| 102 | } |
| 103 | |
| 104 | KeyWithMasterId FileKeyUnwrapper::GetDataEncryptionKey(const KeyMaterial& key_material) { |
| 105 | auto kms_client = GetKmsClientFromConfigOrKeyMaterial(key_material); |
| 106 | |
| 107 | bool double_wrapping = key_material.is_double_wrapped(); |
| 108 | const std::string& master_key_id = key_material.master_key_id(); |
| 109 | const std::string& encoded_wrapped_dek = key_material.wrapped_dek(); |
| 110 | |
| 111 | SecureString data_key; |
| 112 | if (!double_wrapping) { |
| 113 | data_key = kms_client->UnwrapKey(encoded_wrapped_dek, master_key_id); |
| 114 | } else { |
| 115 | // Get Key Encryption Key |
| 116 | const std::string& encoded_kek_id = key_material.kek_id(); |
| 117 | const std::string& encoded_wrapped_kek = key_material.wrapped_kek(); |
| 118 | |
| 119 | const SecureString kek_bytes = kek_per_kek_id_->GetOrInsert( |
| 120 | encoded_kek_id, [kms_client, encoded_wrapped_kek, master_key_id]() { |
| 121 | return kms_client->UnwrapKey(encoded_wrapped_kek, master_key_id); |
| 122 | }); |
| 123 | |
| 124 | // Decrypt the data key |
| 125 | std::string aad = ::arrow::util::base64_decode(encoded_kek_id); |
| 126 | data_key = internal::DecryptKeyLocally(encoded_wrapped_dek, kek_bytes, aad); |
| 127 | } |
| 128 | |
| 129 | return KeyWithMasterId(std::move(data_key), master_key_id); |
| 130 | } |
| 131 | |
| 132 | std::shared_ptr<KmsClient> FileKeyUnwrapper::GetKmsClientFromConfigOrKeyMaterial( |
| 133 | const KeyMaterial& key_material) { |
no test coverage detected