Skip to content

(unnecessary) Incompatibility between golang and ruby sdk S3 client-side encryption #1696

@jeffb-stell

Description

@jeffb-stell

Please fill out the sections below to help us address your issue

Issue description

The Ruby aws sdk's encryption handler labels its CBC client-side encryption "AES/CBC/PKCS5Padding", golang labels it "AES/CBC/PKCS7Padding" . The golang sdk is technically correct (AES CBC uses a 16 byte pad, hence it is PKCS7. PKCS5 is 8 bytes only).

Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version

aws-sdk-s3 1.8.0

Version of Ruby, OS environment

Ubuntu, rvm, ruby 2.4.3

Code snippets / steps to reproduce

Create Aws::S3::Encryption::Client, do .put_object, examine the object's metadata in S3.

https://stackoverflow.com/a/20770158 covers the issue slightly. As there is an unneeded difference between the golang aws sdk provider for AES CBC and the ruby aws sdk provider, and the golang header is technically more correct, I'd propose that the Ruby sdk change the header it sets, and accept "AES/CBC/PKCS5Padding" as well as "AES/CBC/PKCS7Padding" for decryption with the CBC handler.

Alternatively, if the ruby sdk adds "AES/CBC/PKCS7Padding" as an accepted header for CBC decryption handling, that would solve my particular issues.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions