信封 AEAD 商場
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
- 受影響的版本
- 所有 Tink 版本
- 受影響的金鑰類型
- 所有信封 AEAD 金鑰類型
說明
信封加密功能透過第三方供應商 (例如 GCP 或 AWS) 加密資料加密金鑰 (DEK)。
將 KmsEnvelopeAead 與 AwsKmsAead 或 GcpKmsAead 搭配使用做為遠端供應器時，能夠修改已加密的 DEK 的某些部分而不偵測。這是因為其中包含了未經驗證的中繼資料 (例如版本編號)。供應商不會偵測到這項未驗證資料的修改。
請注意，這違反了此介面的自動調整式選擇密文攻擊屬性 (IND-CCA-2)，但密文仍可解密至正確的 DEK。使用這個介面時，請不要假設每個 DEK 只會對應至單一加密 DEK。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eAll versions of Tink and all Envelope AEAD key types are affected by a security vulnerability.\u003c/p\u003e\n"],["\u003cp\u003eThe vulnerability allows modification of unauthenticated metadata within encrypted data encryption keys when using KmsEnvelopeAead with AwsKmsAead or GcpKmsAead.\u003c/p\u003e\n"],["\u003cp\u003eWhile the ciphertext can still be decrypted, this vulnerability violates the adaptive chosen-ciphertext attack property (IND-CCA-2).\u003c/p\u003e\n"],["\u003cp\u003eDevelopers should be aware that a single data encryption key might correspond to multiple encrypted data encryption keys due to this issue.\u003c/p\u003e\n"]]],["Envelope encryption, using `KmsEnvelopeAead` with `AwsKmsAead` or `GcpKmsAead`, allows undetectable modifications to the encrypted data encryption key (DEK) due to unauthenticated metadata. All Tink versions and Envelope AEAD key types are affected. While decryption still yields the correct DEK, this violates the adaptive chosen-ciphertext attack property (IND-CCA-2). Each DEK may correspond to multiple encrypted DEKs; users shouldn't assume a one-to-one mapping.\n"],null,["# Envelope AEAD Malleability\n\nAffected Versions\n: All Tink versions\n\nAffected Key Types\n: All Envelope AEAD key types\n\nDescription\n-----------\n\n[Envelope encryption](/tink/client-side-encryption) uses a third-party provider\n(such as GCP or AWS) to encrypt a data encryption key (DEK).\n\nIt is possible to modify certain parts of the encrypted DEK without detection\nwhen using `KmsEnvelopeAead` with `AwsKmsAead` or `GcpKmsAead` as the remote\nprovider. This is due to the inclusion of unauthenticated metadata (for instance\nversion numbers). Modifications to this unauthenticated data are not detected by\nthe provider.\n\nNote that this violates the adaptive chosen-ciphertext attack property\n(IND-CCA-2) for this interface, although the ciphertext can still decrypt to\nthe correct DEK. When using this interface don't presume that each DEK only\ncorresponds to a single *encrypted DEK*."]]
