Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing application-side encryption for sensitive user profile data. When calling the AWS KMS `Encrypt` API, the developer includes an encryption context: `{"AppName": "UserProfileService"}`. The encrypted ciphertext is stored in a database. When the developer later attempts to decrypt this ciphertext using the AWS SDK, how must the encryption context be handled?

  1. A
    The decryption API automatically extracts the plaintext version of the encryption context from the ciphertext payload, so it does not need to be provided in the API call.
  2. B
    The encryption context is only used as a custom metadata tag in AWS CloudTrail for auditing, making its inclusion optional during the decryption process.
  3. The identical encryption context must be passed in the decryption API call; otherwise, AWS KMS will reject the request with an InvalidCiphertextException.Answer
  4. D
    The encryption context serves as a lookup key to retrieve the plaintext data key from Systems Manager Parameter Store to perform local decryption.

Answer

The identical encryption context must be passed in the decryption API call; otherwise, AWS KMS will reject the request with an InvalidCiphertextException.
When an encryption context is provided in an AWS KMS encryption request, it is cryptographically bound to the ciphertext as Additional Authenticated Data (AAD). To decrypt the ciphertext, the exact same encryption context (case-sensitive key-value pairs) must be supplied in the decryption request. If the context does not match, AWS KMS cannot decrypt the payload and returns an InvalidCiphertextException error.

Step-by-Step Solution

1
Analyze how AWS KMS handles encryption context during the `Encrypt` API call.
The encryption context is cryptographically bound to the ciphertext as Additional Authenticated Data (AAD) to ensure integrity.
This establishes that the encryption context is not merely metadata but a vital part of the cryptographic envelope.
2
Determine the requirements for the subsequent `Decrypt` API call.
The Decrypt request must include the exact same encryption context (key-value pairs) used during encryption.
If there is any mismatch in the keys or values, AWS KMS will fail to authenticate the payload and reject the request with an InvalidCiphertextException.

Key Concept

AWS KMS Encryption Context behaves as Additional Authenticated Data (AAD), requiring an exact, case-sensitive match during Decrypt operations to verify ciphertext integrity.
Estimated Time:1m 30s
Rate this question