Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An application downloads a 150 KB150\text{ KB} encrypted payload and its corresponding encrypted data key from an Amazon S3 bucket. The payload was encrypted client-side using envelope encryption with an AWS KMS customer managed key. Which of the following workflows should the developer implement in the application code to decrypt the payload?

  1. A
    Send the encrypted data key to the AWS KMS GenerateDataKey API operation to regenerate the plaintext key, and then decrypt the payload locally.
  2. Send the encrypted data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the payload locally using the plaintext key, and then delete the plaintext key from memory.Answer
  3. C
    Send the encrypted payload directly to the AWS KMS Decrypt API operation, as KMS can decrypt payloads up to 512 KB512\text{ KB} using a customer managed key.
  4. D
    Store the encrypted data key in AWS Systems Manager Parameter Store as a SecureString, and call the GetParameter API operation to automatically decrypt the payload.

Answer

Send the encrypted data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the payload locally using the plaintext key, and then delete the plaintext key from memory.
The correct workflow involves calling the KMS Decrypt API operation with the encrypted data key. Because direct KMS cryptographic operations are capped at 4096 bytes4096\text{ bytes} (4 KB4\text{ KB}), a 150 KB150\text{ KB} payload cannot be decrypted directly by KMS. Instead, the application must delegate the decryption of the small data key to KMS. Once the plaintext data key is returned, the actual data payload is decrypted locally using cryptographic libraries in the application code, and the plaintext data key is discarded from memory.

Step-by-Step Solution

1
Call the AWS KMS Decrypt API passing the encrypted data key.
AWS KMS decrypts the data key and returns the plaintext data key along with the KMS key ARN.
The ciphertext payload is too large (150 KB150\text{ KB}) to be decrypted directly by KMS, which has a limit of 4 KB4\text{ KB} for direct operations.
2
Use the plaintext data key to decrypt the payload locally in memory.
The plaintext version of the 150 KB150\text{ KB} payload is recovered.
Client-side decryption must occur locally using the symmetric key (the plaintext data key) generated during the initial encryption process.
3
Erase the plaintext data key from memory as soon as decryption is complete.
The plaintext data key is destroyed.
This is a security best practice to prevent the plaintext key from remaining in application memory longer than necessary.

Key Concept

KMS Envelope Decryption Workflow
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic