Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cannot decrypt message from Amazon Connect using RawRsaKeyringNode

See original GitHub issue

I’m creating an IVR credit card payment solution in Amazon Connect and am encrypting the credit card details with the built-in Connect encryption features. I’ve used this blog post as a reference for my implementation. I’m trying to write a nodejs12.x Lambda which decrypts the payload from Connect.

The Lambda source code used in that project (s3://connect-sharing/DecryptCustomerInput.zip) uses a library called awsencryptionsdk-js to decrypt the payload from Connect. However, that library is not published to npmjs. Rather than copy and paste that module into my project, I’m trying to write my code to use @aws-crypto/client-node. However, I’m not able to decrypt the payload.

Here’s some code which shows how I decrypt the Connect payload with my private key using the old awsencryptionsdk-js library:

const AWSEncryptionSDKHelper = require("awsencryptionsdk-js");

/**
 * @param {string} privateKeyPEM - The private key in PEM format.
 * @param {string} encryptedDataBase64 - The encrypted payload encoded in base 64 format.
 * @returns {Promise<string>} - The decrypted message.
 */
async function oldDecrypt(privateKeyPEM, encryptedDataBase64) {
  const awsEncryptionHelper = new AWSEncryptionSDKHelper(privateKeyPEM, encryptedDataBase64);
  const data = await awsEncryptionHelper.decrypt();
  const frames = data.body.frames;
  frames.sort((a, b) => parseInt(a.seq) - parseInt(b.seq));
  return frames
    .map(({ text }) => text)
    .concat([data.body.lastFrame.text])
    .join('');
}

The code above decrypts the payload and returns the message with no issues.

Below is the new code I wrote using @aws-crypto/client-node based on this example:

const { RawRsaKeyringNode, decrypt } = require('@aws-crypto/client-node');

/**
 * @param {string} privateKeyPEM - The private key in PEM format to decrypt the cipher text.
 * @param {string} base64CipherText - The cipher text in base 64 format.
 * @param {string} keyName - Name of the key used to encrypt this message.
 * @returns {Promise<string>}
 */
async function newDecrypt(privateKeyPEM, base64CipherText, keyName) {
  const keyring = new RawRsaKeyringNode({
    keyName,
    keyNamespace: 'AmazonConnect',
    rsaKey: { privateKey: privateKeyPEM }
  });

  const ciphertextBuffer = Buffer.from(base64CipherText, 'base64');
  const { plaintext, messageHeader } = await decrypt(keyring, ciphertextBuffer);
  return plaintext.toString('utf-8');
}

When I try to decrypt with newDecrypt, I get the following error stack trace:

(node:22162) UnhandledPromiseRejectionWarning: Error: unencryptedDataKey has not been set
    at Object.needs (/var/task/orchestrate_lex_conversation/node_modules/@aws-crypto/material-management/build/main/needs.js:17:15)
    at NodeDecryptionMaterial.getUnencryptedDataKey (/var/task/orchestrate_lex_conversation/node_modules/@aws-crypto/material-management/build/main/cryptographic_material.js:217:17)
    at NodeDefaultCryptographicMaterialsManager.decryptMaterials (/var/task/orchestrate_lex_conversation/node_modules/@aws-crypto/material-management-node/build/main/node_cryptographic_materials_manager.js:49:46)
    at process._tickCallback (internal/process/next_tick.js:68:7)
    at Function.Module.runMain (internal/modules/cjs/loader.js:832:11)
    at startup (internal/bootstrap/node.js:283:19)
    at bootstrapNodeJSCore (internal/bootstrap/node.js:622:3)

I dug a bit deeper into this library’s code and found that an exception is thrown in _unwrapKey of raw_rsa_keyring_node.js:

Error: error:04099079:rsa routines:RSA_padding_check_PKCS1_OAEP_mgf1:oaep decoding error
    at Object.privateDecrypt (internal/crypto/cipher.js:44:12)
    at RawRsaKeyringNode._unwrapKey (/var/task/orchestrate_lex_conversation/node_modules/@aws-crypto/raw-rsa-keyring-node/build/main/raw_rsa_keyring_node.js:63:45)
    at RawRsaKeyringNode._onDecrypt (/var/task/orchestrate_lex_conversation/node_modules/@aws-crypto/raw-keyring/build/main/raw_keyring_decorators.js:32:35)
    at RawRsaKeyringNode.onDecrypt (/var/task/orchestrate_lex_conversation/node_modules/@aws-crypto/material-management/build/main/keyring.js:58:38)
    ...

