Skip to content

Commit ac493e5

Browse files
committed
simplified logic in setting the encryption context algorithm value
1 parent 2e13c51 commit ac493e5

1 file changed

Lines changed: 4 additions & 13 deletions

File tree

‎src/s3_encryption/materials/kms_keyring.py‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
from botocore import client
1111

1212
from ..exceptions import S3EncryptionClientError
13-
from ..materials.materials import AlgorithmSuite
1413
from .encrypted_data_key import EncryptedDataKey
1514
from .keyring import S3Keyring
1615

@@ -84,18 +83,10 @@ def on_encrypt(self, enc_materials):
8483
##% The KmsKeyring MUST NOT support encryption using KmsV1 mode.
8584
# For committing algorithm suites (V3), the encryption context algorithm
8685
# value is the algorithm suite ID as a string ("115"), not the cipher name.
87-
# For non-committing suites (V2), use the cipher name ("AES/GCM/NoPadding").
88-
if (
89-
enc_materials.encryption_algorithm
90-
== AlgorithmSuite.ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY
91-
):
92-
encryption_context["aws:x-amz-cek-alg"] = str(
93-
enc_materials.encryption_algorithm.suite_id
94-
)
95-
else:
96-
encryption_context["aws:x-amz-cek-alg"] = (
97-
enc_materials.encryption_algorithm.cipher_name
98-
)
86+
# For non-committing suites (V2), it is the cipher name ("AES/GCM/NoPadding").
87+
encryption_context["aws:x-amz-cek-alg"] = (
88+
enc_materials.encryption_algorithm.content_cipher
89+
)
9990

10091
# Python implementation uses KMS GenerateDataKey instead of the spec's
10192
# EncryptDataKey pattern

0 commit comments

Comments
 (0)