Skip to content

Commit b99931f

Browse files
authored
[KeyVault] - Provide Encrypt/Decrypt parameter overloads and add managed HSM tests (Azure#13889)
## What - Add overloads to lead customers down the right path when encrypting / decrypting using AES algorithms - Add Managed HSM specific test files and coverage - Remove iv, aad, and tag from Encrypt/Decrypt Options - Rename tag to authenticationTag - Add iv, aad, and tag to EncryptResult ## Why - AES algorithms have a bunch of specific requirements for encryption / decryption and it's a lot to put on the consumer to figure out what needs to get sent with each algorithm., We explored a few approaches and settled cross language on passing a set of algorithm specific encrypt parameters to the method. For TS our implementation uses a discriminated union. - To test these changes correctly we should start running KV tests against Managed HSM (some algorithms are only supported in Managed HSM). For now we're only running the subset of tests conditionally but once more changes come in I want to make it run all the tests against the MHSM in a single configuration. Resolves Azure#13843 Resolves Azure#13129
1 parent c0f6127 commit b99931f

File tree

33 files changed

+3949
-461
lines changed

33 files changed

+3949
-461
lines changed

sdk/keyvault/keyvault-keys/CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
- Updated the Latest service version to 7.2.
66
- Added `curve` to `createKeyOptions` to be used when creating an `EC` key.
7+
- Deprecated the current `encrypt` and `decrypt` methods in favor of the more flexible overloads that take an `{Encrypt|Decrypt}Parameters` and allow passing in algorithm specific parameters. This enables support for the various AES algorithms used in Managed HSM. The deprecated methods continue to function and there's no timeline for their removal.
8+
- Added `additionalAuthenticatedData`, `iv`, and `authenticationTag` to `EncryptResult` in order to support AES encryption and decryption.
79

810
## 4.2.0-beta.3 (2021-02-09)
911

sdk/keyvault/keyvault-keys/karma.conf.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ module.exports = function(config) {
5050
"AZURE_TENANT_ID",
5151
"KEYVAULT_NAME",
5252
"KEYVAULT_URI",
53+
"AZURE_MANAGEDHSM_URI",
5354
"TEST_MODE"
5455
],
5556

sdk/keyvault/keyvault-keys/recordings/browsers/cryptographyclient_for_managed_hsm_all_decrypts_happen_remotely_with_aes_crypto_algorithms/recording_encrypts_and_decrypts_using_aescbc.json

Lines changed: 261 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)