{"action":"opened","issue":{"url":"https://api.github.com/repos/awslabs/aws-encryption-sdk-java/issues/10","repository_url":"https://api.github.com/repos/awslabs/aws-encryption-sdk-java","labels_url":"https://api.github.com/repos/awslabs/aws-encryption-sdk-java/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/aws-encryption-sdk-java/issues/10/comments","events_url":"https://api.github.com/repos/awslabs/aws-encryption-sdk-java/issues/10/events","html_url":"https://github.com/awslabs/aws-encryption-sdk-java/issues/10","id":173339949,"number":10,"title":"Encryption context compatibility with AWS CLI","user":{"login":"jwcollinge","id":15145054,"avatar_url":"https://avatars.githubusercontent.com/u/15145054?v=3","gravatar_id":"","url":"https://api.github.com/users/jwcollinge","html_url":"https://github.com/jwcollinge","followers_url":"https://api.github.com/users/jwcollinge/followers","following_url":"https://api.github.com/users/jwcollinge/following{/other_user}","gists_url":"https://api.github.com/users/jwcollinge/gists{/gist_id}","starred_url":"https://api.github.com/users/jwcollinge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jwcollinge/subscriptions","organizations_url":"https://api.github.com/users/jwcollinge/orgs","repos_url":"https://api.github.com/users/jwcollinge/repos","events_url":"https://api.github.com/users/jwcollinge/events{/privacy}","received_events_url":"https://api.github.com/users/jwcollinge/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-26T00:07:13Z","updated_at":"2016-08-26T00:07:13Z","closed_at":null,"body":"There appears to be a compatibility issue between the aws CLI and the encryption sdk around the way that encryption context is formatted. This makes combining decryption of sensitive data in java apps difficult to integrate with many dev ops automation tools. \r\n\r\nencrypting a secret on the command line\r\naws kms encrypt --key-id <key-id-here> --plaintext \"1\\!2@3#4$5%6^7&8*9(0)-_=+\" --query CiphertextBlob --encryption-context key=value --output text | base64 -d > /tmp/encrypted\r\n\r\nand decrypting it in java\r\n\r\nfinal Map<String, String> context = Collections.singletonMap(\"key\", \"value\");\r\nfinal CryptoResult<String, KmsMasterKey> decryptResult = crypto.decryptString(prov, ciphertext);\r\n\r\nwill give you a cipher text error because the encryption contexts don't match.\r\n\r\nIs there a way to make this work that I'm missing or is a local java tool just for encrypting strings going to be required? Alternatively I could look at overriding the sdk serialization function to provide a cli compatible context serialization.\r\n\r\nThanks.\r\n\r\nJason"}}
{"actor":{"display_login":"jwcollinge"}}