| 103 | } |
| 104 | |
| 105 | KeyWithMasterId FileKeyUnwrapper::GetDataEncryptionKey(const KeyMaterial& key_material) { |
| 106 | auto kms_client = GetKmsClientFromConfigOrKeyMaterial(key_material); |
| 107 | |
| 108 | bool double_wrapping = key_material.is_double_wrapped(); |
| 109 | const std::string& master_key_id = key_material.master_key_id(); |
| 110 | const std::string& encoded_wrapped_dek = key_material.wrapped_dek(); |
| 111 | |
| 112 | SecureString data_key; |
| 113 | if (!double_wrapping) { |
| 114 | data_key = kms_client->UnwrapKey(encoded_wrapped_dek, master_key_id); |
| 115 | } else { |
| 116 | // Get Key Encryption Key |
| 117 | const std::string& encoded_kek_id = key_material.kek_id(); |
| 118 | const std::string& encoded_wrapped_kek = key_material.wrapped_kek(); |
| 119 | |
| 120 | const SecureString kek_bytes = kek_per_kek_id_->GetOrInsert( |
| 121 | encoded_kek_id, [kms_client, encoded_wrapped_kek, master_key_id]() { |
| 122 | return kms_client->UnwrapKey(encoded_wrapped_kek, master_key_id); |
| 123 | }); |
| 124 | |
| 125 | // Decrypt the data key |
| 126 | PARQUET_ASSIGN_OR_THROW(auto decoded_kek, |
| 127 | ::arrow::util::base64_decode(encoded_kek_id)); |
| 128 | |
| 129 | std::string aad = std::move(decoded_kek); |
| 130 | data_key = internal::DecryptKeyLocally(encoded_wrapped_dek, kek_bytes, aad); |
| 131 | } |
| 132 | |
| 133 | return KeyWithMasterId(std::move(data_key), master_key_id); |
| 134 | } |
| 135 | |
| 136 | std::shared_ptr<KmsClient> FileKeyUnwrapper::GetKmsClientFromConfigOrKeyMaterial( |
| 137 | const KeyMaterial& key_material) { |
no test coverage detected