IllegalArgumentException getting a master key due to localization

Problem:

Coming from opensearch-project/flow-framework#233 (comment)

The code in JceMasterKey.getInstance() does an uppercase conversion without locale information:

aws-encryption-sdk-java/src/main/java/com/amazonaws/encryptionsdk/jce/JceMasterKey.java

Lines 57 to 68 in 43e078a

    
           public static JceMasterKey getInstance( 
        
               final SecretKey key, 
        
               final String provider, 
        
               final String keyId, 
        
               final String wrappingAlgorithm) { 
        
             switch (wrappingAlgorithm.toUpperCase()) { 
        
               case "AES/GCM/NOPADDING": 
        
                 return new JceMasterKey(provider, keyId, JceKeyCipher.aesGcm(key)); 
        
               default: 
        
                 throw new IllegalArgumentException("Right now only AES/GCM/NoPadding is supported"); 
        
             } 
        
           }

When operating in some locales, the case check fails. For example, locale tr-TR converts the "i" in padding to this unicode character.

This is noted here:

For instance with the Turkish language, when converting the small letter 'i' to upper case, the result is capital letter 'I' with a dot over it.

Solution:

The toUppercase() call in the above code (and everywhere, really) should specify Locale.ROOT.

String WRAPPING_ALGORITHM = "AES/GCM/NoPadding";
String t1 = WRAPPING_ALGORITHM.toUpperCase();
String t2 = WRAPPING_ALGORITHM.toUpperCase(Locale.ROOT);

t1 in hex: 41 45 53 2F 47 43 4D 2F 4E 4F 50 41 44 44 C4 B0 4E 47
t2 in hex: 41 45 53 2F 47 43 4D 2F 4E 4F 50 41 44 44 49 4E 47

Note all these tests fail if run in TR locale:

aws-encryption-sdk-java/src/test/java/com/amazonaws/encryptionsdk/jce/JceMasterKeyTest.java

Lines 48 to 70 in aff5b56

    
             /** 
        
              * Calls JceMasterKey.getInstance with differently cased wrappingAlgorithm names. Passes if no 
        
              * Exception is thrown. Relies on passing an invalid algorithm name to result in an Exception. 
        
              */ 
        
             @Test 
        
             public void testGetInstanceAllLowercase() { 
        
               jceGetInstance("aes/gcm/nopadding"); 
        
             } 
        
             @Test 
        
             public void testGetInstanceMixedCasing() { 
        
               jceGetInstance("AES/GCm/NOpadding"); 
        
             } 
        
             @Test 
        
             public void testGetInstanceAsymmetricAllLowercase() { 
        
               jceGetInstanceAsymmetric("rsa/ecb/oaepwithsha-256andmgf1padding"); 
        
             } 
        
             @Test 
        
             public void testGetInstanceAsymmetricMixedCasing() { 
        
               jceGetInstanceAsymmetric("RSA/ECB/OAepwithsha-256andmgf1padding"); 
        
             }

fix: Add Locale.ROOT to String uppercase conversions (#1880)

AWS Encryption SDK 3.0.1 Release -- 2024-06-12

Navigation Menu

Repository navigation

IllegalArgumentException getting a master key due to localization #1879

Problem:

Solution:

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	public static JceMasterKey getInstance(
	final SecretKey key,
	final String provider,
	final String keyId,
	final String wrappingAlgorithm) {
	switch (wrappingAlgorithm.toUpperCase()) {
	case "AES/GCM/NOPADDING":
	return new JceMasterKey(provider, keyId, JceKeyCipher.aesGcm(key));
	default:
	throw new IllegalArgumentException("Right now only AES/GCM/NoPadding is supported");
	}
	}

	/**
	* Calls JceMasterKey.getInstance with differently cased wrappingAlgorithm names. Passes if no
	* Exception is thrown. Relies on passing an invalid algorithm name to result in an Exception.
	*/
	@Test
	public void testGetInstanceAllLowercase() {
	jceGetInstance("aes/gcm/nopadding");
	}

	@Test
	public void testGetInstanceMixedCasing() {
	jceGetInstance("AES/GCm/NOpadding");
	}

	@Test
	public void testGetInstanceAsymmetricAllLowercase() {
	jceGetInstanceAsymmetric("rsa/ecb/oaepwithsha-256andmgf1padding");
	}

	@Test
	public void testGetInstanceAsymmetricMixedCasing() {
	jceGetInstanceAsymmetric("RSA/ECB/OAepwithsha-256andmgf1padding");
	}

IllegalArgumentException getting a master key due to localization #1879

Description

Problem:

Solution:

Activity

dbwiddis commented on Dec 8, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions