@aws-crypto/example-node - npm Package Compare versions

Comparing version 2.1.0 to 2.2.0

build/main/kms_max_encrypted_data_keys.d.ts

+/// <reference types="node" />
+export declare function kmsEncryptWithMaxEncryptedDataKeysTest(numKeys: number): Promise<{
+    plaintext: Buffer;
+    result: Buffer;
+    cleartext: string;
+}>;
+/**
+ * Try decrypting a ciphertext with `numKeys` many keys, where the decrypting
+ * client has `maxEncryptedDataKeys` set to 3.
+ */
+export declare function kmsDecryptWithMaxEncryptedDataKeysTest(numKeys: number): Promise<{
+    plaintext: Buffer;
+    result: Buffer;
+    cleartext: string;
+}>;
+//# sourceMappingURL=kms_max_encrypted_data_keys.d.ts.map

build/main/kms_max_encrypted_data_keys.d.ts.map

+{"version":3,"file":"kms_max_encrypted_data_keys.d.ts","sourceRoot":"","sources":["../../src/kms_max_encrypted_data_keys.ts"],"names":[],"mappings":";AA4BA,wBAAsB,sCAAsC,CAAC,OAAO,EAAE,MAAM;;;;GAuB3E;AAED;;;GAGG;AACH,wBAAsB,sCAAsC,CAAC,OAAO,EAAE,MAAM;;;;GAoB3E"}

build/main/kms_max_encrypted_data_keys.js

+"use strict";
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kmsDecryptWithMaxEncryptedDataKeysTest = exports.kmsEncryptWithMaxEncryptedDataKeysTest = void 0;
+const client_node_1 = require("@aws-crypto/client-node");
+/* A KMS CMK is required to generate the data key.
+ * You need kms:GenerateDataKey permission on the CMK in generatorKeyId.
+ */
+const generatorKeyId = 'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt';
+/* An alternate KMS key that can decrypt.
+ * Access to kms:Encrypt is required.
+ */
+const alternateKeyId = 'arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f';
+const commitmentPolicy = client_node_1.CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT;
+/* replicate(length, val) is an array containing `length` many copies of `val`.
+ */
+function replicate(length, val) {
+    return Array.from({ length }, () => val);
+}
+async function kmsEncryptWithMaxEncryptedDataKeysTest(numKeys) {
+    /* Encrypting client allows 3 encrypted data keys.
+     * Decrypting client has no limit.
+     */
+    const { encrypt } = client_node_1.buildClient({ commitmentPolicy, maxEncryptedDataKeys: 3 });
+    const { decrypt } = client_node_1.buildClient({
+        commitmentPolicy,
+        maxEncryptedDataKeys: false,
+    });
+    /* `keyring` has a total of `numKeys`-many keys. */
+    const keyring = new client_node_1.KmsKeyringNode({
+        generatorKeyId,
+        keyIds: replicate(numKeys - 1, alternateKeyId),
+    });
+    /* Encrypt and decrypt. */
+    const cleartext = 'asdf';
+    const { result } = await encrypt(keyring, cleartext);
+    const { plaintext } = await decrypt(keyring, result);
+    /* Return the values for testing. */
+    return { plaintext, result, cleartext };
+}
+exports.kmsEncryptWithMaxEncryptedDataKeysTest = kmsEncryptWithMaxEncryptedDataKeysTest;
+/**
+ * Try decrypting a ciphertext with `numKeys` many keys, where the decrypting
+ * client has `maxEncryptedDataKeys` set to 3.
+ */
+async function kmsDecryptWithMaxEncryptedDataKeysTest(numKeys) {
+    const { encrypt } = client_node_1.buildClient({
+        commitmentPolicy,
+        maxEncryptedDataKeys: false,
+    });
+    const { decrypt } = client_node_1.buildClient({ commitmentPolicy, maxEncryptedDataKeys: 3 });
+    /* `keyring` has a total of `numKeys`-many keys. */
+    const keyring = new client_node_1.KmsKeyringNode({
+        generatorKeyId,
+        keyIds: replicate(numKeys - 1, alternateKeyId),
+    });
+    /* Encrypt and decrypt. */
+    const cleartext = 'asdf';
+    const { result } = await encrypt(keyring, cleartext);
+    const { plaintext } = await decrypt(keyring, result);
+    /* Return the values for testing. */
+    return { plaintext, result, cleartext };
+}
+exports.kmsDecryptWithMaxEncryptedDataKeysTest = kmsDecryptWithMaxEncryptedDataKeysTest;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX21heF9lbmNyeXB0ZWRfZGF0YV9rZXlzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2ttc19tYXhfZW5jcnlwdGVkX2RhdGFfa2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUEsb0VBQW9FO0FBQ3BFLHNDQUFzQzs7O0FBRXRDLHlEQUlnQztBQUVoQzs7R0FFRztBQUNILE1BQU0sY0FBYyxHQUFHLHlEQUF5RCxDQUFBO0FBRWhGOztHQUVHO0FBQ0gsTUFBTSxjQUFjLEdBQ2xCLDZFQUE2RSxDQUFBO0FBRS9FLE1BQU0sZ0JBQWdCLEdBQUcsOEJBQWdCLENBQUMsNEJBQTRCLENBQUE7QUFFdEU7R0FDRztBQUNILFNBQVMsU0FBUyxDQUFJLE1BQWMsRUFBRSxHQUFNO0lBQzFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQzFDLENBQUM7QUFFTSxLQUFLLFVBQVUsc0NBQXNDLENBQUMsT0FBZTtJQUMxRTs7T0FFRztJQUNILE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyx5QkFBVyxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQTtJQUM5RSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcseUJBQVcsQ0FBQztRQUM5QixnQkFBZ0I7UUFDaEIsb0JBQW9CLEVBQUUsS0FBSztLQUM1QixDQUFDLENBQUE7SUFFRixtREFBbUQ7SUFDbkQsTUFBTSxPQUFPLEdBQUcsSUFBSSw0QkFBYyxDQUFDO1FBQ2pDLGNBQWM7UUFDZCxNQUFNLEVBQUUsU0FBUyxDQUFDLE9BQU8sR0FBRyxDQUFDLEVBQUUsY0FBYyxDQUFDO0tBQy9DLENBQUMsQ0FBQTtJQUVGLDBCQUEwQjtJQUMxQixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUE7SUFDeEIsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQTtJQUNwRCxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRXBELG9DQUFvQztJQUNwQyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQTtBQUN6QyxDQUFDO0FBdkJELHdGQXVCQztBQUVEOzs7R0FHRztBQUNJLEtBQUssVUFBVSxzQ0FBc0MsQ0FBQyxPQUFlO0lBQzFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyx5QkFBVyxDQUFDO1FBQzlCLGdCQUFnQjtRQUNoQixvQkFBb0IsRUFBRSxLQUFLO0tBQzVCLENBQUMsQ0FBQTtJQUNGLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyx5QkFBVyxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQTtJQUU5RSxtREFBbUQ7SUFDbkQsTUFBTSxPQUFPLEdBQUcsSUFBSSw0QkFBYyxDQUFDO1FBQ2pDLGNBQWM7UUFDZCxNQUFNLEVBQUUsU0FBUyxDQUFDLE9BQU8sR0FBRyxDQUFDLEVBQUUsY0FBYyxDQUFDO0tBQy9DLENBQUMsQ0FBQTtJQUVGLDBCQUEwQjtJQUMxQixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUE7SUFDeEIsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQTtJQUNwRCxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRXBELG9DQUFvQztJQUNwQyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQTtBQUN6QyxDQUFDO0FBcEJELHdGQW9CQyJ9

build/module/kms_max_encrypted_data_keys.d.ts

+/// <reference types="node" />
+export declare function kmsEncryptWithMaxEncryptedDataKeysTest(numKeys: number): Promise<{
+    plaintext: Buffer;
+    result: Buffer;
+    cleartext: string;
+}>;
+/**
+ * Try decrypting a ciphertext with `numKeys` many keys, where the decrypting
+ * client has `maxEncryptedDataKeys` set to 3.
+ */
+export declare function kmsDecryptWithMaxEncryptedDataKeysTest(numKeys: number): Promise<{
+    plaintext: Buffer;
+    result: Buffer;
+    cleartext: string;
+}>;
+//# sourceMappingURL=kms_max_encrypted_data_keys.d.ts.map

