide the
89-
* attestation document for the attested environment. Instead of the plaintext data, the response
90-
* includes the plaintext data encrypted with the public key from the attestation document
91-
* (<code>CiphertextForRecipient</code>). For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
86+
* <code>Decrypt</code> also supports <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html">Amazon Web Services Nitro Enclaves</a> and NitroTPM, which
87+
* provide attested environments in Amazon EC2. To call <code>Decrypt</code> for a Nitro enclave or
88+
* NitroTPM, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK. Use the <code>Recipient</code>
89+
* parameter to provide the attestation document for the attested environment. Instead of the
90+
* plaintext data, the response includes the plaintext data encrypted with the public key from
91+
* the attestation document (<code>CiphertextForRecipient</code>). For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
9292
* <p>The KMS key that you use for this operation must be in a compatible key state. For
9393
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
9494
* <p>

‎clients/client-kms/src/commands/DeriveSharedSecretCommand.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ export interface DeriveSharedSecretCommandOutput extends DeriveSharedSecretRespo
3434
/**
3535
* <p>Derives a shared secret using a key agreement algorithm.</p>
3636
* <note>
37-
* <p>You must use an asymmetric NIST-recommended elliptic curve (ECC) or SM2 (China Regions
37+
* <p>You must use an asymmetric NIST-standard elliptic curve (ECC) or SM2 (China Regions
3838
* only) KMS key pair with a <code>KeyUsage</code> value of <code>KEY_AGREEMENT</code> to call
3939
* DeriveSharedSecret.</p>
4040
* </note>
@@ -53,14 +53,14 @@ export interface DeriveSharedSecretCommandOutput extends DeriveSharedSecretRespo
5353
* <b>Alice</b> calls <a>CreateKey</a> to create an
5454
* asymmetric KMS key pair with a <code>KeyUsage</code> value of
5555
* <code>KEY_AGREEMENT</code>.</p>
56-
* <p>The asymmetric KMS key must use a NIST-recommended elliptic curve (ECC) or SM2 (China
56+
* <p>The asymmetric KMS key must use a NIST-standard elliptic curve (ECC) or SM2 (China
5757
* Regions only) key spec.</p>
5858
* </li>
5959
* <li>
6060
* <p>
6161
* <b>Bob</b> creates an elliptic curve key pair.</p>
6262
* <p>Bob can call <a>CreateKey</a> to create an asymmetric KMS key pair or
63-
* generate a key pair outside of KMS. Bob's key pair must use the same NIST-recommended
63+
* generate a key pair outside of KMS. Bob's key pair must use the same NIST-standard
6464
* elliptic curve (ECC) or SM2 (China Regions ony) curve as Alice.</p>
6565
* </li>
6666
* <li>
@@ -88,8 +88,8 @@ export interface DeriveSharedSecretCommandOutput extends DeriveSharedSecretRespo
8888
* </li>
8989
* </ol>
9090
* <p>To derive a shared secret you must provide a key agreement algorithm, the private key of
91-
* the caller's asymmetric NIST-recommended elliptic curve or SM2 (China Regions only) KMS key
92-
* pair, and the public key from your peer's NIST-recommended elliptic curve or SM2 (China
91+
* the caller's asymmetric NIST-standard elliptic curve or SM2 (China Regions only) KMS key
92+
* pair, and the public key from your peer's NIST-standard elliptic curve or SM2 (China
9393
* Regions only) key pair. The public key can be from another asymmetric KMS key pair or from a
9494
* key pair generated outside of KMS, but both key pairs must be on the same elliptic
9595
* curve.</p>

‎clients/client-kms/src/commands/DescribeKeyCommand.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,12 +146,12 @@ export interface DescribeKeyCommandOutput extends DescribeKeyResponse, __Metadat
146146
* // ExpirationModel: "KEY_MATERIAL_EXPIRES" || "KEY_MATERIAL_DOES_NOT_EXPIRE",
147147
* // KeyManager: "AWS" || "CUSTOMER",
148148
* // CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
149-
* // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
149+
* // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87" || "ECC_NIST_EDWARDS25519",
150150
* // EncryptionAlgorithms: [ // EncryptionAlgorithmSpecList
151151
* // "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE",
152152
* // ],
153153
* // SigningAlgorithms: [ // SigningAlgorithmSpecList
154-
* // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
154+
* // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256" || "ED25519_SHA_512" || "ED25519_PH_SHA_512",
155155
* // ],
156156
* // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
157157
* // "ECDH",