Based on the documentation and the examples given, I’m not sure if I’m using the API incorrectly or if there is something wrong with the payload from Connnect. I’m still going through the docs and the code to try and sort it out myself, but I wanted to reach out to see if there’s something obvious I’m missing.

Below are two payloads that may be decrypted with my private key. The 1st one comes directly from Connect. The 2nd one I created myself using @aws-crypto/client-node’s encrypt method. The 1st one fails, while the 2nd one works 🤔

Connect payload The decrypted payload is 1236547891321456.

AYADeDOc+0FhSFUFo3AviGMBU3MAXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREE5RkxLMG8wS0x3a3g3MEV2SFVoTjRQQkhzL0JYaE1JQ0ZTczRXOTNmcWVONnNOQmRjQys5TEdwdFF2Mkg2RkQrUT09AAEADUFtYXpvbkNvbm5lY3QAJDRjZGI4MjZhLTI0YzktNDQzZC1iNzhiLTMyN2M4MTcwNzNjZQIAIReQbs93LrJQPGzQHV8YUciS63WhSie3Y/xbTWRl7t51Fyi57clN78ZuCGuiPYzzJmg8NualETJSq5AaAIjviXp4Bf7WyZqe2Ho70WRFCitXIBFMpJUM+WmqwehMaDy9c1p6Roulm17eyfiOg6P2qDiM4jEDctYzQ8OAAjuJuGD8BB9N4CGaOCSwp9o8uiM3BmZ/pbLlTCvXMqkg2n94rfjL3Y3s2hAuy69mhcU9mF0ZEnya4MamrKC/pd1XLZdOV0K/zeHPksIrcy00nCJ7S+Gb73ieSUWQxjXya3uyc946QGE2KduB1zTlbAwhfRs3ctpfPtkUDIzkQfxYz+iz1vw3EuG6CW/MneVcdlJBJ58uZvL7vrTaUNFXu6tqGheXRalLDPnasDApt7c3yLEL6IoeQe7j33EYxHyxoXzK062yt85HcBXnjm+Daax2oYb8s/39qjWFlZPGD0OMdmQjzCjqe+Qjw2H3cmN2H03bGvHddhg5IPNi4vb03Owor20dCrZJAz7wjeIkfgpR5ZyWDQmU/zX+AoRLa4oaTgvPsi5TVM8Qev8+a2loJpMAQVh62xQt4CJZoRVCp7GkVhZ1XquMaz+ITtarcMV29L5XVQwubAtR1OWenk1Xd2uOGyiTRw5B5cXD6CRNUs9YCcp3DfH0lpxFOd7yMZzICJxTgEgCAAAAAAwAABAABB6FU2et/38i0UOCg1Ovr77Pa0lkxlemxoeQM/////8AAAABZdNd5d67U84wbD2mAAAAEEG64b/bdb0rvm9RLVbBxfeGJZe/VP12oLpBM33B5ufjAGcwZQIwNe81SSjyNfTowZE4ll53sUdubIUvuPX9PXMGNCzImoVosr+6rZEbk3GFujj7wF0AAjEAztFBwLTAFLZPiGpQNuNRBXiVrTKhiSUwHGrnK/1UlH5ZumCmUAV2FeyD0A9UH9oa

Payload encrypted with @aws-crypto/client-node

AYADeJng3phI5lPf+MvmQ0GOf2MAXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREE4TlJ2MG02Zy94TWJ5aTJyVHU3aERKRkkwRC9DbmFFSkpzVTg2TllHbG5qVTRXY2orNkxkSmxGb0hHeDVFRkpOQT09AAEADUFtYXpvbkNvbm5lY3QAJDRjZGI4MjZhLTI0YzktNDQzZC1iNzhiLTMyN2M4MTcwNzNjZQIAnfklSo24jl95kJ4JsC0+wdcdpNhi0MD3PrWs9FiUZi0RZ+Hjj8PPm0frgrzVCQdi7JH3gU/h797buoQaN9A23VBThn644/Ps8T5X6oeZWb2DP0/O9kFCssC2vP0L7WomDvMZedxDASEJej/a4e5LJrXtAGHlJcKhPJ5NzfIo4ccjHWgRiDzu4JQKga3vRXMkUe+/4O6EjYLjCNbubAxjH+rGPGgGgA65N4bDaOKUzmqfbV5wudnigCj8la419i0MSxg80NUfm52NfxYpvO9Z1QROLX4CkLyr98h759dzz+gTLo4v/TdGiEA95f0ARjjNeyePkhLncJ8seiri9N53do6Ry6rpDz2ZZrsv32p7g+EUZHPKYfoltpuwrfZskUmzh8+H9nAnnw9tUzMHzmbVTze2mpJ0cd3TljSv56Wh8ZqBPfR2D0narADt7jFiNFMqL73a5IaD3jLDLA9S9Ax+zP+b4REm22aOoJ9diUjpbODn3CZ3tlhZnGLJGzumrKFP2I22cegOCAvvjlI/Y2GN8MjrvXYuzHjEm6tSMA1zYFxrck1h6nT+bUvjsxnPxZAsbJgGoXIJUf+Fpr24UUVUaMAdx6vkI/v9booFCLcm5qbLxrFvQlfwpwwyBzVZkgNa7qrKyQs9TuHZICFMrDQkagc4Z8QauldFdbl4Bbj83W4CAAAAAAwAABAAAAAAAAAAAAAAAAAA8wAcoQ2kiI2ZWTMwFRIWd/////8AAAABAAAAAAAAAAAAAAABAAAAEBNU9GddlBwWeq7L/Ix0eTc//qsRhhHdOob/ve/4ZElEAGgwZgIxAL8vZfr6ekuOSjH4Y/u9WJloNNOpI0TG/KvH1TyXQyfVmRCrPShKmRwwORKl79n9HwIxAPas5ox0uqDbZUv15L2+5XwIKSVMnxJwxf7GPFgQG+IRIHQ/DXKBVXUL+Ec5C+gXAA==

Here is the public key, private key, and certificate I’m using to encrypt/decrypt the data. These keys are only used for my own testing so it is safe to share.

Issue Analytics

State:
Created 3 years ago
Comments:12 (3 by maintainers)

Top GitHub Comments

1reaction

seebeescommented, Jun 22, 2020

I did not find any documentation around the oaepHash

Yes that is something we are working on. It was a somewhat recent addition.

Additionally, the defaults should probably change. With all things in security, it is every upward. So having a default padding mode is sub-optimal.

In fact, if there are JavaScript-specific API docs

I’ll take this as a request to produce docs from the typescript interfaces. 😃

Also, how did you know that oaepHash should be set to ‘sha512’ as opposed to

I verified that I could indeed decrypt your message from the code linked in the blog post. Then I read through that code to find the options, (I used a little console.log magic… 😦 ) and with a little bit of intuition/memory.

The padding information is not stored in the ESDK message format, so that is just something you have to know 😦

1reaction

iknowcsscommented, Jun 22, 2020

Hey @seebees,

Yes! That solves my problem perfectly! And it’s much faster than before. Cheers!

Regarding the documentation, I did not find any documentation around the oaepHash option for the RawRsaKeyringNode constructor. In fact, if there are JavaScript-specific API docs I could not find them anywhere. I did find this page which has a couple of simple examples, but there are no API-level docs for this library.

Also, how did you know that oaepHash should be set to 'sha512' as opposed to 'sha384' or one of the other valid options? I used the AWS Encryption SDK message format reference to decode the message header, body and footer, but I didn’t see any information about what kind of OAEP hash algorithm to use (maybe I missed it).

Thanks again!

Top Results From Across the Web

Raw RSA keyrings - AWS Encryption SDK

The Raw RSA keyring performs asymmetric encryption and decryption of data keys in local memory with an RSA public and private keys that...

Encryption at rest - Amazon Connect - AWS Documentation

Send GenerateDataKey requests to KMS key to create data keys with which to encrypt objects. Send Decrypt requests to AWS KMS to decrypt...

Modules in the AWS Encryption SDK for JavaScript

Provides code for assembling the cryptographic materials that are cached with each data key.

Encryption in transit - Amazon Connect - AWS Documentation

All data exchanged with Amazon Connect is protected in transit between the user's web browser and Amazon Connect using industry-standard TLS encryption.

Encrypt customer input - Amazon Connect

The following code sample shows how to decrypt data using the AWS Encryption SDK. package com.amazonaws; import com.