build/module/kms_max_encrypted_data_keys.d.ts.map

+{"version":3,"file":"kms_max_encrypted_data_keys.d.ts","sourceRoot":"","sources":["../../src/kms_max_encrypted_data_keys.ts"],"names":[],"mappings":";AA4BA,wBAAsB,sCAAsC,CAAC,OAAO,EAAE,MAAM;;;;GAuB3E;AAED;;;GAGG;AACH,wBAAsB,sCAAsC,CAAC,OAAO,EAAE,MAAM;;;;GAoB3E"}

build/module/kms_max_encrypted_data_keys.js

+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { KmsKeyringNode, buildClient, CommitmentPolicy, } from '@aws-crypto/client-node';
+/* A KMS CMK is required to generate the data key.
+ * You need kms:GenerateDataKey permission on the CMK in generatorKeyId.
+ */
+const generatorKeyId = 'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt';
+/* An alternate KMS key that can decrypt.
+ * Access to kms:Encrypt is required.
+ */
+const alternateKeyId = 'arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f';
+const commitmentPolicy = CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT;
+/* replicate(length, val) is an array containing `length` many copies of `val`.
+ */
+function replicate(length, val) {
+    return Array.from({ length }, () => val);
+}
+export async function kmsEncryptWithMaxEncryptedDataKeysTest(numKeys) {
+    /* Encrypting client allows 3 encrypted data keys.
+     * Decrypting client has no limit.
+     */
+    const { encrypt } = buildClient({ commitmentPolicy, maxEncryptedDataKeys: 3 });
+    const { decrypt } = buildClient({
+        commitmentPolicy,
+        maxEncryptedDataKeys: false,
+    });
+    /* `keyring` has a total of `numKeys`-many keys. */
+    const keyring = new KmsKeyringNode({
+        generatorKeyId,
+        keyIds: replicate(numKeys - 1, alternateKeyId),
+    });
+    /* Encrypt and decrypt. */
+    const cleartext = 'asdf';
+    const { result } = await encrypt(keyring, cleartext);
+    const { plaintext } = await decrypt(keyring, result);
+    /* Return the values for testing. */
+    return { plaintext, result, cleartext };
+}
+/**
+ * Try decrypting a ciphertext with `numKeys` many keys, where the decrypting
+ * client has `maxEncryptedDataKeys` set to 3.
+ */
+export async function kmsDecryptWithMaxEncryptedDataKeysTest(numKeys) {
+    const { encrypt } = buildClient({
+        commitmentPolicy,
+        maxEncryptedDataKeys: false,
+    });
+    const { decrypt } = buildClient({ commitmentPolicy, maxEncryptedDataKeys: 3 });
+    /* `keyring` has a total of `numKeys`-many keys. */
+    const keyring = new KmsKeyringNode({
+        generatorKeyId,
+        keyIds: replicate(numKeys - 1, alternateKeyId),
+    });
+    /* Encrypt and decrypt. */
+    const cleartext = 'asdf';
+    const { result } = await encrypt(keyring, cleartext);
+    const { plaintext } = await decrypt(keyring, result);
+    /* Return the values for testing. */
+    return { plaintext, result, cleartext };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX21heF9lbmNyeXB0ZWRfZGF0YV9rZXlzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2ttc19tYXhfZW5jcnlwdGVkX2RhdGFfa2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDO0FBRXRDLE9BQU8sRUFDTCxjQUFjLEVBQ2QsV0FBVyxFQUNYLGdCQUFnQixHQUNqQixNQUFNLHlCQUF5QixDQUFBO0FBRWhDOztHQUVHO0FBQ0gsTUFBTSxjQUFjLEdBQUcseURBQXlELENBQUE7QUFFaEY7O0dBRUc7QUFDSCxNQUFNLGNBQWMsR0FDbEIsNkVBQTZFLENBQUE7QUFFL0UsTUFBTSxnQkFBZ0IsR0FBRyxnQkFBZ0IsQ0FBQyw0QkFBNEIsQ0FBQTtBQUV0RTtHQUNHO0FBQ0gsU0FBUyxTQUFTLENBQUksTUFBYyxFQUFFLEdBQU07SUFDMUMsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUE7QUFDMUMsQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsc0NBQXNDLENBQUMsT0FBZTtJQUMxRTs7T0FFRztJQUNILE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxXQUFXLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFBO0lBQzlFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxXQUFXLENBQUM7UUFDOUIsZ0JBQWdCO1FBQ2hCLG9CQUFvQixFQUFFLEtBQUs7S0FDNUIsQ0FBQyxDQUFBO0lBRUYsbURBQW1EO0lBQ25ELE1BQU0sT0FBTyxHQUFHLElBQUksY0FBYyxDQUFDO1FBQ2pDLGNBQWM7UUFDZCxNQUFNLEVBQUUsU0FBUyxDQUFDLE9BQU8sR0FBRyxDQUFDLEVBQUUsY0FBYyxDQUFDO0tBQy9DLENBQUMsQ0FBQTtJQUVGLDBCQUEwQjtJQUMxQixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUE7SUFDeEIsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQTtJQUNwRCxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRXBELG9DQUFvQztJQUNwQyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQTtBQUN6QyxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxzQ0FBc0MsQ0FBQyxPQUFlO0lBQzFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxXQUFXLENBQUM7UUFDOUIsZ0JBQWdCO1FBQ2hCLG9CQUFvQixFQUFFLEtBQUs7S0FDNUIsQ0FBQyxDQUFBO0lBQ0YsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLFdBQVcsQ0FBQyxFQUFFLGdCQUFnQixFQUFFLG9CQUFvQixFQUFFLENBQUMsRUFBRSxDQUFDLENBQUE7SUFFOUUsbURBQW1EO0lBQ25ELE1BQU0sT0FBTyxHQUFHLElBQUksY0FBYyxDQUFDO1FBQ2pDLGNBQWM7UUFDZCxNQUFNLEVBQUUsU0FBUyxDQUFDLE9BQU8sR0FBRyxDQUFDLEVBQUUsY0FBYyxDQUFDO0tBQy9DLENBQUMsQ0FBQTtJQUVGLDBCQUEwQjtJQUMxQixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUE7SUFDeEIsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQTtJQUNwRCxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRXBELG9DQUFvQztJQUNwQyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQTtBQUN6QyxDQUFDIn0=

build/main/kms_filtered_discovery.d.ts

 /// <reference types="node" />
 export declare function kmsFilteredDiscoveryTest(ciphertext: string | Buffer, accountID: string, partition: string): Promise<{
     ciphertext: string | Buffer;
-    cleartext: import("@aws-crypto/decrypt-node/build/main/decrypt").DecryptOutput;
+    cleartext: import("@aws-crypto/client-node").DecryptOutput;
 }>;
 //# sourceMappingURL=kms_filtered_discovery.d.ts.map

build/main/kms_regional_discovery.d.ts

 /// <reference types="node" />
 export declare function kmsRegionalDiscoveryLimitTest(ciphertext: string | Buffer): Promise<{
     ciphertext: string | Buffer;
-    cleartext: import("@aws-crypto/decrypt-node/build/main/decrypt").DecryptOutput;
+    cleartext: import("@aws-crypto/client-node").DecryptOutput;
 }>;
 export declare function kmsRegionalDiscoveryExcludeTest(ciphertext: string | Buffer): Promise<{
     ciphertext: string | Buffer;
-    cleartext: import("@aws-crypto/decrypt-node/build/main/decrypt").DecryptOutput;
+    cleartext: import("@aws-crypto/client-node").DecryptOutput;
 }>;
 //# sourceMappingURL=kms_regional_discovery.d.ts.map

build/main/kms_stream.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"kms_stream.d.ts","sourceRoot":"","sources":["../../src/kms_stream.ts"],"names":[],"mappings":";AA2BA,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,mBAwDnD"}
+{"version":3,"file":"kms_stream.d.ts","sourceRoot":"","sources":["../../src/kms_stream.ts"],"names":[],"mappings":";AA4BA,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,mBAuEnD"}

