Skip to content

Conversation

@Elvrarin
Copy link
Contributor

@Elvrarin Elvrarin commented Sep 25, 2025

Issues:

See SIM P307101963

Description of changes:

Currently, only the PaddedBlock keys and Streaming keys supports CBC mode.
This adds CBC mode for EncryptingKey and DecryptingKey. This allows AES CBC encryption/decryption with no padding.

Call-outs:

Since no padding is used, input data must be block aligned, length of input must be a multiple of 16 bytes.
I also included the DANGER message in the doc string, since I think the use of this is unconventional.

Testing:

Unit tests added following examples of existing unit tests.

KAT

Added known-answer tests from "Appendix F" of SP800-38a:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@Elvrarin Elvrarin requested a review from a team as a code owner September 25, 2025 21:30
@codecov-commenter
Copy link

codecov-commenter commented Sep 26, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.36%. Comparing base (c358484) to head (6bcc4a8).
⚠️ Report is 263 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #895      +/-   ##
==========================================
- Coverage   95.80%   92.36%   -3.44%     
==========================================
  Files          61       73      +12     
  Lines        8143     9659    +1516     
  Branches        0     9659    +9659     
==========================================
+ Hits         7801     8922    +1121     
- Misses        342      450     +108     
- Partials        0      287     +287     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Elvrarin
Copy link
Contributor Author

Elvrarin commented Sep 26, 2025

the same code would succeed for some inputs and fail for others at runtime.

I agree this is a bit confusing, but the existing ECB mode for EncryptKey and DecryptKey also behaves the same way, that is to require input size to be block-aligned. There is the "skull emoji" DANGER message that will be shown on the docs.rs, I think it already push consumers off of these API, save for those who understands the intricacies of ECB mode.

The larger API/feature flag refactoring is beyond what I can single handedly do. Let me know how I can help here. Thanks.

justsmth
justsmth previously approved these changes Sep 29, 2025
@skmcgrail skmcgrail merged commit cea4296 into aws:main Sep 29, 2025
316 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants