‫So now let's do a deep dive into
‫how KMS really works for the encrypt and decrypt APIs
‫as well as for envelope encryption.
‫So what we did is that we had a secret,
‫for example, a password,
‫and it was less than four kilobytes,
‫because this is a limit for KMS,
‫and we sent it into the KMS service.
‫So we use the encrypt API using an SDK or the CLI,
‫and then we specified the CMK we wanted to use in KMS.
‫And then KMS was checking
‫with IAM if we had the right permissions.
‫And if we did, then it would perform encryption for us.
‫What KMS will send us back
‫would be the entirely encrypted secret.
‫So that will be the encrypted data.
‫Then we need to decrypt it.
‫So we use the CLI or the SDK to do a decrypt API.
‫And then we would,
‫KMS would automatically actually,
‫understand which CMK was used for encryption
‫and look at it for performing decryption.
‫It would first check with IAM
‫to make sure that we have the correct permissions
‫to perform the decryption.
‫And if we do,
‫then it would send us via decrypted secret in plain-text.
‫So this is the encrypt and the decrypt API
‫and these are pretty easy.
‫So as we can see though there is a problem,
‫we are limited by the size of the secret to four kilobytes.
‫So for this we have a loop encryption.
‫So if you want to encrypt over four kilobytes,
‫then there's this technique
‫where you encrypt using an envelope.
‫And the main API you have to remember
‫for us to encrypt a large number,
‫large amount of data is to use the GenerateDataKey API.
‫So from an exam perspective,
‫if you want it to just stop here in this lecture,
‫anything over four kilobytes of data
‫has to be encrypted using the envelope encryption technique,
‫which corresponds to the KMS GeneratDataKey API.
‫Now I want you to go over the exam.
‫So I want to explain to you how this API works
‫and I think this could be valuable,
‫but rest assured this is a little bit difficult.
‫So if you don't follow, don't worry too much.
‫So we're going to go into envelope encryption.
‫So we have the KMS service,
‫and this time we want to encrypt a very big file.
‫Maybe it is up to 10 megabytes,
‫but it could be as big as you want, really.
‫So we're going to use the SDK,
‫and call the GenerateDataKey API,
‫and we'll specify a CMK,
‫and so KMS will check again the IAM permission,
‫making sure we can generate a data key.
‫And if we can,
‫then KMS will generate this data key for us,
‫and will send us back a plain-text version of it.
‫So we have a plain-text data key encryption,
‫data ecryption key, which is DEK.
‫So now we have this data encryption key,
‫but why do we have it?
‫Well, because now we can do something client side.
‫We can encrypt the big file client side
‫using our own CPU with this DEK.
‫So this gives us an encrypted file.
‫And then, actually,
‫we're going to build an envelope around it,
‫which is the final file.
‫So we will build an envelope
‫and what do we put in this envelope?
‫Then we'll put an encrypted version of the DEK,
‫and actually KMS will also send us this.
‫So when we call the GenerateDataKey API,
‫it sends us both the plain-text DEK
‫and the encrypted DEK.
‫And so we store these two things into one final file.
‫And this is why it's called envelope encryption.
‫Because there is a wrapper around your encrypted file
‫with the encrypted DEK.
‫So as we can see in this example,
‫from KMS the only thing we got was an encryption key,
‫a data key and a data key that was encrypted.
‫And all the work for the encryption
‫of that file happened client side.
‫So now how do we decrypt that envelope?
‫So to do so we come back from this envelope file,
‫which contains the encrypted DEK and the encrypted file.
‫And we're going to leverage KMS obviously one more time.
‫So this time we're going to call the decrypt API.
‫So with a decrypt API we can only pass
‫up to four kilobytes of data.
‫So what we're going to decrypt in this instance
‫is going to be the data encryption key,
‫so the DEK.
‫So I'll pass through KMS, we'll check the IAM permissions.
‫And if everything is good with KMS,
‫we're able to decrypt that DEK.
‫So now we get the plain-text DEK.
‫And with this plain-text DEK,
‫we can look at the encrypted file and the plain-text DEK
‫and decrypt it together, client side.
‫And here we go, we have a decrypted big file.
‫So the whole purpose of this envelope encryption technique
‫is to use KMS for what it's good at,
‫which is to generate keys,
‫and then the whole encryption
‫and decryption happens client side.
‫So this is complicated to implement, and so as such,
‫AWS has implemented envelope encryption for us.
‫And for this we can leverage the AWS encryption SDK.
‫So this also exists as a CLI tool that we can install.
‫And there are SDK implementation for Java,
‫Python, C and JavaScript.
‫And so on top of implementing
‫this encryption pattern that I just showed you,
‫this encryption SDK has a feature called data key caching.
‫So in this example,
‫instead of recreating a new data key every time
‫we want to encrypt an object,
‫we can reuse them instead.
‫And so the idea with reusing data keys
‫is that you have less calls into KMS.
‫So you are doing less API calls and it's less expensive.
‫But there is a security trade-off
‫because now you're using the same data key encryption,
‫data encryption key for many different files.
‫So it's a trade-off between your security
‫and your API calls.
‫But in practice this is still used.
‫So if you're using data key caching,
‫then you would use something called
‫a LocalCryptoMaterialsCache, which has a long name,
‫to indicate how big the cache of this data key should be.
‫And it could be that you define the max age of your key,
‫the max number of bytes that it should encrypt,
‫or the max number of messages that should be encrypted
‫by this DEK before moving on to the next DEK.
‫So this encryption SDK is extremely helpful.
‫Now from an exam perspective,
‫what do we need to remember?
‫We need to remember the name of the symmetric APIs.
‫So the first one is encrypt,
‫to encrypt up to four kilobytes of data through KMS.
‫The second one is GenerateDataKey,
‫and this will generate a unique symmetric data key or DEK,
‫and this API will do two things,
‫it will return to us a plain-text copy of the data key
‫and it will return to us an encrypted version
‫of the data key with the CMK that we specify.
‫And this is what we've used during the envelope encryption.
‫There's another API called GenerateDataKeyWithoutPlaintext
‫and this time it's to generate again a GEK,
‫but not to use right now,
‫it's to use at some point in the future.
‫And so as such, this DEK is the same,
‫it's also encrypted using this CMK we specify,
‫but if you use it, we must decrypted afterwards,
‫which is one extra step.
‫So the exam will try to trick you
‫to perform envelope encryption right now,
‫you need to use GenerateDataKey API
‫not GenerateDataKeyWithoutPlaintext.
‫And then to decrypt anything,
‫you need to use the decrypt API.
‫So to decrypt up to four kilobytes of data,
‫including an envelope encryption to decrypt the data key,
‫the data encryption key.
‫And finally, if you want it to generate a random number,
‫then you have the API called GenerateRandom
‫that will return a random byte string.
‫So that's it for this lecture.
‫I hope that was helpful to you
‫and I will see you in the next lecture.