build/main/kms_stream.js

@@ -7,2 +7,3 @@ "use strict";
 const client_node_1 = require("@aws-crypto/client-node");
+const material_management_1 = require("@aws-crypto/material-management");
 /* This builds the client with the REQUIRE_ENCRYPT_REQUIRE_DECRYPT commitment policy,
@@ -16,3 +17,3 @@ * which enforces that this client only encrypts using committing algorithm suites
  */
-const { encryptStream, decryptStream } = client_node_1.buildClient(client_node_1.CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT);
+const { encryptStream, decryptUnsignedMessageStream } = client_node_1.buildClient(client_node_1.CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT);
 const stream_1 = require("stream");
@@ -45,4 +46,16 @@ const fs_1 = require("fs");
     const stream = fs_1.createReadStream(filename)
-        .pipe(encryptStream(keyring, { encryptionContext: context }))
-        .pipe(decryptStream(new client_node_1.KmsKeyringNode({ discovery: true })))
+        .pipe(encryptStream(keyring, {
+        /*
+         * Since we are streaming, and assuming that the encryption and decryption contexts
+         * are equally trusted, using an unsigned algorithm suite is faster and avoids
+         * the possibility of processing plaintext before the signature is verified.
+         */
+        suiteId: material_management_1.AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA512_COMMIT_KEY,
+        encryptionContext: context,
+    }))
+        /*
+         * decryptUnsignedMessageStream is recommended when streaming if you don't need
+         * digital signatures.
+         */
+        .pipe(decryptUnsignedMessageStream(new client_node_1.KmsKeyringNode({ discovery: true })))
         .on('MessageHeader', ({ encryptionContext }) => {
@@ -75,2 +88,2 @@ /* Verify the encryption context.
 exports.kmsStreamTest = kmsStreamTest;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX3N0cmVhbS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rbXNfc3RyZWFtLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDOzs7QUFFdEMseURBS2dDO0FBRWhDOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxHQUFHLHlCQUFXLENBQ2xELDhCQUFnQixDQUFDLCtCQUErQixDQUNqRCxDQUFBO0FBRUQsbUNBQWlDO0FBQ2pDLDJCQUFxQztBQUNyQywrQkFBZ0M7QUFDaEMsTUFBTSxhQUFhLEdBQUcsZ0JBQVMsQ0FBQyxpQkFBUSxDQUFDLENBQUE7QUFFbEMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxRQUFnQjtJQUNsRDs7T0FFRztJQUNILE1BQU0sY0FBYyxHQUNsQix5REFBeUQsQ0FBQTtJQUUzRCw4REFBOEQ7SUFDOUQsTUFBTSxPQUFPLEdBQUcsSUFBSSw0QkFBYyxDQUFDLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQTtJQUV0RDs7Ozs7Ozs7T0FRRztJQUNILE1BQU0sT0FBTyxHQUFHO1FBQ2QsS0FBSyxFQUFFLE1BQU07UUFDYixPQUFPLEVBQUUsMEJBQTBCO1FBQ25DLE1BQU0sRUFBRSxXQUFXO0tBQ3BCLENBQUE7SUFFRCw0RUFBNEU7SUFDNUUsTUFBTSxNQUFNLEdBQUcscUJBQWdCLENBQUMsUUFBUSxDQUFDO1NBQ3RDLElBQUksQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztTQUM1RCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksNEJBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7U0FDNUQsRUFBRSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsaUJBQWlCLEVBQWlCLEVBQUUsRUFBRTtRQUM1RDs7Ozs7O1dBTUc7UUFDSCxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxLQUFLO2dCQUNsQyxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLENBQUE7UUFDeEUsQ0FBQyxDQUFDLENBQUE7SUFDSixDQUFDLENBQUMsQ0FBQTtJQUVKOzs7OztPQUtHO0lBQ0gsTUFBTSxJQUFJLEdBQWEsRUFBRSxDQUFBO0lBQ3pCLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUU7UUFDbEMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNsQixDQUFDLENBQUMsQ0FBQTtJQUVGLE1BQU0sYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQzNCLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQTtBQUM1QixDQUFDO0FBeERELHNDQXdEQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX3N0cmVhbS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rbXNfc3RyZWFtLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDOzs7QUFFdEMseURBS2dDO0FBQ2hDLHlFQUEwRTtBQUUxRTs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxFQUFFLGFBQWEsRUFBRSw0QkFBNEIsRUFBRSxHQUFHLHlCQUFXLENBQ2pFLDhCQUFnQixDQUFDLCtCQUErQixDQUNqRCxDQUFBO0FBRUQsbUNBQWlDO0FBQ2pDLDJCQUFxQztBQUNyQywrQkFBZ0M7QUFDaEMsTUFBTSxhQUFhLEdBQUcsZ0JBQVMsQ0FBQyxpQkFBUSxDQUFDLENBQUE7QUFFbEMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxRQUFnQjtJQUNsRDs7T0FFRztJQUNILE1BQU0sY0FBYyxHQUNsQix5REFBeUQsQ0FBQTtJQUUzRCw4REFBOEQ7SUFDOUQsTUFBTSxPQUFPLEdBQUcsSUFBSSw0QkFBYyxDQUFDLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQTtJQUV0RDs7Ozs7Ozs7T0FRRztJQUNILE1BQU0sT0FBTyxHQUFHO1FBQ2QsS0FBSyxFQUFFLE1BQU07UUFDYixPQUFPLEVBQUUsMEJBQTBCO1FBQ25DLE1BQU0sRUFBRSxXQUFXO0tBQ3BCLENBQUE7SUFFRCw0RUFBNEU7SUFDNUUsTUFBTSxNQUFNLEdBQUcscUJBQWdCLENBQUMsUUFBUSxDQUFDO1NBQ3RDLElBQUksQ0FDSCxhQUFhLENBQUMsT0FBTyxFQUFFO1FBQ3JCOzs7O1dBSUc7UUFDSCxPQUFPLEVBQ0wsOENBQXdCLENBQUMsZ0RBQWdEO1FBQzNFLGlCQUFpQixFQUFFLE9BQU87S0FDM0IsQ0FBQyxDQUNIO1FBQ0Q7OztXQUdHO1NBQ0YsSUFBSSxDQUFDLDRCQUE0QixDQUFDLElBQUksNEJBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7U0FDM0UsRUFBRSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsaUJBQWlCLEVBQWlCLEVBQUUsRUFBRTtRQUM1RDs7Ozs7O1dBTUc7UUFDSCxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxLQUFLO2dCQUNsQyxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLENBQUE7UUFDeEUsQ0FBQyxDQUFDLENBQUE7SUFDSixDQUFDLENBQUMsQ0FBQTtJQUVKOzs7OztPQUtHO0lBQ0gsTUFBTSxJQUFJLEdBQWEsRUFBRSxDQUFBO0lBQ3pCLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUU7UUFDbEMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNsQixDQUFDLENBQUMsQ0FBQTtJQUVGLE1BQU0sYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQzNCLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQTtBQUM1QixDQUFDO0FBdkVELHNDQXVFQyJ9

build/module/kms_filtered_discovery.d.ts

 /// <reference types="node" />
 export declare function kmsFilteredDiscoveryTest(ciphertext: string | Buffer, accountID: string, partition: string): Promise<{
     ciphertext: string | Buffer;
-    cleartext: import("@aws-crypto/decrypt-node/build/main/decrypt").DecryptOutput;
+    cleartext: import("@aws-crypto/client-node").DecryptOutput;
 }>;
 //# sourceMappingURL=kms_filtered_discovery.d.ts.map

build/module/kms_regional_discovery.d.ts

 /// <reference types="node" />
 export declare function kmsRegionalDiscoveryLimitTest(ciphertext: string | Buffer): Promise<{
     ciphertext: string | Buffer;
-    cleartext: import("@aws-crypto/decrypt-node/build/main/decrypt").DecryptOutput;
+    cleartext: import("@aws-crypto/client-node").DecryptOutput;
 }>;
 export declare function kmsRegionalDiscoveryExcludeTest(ciphertext: string | Buffer): Promise<{
     ciphertext: string | Buffer;
-    cleartext: import("@aws-crypto/decrypt-node/build/main/decrypt").DecryptOutput;
+    cleartext: import("@aws-crypto/client-node").DecryptOutput;
 }>;
 //# sourceMappingURL=kms_regional_discovery.d.ts.map

build/module/kms_stream.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"kms_stream.d.ts","sourceRoot":"","sources":["../../src/kms_stream.ts"],"names":[],"mappings":";AA2BA,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,mBAwDnD"}
+{"version":3,"file":"kms_stream.d.ts","sourceRoot":"","sources":["../../src/kms_stream.ts"],"names":[],"mappings":";AA4BA,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,mBAuEnD"}

