A developer is implementing application-side encryption for sensitive user profile data. When calling the AWS KMS `Encrypt` API, the developer includes an encryption context: `{"AppName": "UserProfileService"}`. The encrypted ciphertext is stored in a database. When the developer later attempts to decrypt this ciphertext using the AWS SDK, how must the encryption context be handled?
- AThe decryption API automatically extracts the plaintext version of the encryption context from the ciphertext payload, so it does not need to be provided in the API call.
- BThe encryption context is only used as a custom metadata tag in AWS CloudTrail for auditing, making its inclusion optional during the decryption process.
- The identical encryption context must be passed in the decryption API call; otherwise, AWS KMS will reject the request with an InvalidCiphertextException.Answer
- DThe encryption context serves as a lookup key to retrieve the plaintext data key from Systems Manager Parameter Store to perform local decryption.
Answer
The identical encryption context must be passed in the decryption API call; otherwise, AWS KMS will reject the request with an InvalidCiphertextException.
When an encryption context is provided in an AWS KMS encryption request, it is cryptographically bound to the ciphertext as Additional Authenticated Data (AAD). To decrypt the ciphertext, the exact same encryption context (case-sensitive key-value pairs) must be supplied in the decryption request. If the context does not match, AWS KMS cannot decrypt the payload and returns an InvalidCiphertextException error.
Step-by-Step Solution
Key Concept
AWS KMS Encryption Context behaves as Additional Authenticated Data (AAD), requiring an exact, case-sensitive match during Decrypt operations to verify ciphertext integrity.
Estimated Time:1m 30s