Examkin

Question

Difficulty: Very hardAWS KMS and Encryption

An application needs to decrypt a large dataset (5 GB5\text{ GB}) that was previously encrypted client-side using envelope encryption with an AWS KMS Customer Managed Key (CMK). The encrypted dataset consists of the ciphertext data and the encrypted data key, both of which are stored in an Amazon S3 bucket. The application's IAM role has been granted `kms:Decrypt` permissions.

Which of the following steps must the developer implement in the application code to successfully decrypt the dataset? (Select TWO.)

  1. Call the AWS KMS `Decrypt` API operation, passing the encrypted data key to retrieve the plaintext data key.Answer
  2. Decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.Answer
  3. C
    Call the AWS KMS `Decrypt` API operation, passing the entire ciphertext dataset to retrieve the decrypted plaintext data directly.
  4. D
    Call the AWS KMS `GenerateDataKey` API operation, passing the KMS key identifier to generate a new plaintext key for decrypting the data.
  5. E
    Call the AWS KMS `ReEncrypt` API operation, passing the encrypted data key and the ciphertext dataset to decrypt it in a single request.

Answer

To decrypt a large dataset encrypted client-side with envelope encryption, the application must call the KMS Decrypt API operation, passing the encrypted data key to obtain the plaintext data key, and then decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.
In client-side envelope encryption, the Customer Managed Key (CMK) in AWS KMS is only used to decrypt the encrypted data key. The application must first send the encrypted data key to KMS via the `Decrypt` API to retrieve the plaintext data key. Once retrieved, the actual decryption of the large dataset (in this case, 5 GB5\text{ GB}) is performed locally on the client side using a symmetric decryption algorithm (like AES) with the plaintext data key. This avoids sending large files over the network to KMS and bypasses KMS API payload limits.

Step-by-Step Solution

1
Retrieve the encrypted data key and the ciphertext dataset from the S3 bucket.
The application has the encrypted data key and the encrypted dataset ready in memory or buffer.
Before performing any cryptographic operations, both the encrypted key and ciphertext must be accessed.
2
Call the AWS KMS `Decrypt` API, providing the encrypted data key as the CiphertextBlob parameter.
AWS KMS decrypts the data key using the designated Customer Managed Key (CMK) and returns the plaintext data key.
The Customer Managed Key (CMK) is kept securely within KMS HSMs; only KMS can decrypt the encrypted data key.
3
Use the returned plaintext data key with a local cryptographic library (such as AES-GCM) to decrypt the ciphertext dataset.
The 5 GB5\text{ GB} ciphertext is decrypted locally into its original plaintext state.
KMS cannot decrypt large data directly due to the 4 KB4\text{ KB} payload limit, so decryption of the dataset must occur client-side.
4
Securely wipe the plaintext data key from the application's memory.
The plaintext data key is erased.
This minimizes the risk of the plaintext data key being exposed in memory dumps or logs.

Key Concept

Client-side envelope encryption relies on using a local plaintext data key (retrieved by decrypting the encrypted data key via KMS) to perform symmetric decryption on the actual dataset locally, rather than sending the large dataset to KMS.
Estimated Time:3m 0s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic