浏览器 JavaScript 客户端的 AWS 加密 SDK

@aws-crypto/客户端浏览器

这个 客户端浏览器 模块包括您需要使用 AWS 加密 SDK 的所有模块 javaScript 网页浏览器 .

• 解密浏览器
• 加密浏览器
• keys-ring-浏览器
• 材料管理浏览器
• 隐形-材料-管理-浏览器
• 原始键盘浏览器
• 原始的 rsa- keyring- 浏览器
• 网页后端

对于显示如何创建密钥环和加密及解密数据的模块的代码示例,请安装 实例浏览器 模块.

安装

要安装此模块, 请使用 npm 软件包管理器 。 安装帮助请参见 https://www.npmjs.com/get-npm (英语)。 。 。 .

npm install @aws-crypto/client-browser

使用情况

详细代码示例 告诉你如何使用这些模块 创建密钥环 并加密和解密数据, 安装 实例浏览器 模块.

/* Start by constructing a keyring. We'll create a KMS keyring.
 * Specify an AWS Key Management Service (AWS KMS) customer master key (CMK) to be the
 * generator key in the keyring. This CMK generates a data key and encrypts it. 
 * To use the keyring to encrypt data, you need kms:GenerateDataKey permission 
 * on this CMK. To decrypt, you need kms:Decrypt permission. 
 */
const generatorKeyId = 'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt'

/* You can specify additional CMKs for the keyring. The data key that the generator key
 * creates is also encrypted by the additional CMKs you specify. To encrypt data, 
 *  you need kms:Encrypt permission on this CMK. To decrypt, you need kms:Decrypt permission.
 */ 
const keyIds = ['arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f']

/* Create a KMS client provider with your AWS credentials */
const clientProvider = getClient(KMS, {
  credentials: {
    accessKeyId,
    secretAccessKey
  }
})

/* Create the KMS keyring */
const keyring = new KmsKeyringBrowser({ clientProvider, generatorKeyId, keyIds })

/* Set an encryption context For more information: 
 * https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#encryption-context
 */
const context = {
    stage: 'demo',
    purpose: 'simple demonstration app',
    origin: 'us-west-2'
  }
 
/* Create a string to encrypt */
const plainText = new Uint8Array([1, 2, 3, 4, 5])

/* Encrypt the string using the keyring and the encryption context 
 * the Encryption SDK returns an "encrypted message" (`result`) that includes the ciphertext, 
 * the encryption context, and the encrypted data keys.
 */ 
const { result } = await encrypt(keyring, plainText, { encryptionContext: context })

/* Decrypt the result using the same keyring */
const { plaintext, messageHeader } = await decrypt(keyring, result)

/* Get the encryption context */
const { encryptionContext } = messageHeader

/* Verify that all values in the original encryption context are in the 
 * current one. (The Encryption SDK adds extra values for signing.) 
 */
Object
  .entries(context)
  .forEach(([key, value]) => {
    if (encryptionContext[key] !== value) throw new Error('Encryption Context does not match expected values')
    })

/* If the encryption context is verified, log the plaintext. */
document.write('</br>Decrypted:' + plaintext)
console.log(plaintext)

测试

npm test

兼容性考虑

WebCrypto 可用性

WebCrypto API 并非所有浏览器都可用. 后退可以配置 . 一个倒计时库的例子有: MSR 密码

import { configureFallback } from '@aws-crypto/client-browser'
configureFallback(msrCrypto)

详细情况 configureFallback 见: @aws-crypto/web-crypto后端

0字节 AES-GCM 操作

Safari的现代版本在0字节上不支持AES-GCM. AWS加密SDK需要这个操作. 要解决这个问题, 配置一个倒置库 . AWS加密SDK将只使用倒计时来进行零字节操作.

RSA 选项

WebCrypto API 不支持 PKCS1v15 RSA 密钥包装 .

192 位键

浏览器不支持192比特的密钥长度.

许可证

此 SDK 分布于 Apache 许可证,2.0版本, (中文(简体) ), 更多信息见LICENSE.txt和Notice.txt.