build/module/kms_stream.js

 // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 import { KmsKeyringNode, buildClient, CommitmentPolicy, } from '@aws-crypto/client-node';
+import { AlgorithmSuiteIdentifier } from '@aws-crypto/material-management';
 /* This builds the client with the REQUIRE_ENCRYPT_REQUIRE_DECRYPT commitment policy,
@@ -12,3 +13,3 @@ * which enforces that this client only encrypts using committing algorithm suites
  */
-const { encryptStream, decryptStream } = buildClient(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT);
+const { encryptStream, decryptUnsignedMessageStream } = buildClient(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT);
 import { finished } from 'stream';
@@ -41,4 +42,16 @@ import { createReadStream } from 'fs';
     const stream = createReadStream(filename)
-        .pipe(encryptStream(keyring, { encryptionContext: context }))
-        .pipe(decryptStream(new KmsKeyringNode({ discovery: true })))
+        .pipe(encryptStream(keyring, {
+        /*
+         * Since we are streaming, and assuming that the encryption and decryption contexts
+         * are equally trusted, using an unsigned algorithm suite is faster and avoids
+         * the possibility of processing plaintext before the signature is verified.
+         */
+        suiteId: AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA512_COMMIT_KEY,
+        encryptionContext: context,
+    }))
+        /*
+         * decryptUnsignedMessageStream is recommended when streaming if you don't need
+         * digital signatures.
+         */
+        .pipe(decryptUnsignedMessageStream(new KmsKeyringNode({ discovery: true })))
         .on('MessageHeader', ({ encryptionContext }) => {
@@ -70,2 +83,2 @@ /* Verify the encryption context.
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX3N0cmVhbS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rbXNfc3RyZWFtLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7QUFFdEMsT0FBTyxFQUNMLGNBQWMsRUFDZCxXQUFXLEVBQ1gsZ0JBQWdCLEdBRWpCLE1BQU0seUJBQXlCLENBQUE7QUFFaEM7Ozs7Ozs7R0FPRztBQUNILE1BQU0sRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLEdBQUcsV0FBVyxDQUNsRCxnQkFBZ0IsQ0FBQywrQkFBK0IsQ0FDakQsQ0FBQTtBQUVELE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxRQUFRLENBQUE7QUFDakMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sSUFBSSxDQUFBO0FBQ3JDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxNQUFNLENBQUE7QUFDaEMsTUFBTSxhQUFhLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0FBRXpDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsYUFBYSxDQUFDLFFBQWdCO0lBQ2xEOztPQUVHO0lBQ0gsTUFBTSxjQUFjLEdBQ2xCLHlEQUF5RCxDQUFBO0lBRTNELDhEQUE4RDtJQUM5RCxNQUFNLE9BQU8sR0FBRyxJQUFJLGNBQWMsQ0FBQyxFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUE7SUFFdEQ7Ozs7Ozs7O09BUUc7SUFDSCxNQUFNLE9BQU8sR0FBRztRQUNkLEtBQUssRUFBRSxNQUFNO1FBQ2IsT0FBTyxFQUFFLDBCQUEwQjtRQUNuQyxNQUFNLEVBQUUsV0FBVztLQUNwQixDQUFBO0lBRUQsNEVBQTRFO0lBQzVFLE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQztTQUN0QyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7U0FDNUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7U0FDNUQsRUFBRSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsaUJBQWlCLEVBQWlCLEVBQUUsRUFBRTtRQUM1RDs7Ozs7O1dBTUc7UUFDSCxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxLQUFLO2dCQUNsQyxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLENBQUE7UUFDeEUsQ0FBQyxDQUFDLENBQUE7SUFDSixDQUFDLENBQUMsQ0FBQTtJQUVKOzs7OztPQUtHO0lBQ0gsTUFBTSxJQUFJLEdBQWEsRUFBRSxDQUFBO0lBQ3pCLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUU7UUFDbEMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNsQixDQUFDLENBQUMsQ0FBQTtJQUVGLE1BQU0sYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQzNCLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQTtBQUM1QixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX3N0cmVhbS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rbXNfc3RyZWFtLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7QUFFdEMsT0FBTyxFQUNMLGNBQWMsRUFDZCxXQUFXLEVBQ1gsZ0JBQWdCLEdBRWpCLE1BQU0seUJBQXlCLENBQUE7QUFDaEMsT0FBTyxFQUFFLHdCQUF3QixFQUFFLE1BQU0saUNBQWlDLENBQUE7QUFFMUU7Ozs7Ozs7R0FPRztBQUNILE1BQU0sRUFBRSxhQUFhLEVBQUUsNEJBQTRCLEVBQUUsR0FBRyxXQUFXLENBQ2pFLGdCQUFnQixDQUFDLCtCQUErQixDQUNqRCxDQUFBO0FBRUQsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLFFBQVEsQ0FBQTtBQUNqQyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxJQUFJLENBQUE7QUFDckMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLE1BQU0sQ0FBQTtBQUNoQyxNQUFNLGFBQWEsR0FBRyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUE7QUFFekMsTUFBTSxDQUFDLEtBQUssVUFBVSxhQUFhLENBQUMsUUFBZ0I7SUFDbEQ7O09BRUc7SUFDSCxNQUFNLGNBQWMsR0FDbEIseURBQXlELENBQUE7SUFFM0QsOERBQThEO0lBQzlELE1BQU0sT0FBTyxHQUFHLElBQUksY0FBYyxDQUFDLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQTtJQUV0RDs7Ozs7Ozs7T0FRRztJQUNILE1BQU0sT0FBTyxHQUFHO1FBQ2QsS0FBSyxFQUFFLE1BQU07UUFDYixPQUFPLEVBQUUsMEJBQTBCO1FBQ25DLE1BQU0sRUFBRSxXQUFXO0tBQ3BCLENBQUE7SUFFRCw0RUFBNEU7SUFDNUUsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxDQUFDO1NBQ3RDLElBQUksQ0FDSCxhQUFhLENBQUMsT0FBTyxFQUFFO1FBQ3JCOzs7O1dBSUc7UUFDSCxPQUFPLEVBQ0wsd0JBQXdCLENBQUMsZ0RBQWdEO1FBQzNFLGlCQUFpQixFQUFFLE9BQU87S0FDM0IsQ0FBQyxDQUNIO1FBQ0Q7OztXQUdHO1NBQ0YsSUFBSSxDQUFDLDRCQUE0QixDQUFDLElBQUksY0FBYyxDQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztTQUMzRSxFQUFFLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxpQkFBaUIsRUFBaUIsRUFBRSxFQUFFO1FBQzVEOzs7Ozs7V0FNRztRQUNILE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRTtZQUMvQyxJQUFJLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxLQUFLLEtBQUs7Z0JBQ2xDLE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQTtRQUN4RSxDQUFDLENBQUMsQ0FBQTtJQUNKLENBQUMsQ0FBQyxDQUFBO0lBRUo7Ozs7O09BS0c7SUFDSCxNQUFNLElBQUksR0FBYSxFQUFFLENBQUE7SUFDekIsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFhLEVBQUUsRUFBRTtRQUNsQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ2xCLENBQUMsQ0FBQyxDQUFBO0lBRUYsTUFBTSxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDM0IsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFBO0FBQzVCLENBQUMifQ==

