Skip to content

KMS: fix HMAC key import and add validated tests for HMAC and ECC key specs #12952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Aug 7, 2025
Merged

KMS: fix HMAC key import and add validated tests for HMAC and ECC key specs #12952

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
26fc288
KMS: add support for import of external HMAC keys
sannya-singal Aug 2, 2025
d7ea73a
add tests to validate imported ecc keys
sannya-singal Aug 4, 2025
a55cb9a
code cleanup and fix lint
sannya-singal Aug 4, 2025
a212c1f
re run tests
sannya-singal Aug 5, 2025
875f432
rebasing
sannya-singal Aug 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion localstack-core/localstack/services/kms/models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,13 @@ def __init__(self, key_spec: str, key_material: Optional[bytes] = None):
self._serialize_key(key)

def load_key_material(self, material: bytes):
if self.key_spec == "SYMMETRIC_DEFAULT":
if self.key_spec in [
KeySpec.SYMMETRIC_DEFAULT,
KeySpec.HMAC_224,
KeySpec.HMAC_256,
KeySpec.HMAC_384,
KeySpec.HMAC_512,
]:
self.key_material = material
else:
key = crypto_serialization.load_der_private_key(material, password=None)
Expand Down
189 changes: 189 additions & 0 deletions tests/aws/services/kms/test_kms.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1702,6 +1702,195 @@ def test_hmac_create_key_invalid_operations(self, kms_create_key, snapshot, regi
)
snapshot.match("create-hmac-key-invalid-key-usage", e.value.response)

@markers.aws.validated
@pytest.mark.parametrize(
"key_spec, curve, oaep_hash, signing_algorithm, wrapping_key_spec, wrapping_algorithm",
[
(
"ECC_NIST_P256",
ec.SECP256R1(),
hashes.SHA1(),
"ECDSA_SHA_256",
"RSA_2048",
"RSAES_OAEP_SHA_1",
),
(
"ECC_NIST_P384",
ec.SECP384R1(),
hashes.SHA1(),
"ECDSA_SHA_384",
"RSA_2048",
"RSAES_OAEP_SHA_1",
),
(
"ECC_NIST_P521",
ec.SECP521R1(),
hashes.SHA256(),
"ECDSA_SHA_512",
"RSA_4096",
"RSAES_OAEP_SHA_256",
),
(
"ECC_SECG_P256K1",
ec.SECP256K1(),
hashes.SHA1(),
"ECDSA_SHA_256",
"RSA_2048",
"RSAES_OAEP_SHA_1",
),
],
ids=["ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1"],
)
def test_import_key_ecc_keys(
self,
key_spec,
curve,
oaep_hash,
signing_algorithm,
wrapping_key_spec,
wrapping_algorithm,
kms_create_key,
aws_client,
snapshot,
):
key = kms_create_key(
Origin="EXTERNAL",
KeySpec=key_spec,
KeyUsage="SIGN_VERIFY",
Description="test ecc key import",
)
key_id = key["KeyId"]

ecc_key = ec.generate_private_key(curve)
raw_private_key = ecc_key.private_bytes(
serialization.Encoding.DER,
serialization.PrivateFormat.PKCS8,
serialization.NoEncryption(),
)
raw_public_key = ecc_key.public_key().public_bytes(
serialization.Encoding.DER,
serialization.PublicFormat.SubjectPublicKeyInfo,
)

import_params = aws_client.kms.get_parameters_for_import(
KeyId=key_id,
WrappingAlgorithm=wrapping_algorithm,
WrappingKeySpec=wrapping_key_spec,
)

public_key = load_der_public_key(import_params["PublicKey"])
encrypted_key = public_key.encrypt(
raw_private_key,
padding.OAEP(
mgf=padding.MGF1(algorithm=oaep_hash),
algorithm=oaep_hash,
label=None,
),
)

describe_before = aws_client.kms.describe_key(KeyId=key_id)
snapshot.match("describe-key-before-import", describe_before)