‎clients/client-kms/src/commands/GenerateDataKeyCommand.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,12 @@ export interface GenerateDataKeyCommandOutput extends GenerateDataKeyResponse, _
5858
* <p>
5959
* <code>GenerateDataKey</code> also supports <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html">Amazon Web Services Nitro Enclaves</a>, which provide an
6060
* isolated compute environment in Amazon EC2. To call <code>GenerateDataKey</code> for an Amazon Web Services Nitro
61-
* enclave or NitroTPM, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK. Use the <code>Recipient</code> parameter
62-
* to provide the attestation document for the attested environment. <code>GenerateDataKey</code> returns a
63-
* copy of the data key encrypted under the specified KMS key, as usual. But instead of a
64-
* plaintext copy of the data key, the response includes a copy of the data key encrypted under
65-
* the public key from the attestation document (<code>CiphertextForRecipient</code>).
66-
* For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
61+
* enclave or NitroTPM, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK. Use the
62+
* <code>Recipient</code> parameter to provide the attestation document for the attested
63+
* environment. <code>GenerateDataKey</code> returns a copy of the data key encrypted under the
64+
* specified KMS key, as usual. But instead of a plaintext copy of the data key, the response
65+
* includes a copy of the data key encrypted under the public key from the attestation document
66+
* (<code>CiphertextForRecipient</code>). For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
6767
* <p>The KMS key that you use for this operation must be in a compatible key state. For
6868
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
6969
* <p>

‎clients/client-kms/src/commands/GenerateDataKeyPairCommand.ts‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,12 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
6565
* <p>
6666
* <code>GenerateDataKeyPair</code> also supports <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html">Amazon Web Services Nitro Enclaves</a>, which provide an
6767
* isolated compute environment in Amazon EC2. To call <code>GenerateDataKeyPair</code> for an Amazon Web Services
68-
* Nitro enclave or NitroTPM, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK. Use the <code>Recipient</code>
69-
* parameter to provide the attestation document for the attested environment.
70-
* <code>GenerateDataKeyPair</code> returns the public data key and a copy of the private data
71-
* key encrypted under the specified KMS key, as usual. But instead of a plaintext copy of the
72-
* private data key (<code>PrivateKeyPlaintext</code>), the response includes a copy of the
73-
* private data key encrypted under the public key from the attestation document
68+
* Nitro enclave or NitroTPM, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK. Use the
69+
* <code>Recipient</code> parameter to provide the attestation document for the attested
70+
* environment. <code>GenerateDataKeyPair</code> returns the public data key and a copy of the
71+
* private data key encrypted under the specified KMS key, as usual. But instead of a plaintext
72+
* copy of the private data key (<code>PrivateKeyPlaintext</code>), the response includes a copy
73+
* of the private data key encrypted under the public key from the attestation document
7474
* (<code>CiphertextForRecipient</code>). For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
7575
* <p>You can use an optional encryption context to add additional security to the encryption
7676
* operation. If you specify an <code>EncryptionContext</code>, you must specify the same
@@ -130,7 +130,7 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
130130
* "<keys>": "STRING_VALUE",
131131
* },
132132
* KeyId: "STRING_VALUE", // required
133-
* KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2", // required
133+
* KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2" || "ECC_NIST_EDWARDS25519", // required
134134
* GrantTokens: [ // GrantTokenList
135135
* "STRING_VALUE",
136136
* ],
@@ -147,7 +147,7 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
147147
* // PrivateKeyPlaintext: new Uint8Array(),
148148
* // PublicKey: new Uint8Array(),
149149
* // KeyId: "STRING_VALUE",
150-
* // KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2",
150+
* // KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2" || "ECC_NIST_EDWARDS25519",
151151
* // CiphertextForRecipient: new Uint8Array(),
152152
* // KeyMaterialId: "STRING_VALUE",
153153
* // };

‎clients/client-kms/src/commands/GenerateDataKeyPairWithoutPlaintextCommand.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ export interface GenerateDataKeyPairWithoutPlaintextCommandOutput
116116
* "<keys>": "STRING_VALUE",
117117
* },
118118
* KeyId: "STRING_VALUE", // required
119-
* KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2", // required
119+
* KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2" || "ECC_NIST_EDWARDS25519", // required
120120
* GrantTokens: [ // GrantTokenList
121121
* "STRING_VALUE",
122122
* ],
@@ -128,7 +128,7 @@ export interface GenerateDataKeyPairWithoutPlaintextCommandOutput
128128
* // PrivateKeyCiphertextBlob: new Uint8Array(),
129129
* // PublicKey: new Uint8Array(),
130130
* // KeyId: "STRING_VALUE",
131-
* // KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2",
131+
* // KeyPairSpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SM2" || "ECC_NIST_EDWARDS25519",
132132
* // KeyMaterialId: "STRING_VALUE",
133133
* // };
134134
*

0 commit comments

Comments
 (0)