在 NodeJs 中使用 AWS KMS 解密文本

Question

我正在尝试使用 aws-sdk 和 NodeJs 解密一些使用 AWS KMS 加密的文本。我今天开始玩 NodeJs，所以我是新手。我用 Java 解决了这个问题，但我正在尝试将现有的 Alexa 技能从 Java 迁移到 NodeJs。

解密密码为：

function decrypt(buffer) {
    const kms = new aws.KMS({
        accessKeyId: 'accessKeyId',
        secretAccessKey: 'secretAccessKey',
        region: 'eu-west-1'
    });
    return new Promise((resolve, reject) => {
        let params = {
            "CiphertextBlob" : buffer,
        };
        kms.decrypt(params, (err, data) => {
            if (err) {
                reject(err);
            } else {
                resolve(data.Plaintext);
            }
        });
    });
};

当我运行此代码使用正确的 CiphertextBlob 时，出现此错误：

Promise {
  <rejected> { MissingRequiredParameter: Missing required key 'CiphertextBlob' in params
    at ParamValidator.fail (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\param_validator.js:50:37)
    at ParamValidator.validateStructure (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\param_validator.js:61:14)
    at ParamValidator.validateMember (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\param_validator.js:88:21)
    at ParamValidator.validate (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\param_validator.js:34:10)
    at Request.VALIDATE_PARAMETERS (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\event_listeners.js:126:42)
    at Request.callListeners (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\sequential_executor.js:106:20)
    at callNextListener (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\sequential_executor.js:96:12)
    at D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\event_listeners.js:86:9
    at finish (D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\config.js:349:7)
    at D:\Developing\abono-transportes-js\node_modules\aws-sdk\lib\config.js:367:9
  message: 'Missing required key \'CiphertextBlob\' in params',
  code: 'MissingRequiredParameter',
  time: 2019-06-30T20:29:18.890Z } }

我不明白为什么我会收到如果 CiphertextBlob 在 params 变量中。

有人知道吗？提前致谢！

编辑 01/07

测试编码特征：第一个函数：

const CheckExpirationDateHandler = {
    canHandle(handlerInput) {
        return handlerInput.requestEnvelope.request.type === 'IntentRequest'
            && handlerInput.requestEnvelope.request.intent.name === 'TtpConsultaIntent';
    },
    handle(handlerInput) {

        var fecha = "";
        var speech = "";

        userData = handlerInput.attributesManager.getSessionAttributes();

        if (Object.keys(userData).length === 0) {
            speech = consts.No_Card_Registered;
        } else {
            console.log("Retrieving expiration date from 3rd API");
            fecha = crtm.expirationDate(cipher.decrypt(userData.code.toString()));
            speech = "Tu abono caducará el " + fecha;
        }

        return handlerInput.responseBuilder
            .speak(speech)
            .shouldEndSession(true)
            .getResponse();

    }
}

提供日志的解密函数：

// source is plaintext
async function decrypt(source) {

    console.log("Decrypt func INPUT: " + source)
    const params = {
        CiphertextBlob: Buffer.from(source, 'base64'),
    };
    const { Plaintext } = await kms.decrypt(params).promise();
    return Plaintext.toString();
};

输出：

2019-07-01T19:01:12.814Z 38b45272-809d-4c84-b155-928bee61a4f8 INFO Retrieving expiration date from 3rd API 2019-07-01T19:01:12.814Z 38b45272-809d-4c84-b155-928bee61a4f8 INFO Decrypt func INPUT: AYADeHK9xoVE19u/3vBTiug3LuYAewACABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREF4UW0rcW5PSElnY1ZnZ2l1bHQ2bzc3ZnFLZWZMM2J6YWJEdnFCNVNGNzEyZGVQZ1dXTDB3RkxsdDJ2dFlRaEY4UT09AA10dHBDYXJkTnVtYmVyAAt0aXRsZU51bWJlcgABAAdhd3Mta21zAEthcm46YXdzOmttczpldS13ZXN0LTE6MjQwMTE3MzU1MTg4OmtleS81YTRkNmFmZS03MzkxLTRkMDQtYmUwYi0zZDJlMWRhZTRkMmIAuAECAQB4sE8Iv75TZ0A9b/ila9Yi/3vTSja3wM7mN/B0ThqiHZEBxYsoWpX7jCqHMoeoYOkVtAAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDNnGIwghz+b42E07KAIBEIA76sV3Gmp5ib99S9H4MnY0d1l............ 2019-07-01T19:01:12.925Z 38b45272-809d-4c84-b155-928bee61a4f8 INFO Error handled: handlerInput.responseBuilder.speak(...).shouldEndSession is not a function 2019-07-01T19:01:13.018Z 38b45272-809d-4c84-b155-928bee61a4f8 ERROR Unhandled Promise Rejection {"errorType":"Runtime.UnhandledPromiseRejection","errorMessage":"InvalidCiphertextException: null","stack":["Runtime.UnhandledPromiseRejection: InvalidCiphertextException: null","...

Answer 1

这意味着您缺少密钥 'CiphertextBlob' 或它的值未定义。

请检查您作为 buffer 传递的值。

作为参考，我还添加了我使用的工作代码示例。

import { KMS } from 'aws-sdk';

import config from '../config';

const kms = new KMS({
  accessKeyId: config.aws.accessKeyId,
  secretAccessKey: config.aws.secretAccessKey,
  region: config.aws.region,
});

// source is plaintext
async function encrypt(source) {
  const params = {
    KeyId: config.aws.kmsKeyId,
    Plaintext: source,
  };
  const { CiphertextBlob } = await kms.encrypt(params).promise();

  // store encrypted data as base64 encoded string
  return CiphertextBlob.toString('base64');
}

// source is plaintext
async function decrypt(source) {
  const params = {
    CiphertextBlob: Buffer.from(source, 'base64'),
  };
  const { Plaintext } = await kms.decrypt(params).promise();
  return Plaintext.toString();
}

export default {
  encrypt,
  decrypt,
};

----- 已添加 -----

我能够重现您的问题。

decrypt("this text has never been encrypted before!");

这段代码抛出同样的错误。

因此，如果您传递以前从未加密过或使用不同密钥加密过的纯文本，它会抛出 InvalidCiphertextException: null。

下面我给大家举个例子。

encrypt("hello world!") // this will return base64 encoded string
  .then(decrypt) // this one accepts encrypted string
  .then(decoded => console.log(decoded)); // hello world!

Answer 2

我在尝试接受的解决方案时，在我的 AWS lambda 中不断收到此错误，在我拥有的环境变量上使用 AWS KMS使用 AWS 用户界面加密。

这段代码改编自 AWS official solution:

decrypt.js

const AWS = require('aws-sdk');
AWS.config.update({ region: 'us-east-1' });

module.exports = async (env) => {
    const functionName = process.env.AWS_LAMBDA_FUNCTION_NAME;
    const encrypted = process.env[env];
    
    if (!process.env[env]) {
        throw Error(`Environment variable ${env} not found`) 
    }
    
    const kms = new AWS.KMS();
    try {
        const data = await kms.decrypt({
            CiphertextBlob: Buffer.from(process.env[env], 'base64'),
            EncryptionContext: { LambdaFunctionName: functionName },
        }).promise();
        console.info(`Environment variable ${env} decrypted`)
        return data.Plaintext.toString('ascii');
    } catch (err) {
        console.log('Decryption error:', err);
        throw err;
    }
}

这样使用：

index.js

const decrypt = require("./decrypt.js")

exports.handler = async (event, context, callback) => {
    console.log(await decrypt("MY_CRYPTED_ENVIRONMENT_VARIABLE"))
}

Answer 3

EncryptionContext 是这个工作所必需的。
假设 EnvironmentVariable 的名称是 Secret
下面的代码读取名为 Secret 的 EnvironmentVariable 和 returns 解密的秘密作为正文中的纯文本。
请看下面贴出的功能代码

'use strict';

const aws = require('aws-sdk');
var kms = new aws.KMS();

exports.handler = (event, context, callback) => {
    const functionName = process.env.AWS_LAMBDA_FUNCTION_NAME;
    const encryptedSecret = process.env.Secret;

    kms.decrypt({
            CiphertextBlob: new Buffer(encryptedSecret, 'base64'),
            EncryptionContext: {
                LambdaFunctionName: functionName /*Providing the name of the function as the Encryption Context is a must*/
            },
        },
        (err, data) => {

            if (err) {
                /*Handle the error please*/
            }

            var decryptedSecret = data.Plaintext.toString('ascii');

            callback(null, {
                statusCode: 200,
                body: decryptedSecret,
                headers: {
                    'Content-Type': 'application/json',
                },
            });
        });
};

在 NodeJs 中使用 AWS KMS 解密文本

Decrypt text with AWS KMS in NodeJs

encryption

node.js

aws-lambda

amazon-kms