aws_client.kms.import_key_material(
KeyId=key_id,
ImportToken=import_params["ImportToken"],
EncryptedKeyMaterial=encrypted_key,
ExpirationModel="KEY_MATERIAL_DOES_NOT_EXPIRE",
)

describe_after = aws_client.kms.describe_key(KeyId=key_id)
snapshot.match("describe-key-after-import", describe_after)

get_public_key_after_import = aws_client.kms.get_public_key(KeyId=key_id)
assert get_public_key_after_import["PublicKey"] == raw_public_key

message = b"test sign verify 123 !%$@ 1234567890"
sign_result = aws_client.kms.sign(
KeyId=key_id,
Message=message,
MessageType="RAW",
SigningAlgorithm=signing_algorithm,
)
snapshot.match("sign-result", sign_result)

verify_result = aws_client.kms.verify(
KeyId=key_id,
Message=message,
MessageType="RAW",
SigningAlgorithm=signing_algorithm,
Signature=sign_result["Signature"],
)
snapshot.match("verify-result", verify_result)
assert verify_result["SignatureValid"]

aws_client.kms.delete_imported_key_material(KeyId=key_id)
describe_deleted = aws_client.kms.describe_key(KeyId=key_id)
snapshot.match("describe-key-after-deleted-import", describe_deleted)

@markers.aws.validated
@pytest.mark.parametrize(
"key_spec, key_length, mac_algo",
[
("HMAC_224", 28, "HMAC_SHA_224"),
("HMAC_256", 32, "HMAC_SHA_256"),
("HMAC_384", 48, "HMAC_SHA_384"),
("HMAC_512", 64, "HMAC_SHA_512"),
],
ids=["HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512"],
)
def test_import_key_hmac_keys(
self, key_spec, key_length, mac_algo, kms_create_key, aws_client, snapshot
):
key = kms_create_key(
Origin="EXTERNAL",
KeySpec=key_spec,
KeyUsage="GENERATE_VERIFY_MAC",
Description="test import hmac key",
)
key_id = key["KeyId"]

plaintext = os.urandom(key_length)

params = aws_client.kms.get_parameters_for_import(
KeyId=key_id, WrappingAlgorithm="RSAES_OAEP_SHA_256", WrappingKeySpec="RSA_4096"
)

public_key = load_der_public_key(params["PublicKey"])
encrypted_key = public_key.encrypt(
plaintext,
padding.OAEP(
mgf=padding.MGF1(algorithm=hashes.SHA256()), algorithm=hashes.SHA256(), label=None
),
)
describe_key_before_import = aws_client.kms.describe_key(KeyId=key_id)
snapshot.match("describe-key-before-import", describe_key_before_import)

aws_client.kms.import_key_material(
KeyId=key_id,
ImportToken=params["ImportToken"],
EncryptedKeyMaterial=encrypted_key,
ExpirationModel="KEY_MATERIAL_DOES_NOT_EXPIRE",
)
describe_key_after_import = aws_client.kms.describe_key(KeyId=key_id)
snapshot.match("describe-key-after-import", describe_key_after_import)

# Generate and verify MAC
message = b"test-mac-message"
generate_mac = aws_client.kms.generate_mac(
KeyId=key_id, Message=message, MacAlgorithm=mac_algo
)
snapshot.match("generate-mac-response", generate_mac)

verify_mac = aws_client.kms.verify_mac(
KeyId=key_id, Message=message, Mac=generate_mac["Mac"], MacAlgorithm=mac_algo
)
snapshot.match("verify-mac-response", verify_mac)
assert verify_mac["MacValid"]

aws_client.kms.delete_imported_key_material(KeyId=key_id)
describe_key_after_deleted_import = aws_client.kms.describe_key(KeyId=key_id)
snapshot.match("describe-key-after-deleted-import", describe_key_after_deleted_import)

@markers.aws.validated
@pytest.mark.parametrize(
"key_spec,mac_algo",
Expand Down
Loading
Loading