CHANGELOG.md

@@ -6,2 +6,10 @@ # Change Log
 
+# [2.2.0](https://github.com/aws/private-aws-encryption-sdk-javascript-staging/compare/@aws-crypto/example-node@2.1.0...@aws-crypto/example-node@2.2.0) (2021-05-27)
+
+**Note:** Version bump only for package @aws-crypto/example-node
+
+
+
+
+
 # [2.1.0](https://github.com/aws/aws-encryption-sdk-javascript/compare/@aws-crypto/example-node@2.0.0...@aws-crypto/example-node@2.1.0) (2021-02-04)
@@ -8,0 +16,0 @@

package.json

 {
   "name": "@aws-crypto/example-node",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "scripts": {
@@ -21,4 +21,4 @@ "prepublishOnly": "npm run build",
   "dependencies": {
-    "@aws-crypto/client-node": "^2.1.0",
-    "tslib": "^1.11.1"
+    "@aws-crypto/client-node": "^2.2.0",
+    "tslib": "^2.2.0"
   },
@@ -32,3 +32,3 @@ "sideEffects": false,
   ],
-  "gitHead": "c6ef12119e60d8527375c600155ff3437c70b44e"
+  "gitHead": "35a8888596e935beabb99f872da26abc61d20a3e"
 }

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1094690

3.55%

Number of package files

73

8.96%

Lines of code

1692

11.98%

Dependency changes

• - Removed

  tslib@1.14.1
  (transitive)

• Updated

  @aws-crypto/client-node@^2.2.0

• Updated

  tslib@^2.2.0