Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Go io.Reader Decrypt Example

Open
  • Is something wrong?
#796 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
aws, go
Domain
security

Research direction

Start by reading the existing Go awskmsmrkkeyring example and the Go Decrypt API entry point. Determine how the SDK consumes a complete ciphertext stream rather than individual chunks, and use the Python streaming example and reported Incomplete message as reference. Done means a documented Go example decrypts an io.Reader under the stated commitment policy.

Written by the indexing model from the issue text.

Description

enhancement

Hi there! Can there be an example of using the golang esdk to decrypt from a readable stream via an io.Reader?

I'm working on an example where the ciphertext is created with AWS Encryption SDK using a multiregion key and RequireEncryptAllowDecrypt commitment policy. Using a modified version of the awskmsmrkkeyring example, I can decrypt the entire file if I load it all into memory.

I'm not sure if the std lib way to do it is to use cipher.StreamReader? Particularly, I just don't know what to use for the nonce, key, and whether or not it is using GCM or some other block mode, or how to connect that to the esdk client

Thank you for any help!

Creating the encrypted file with this script:

import argparse
import sys

import aws_encryption_sdk as aes

def main(infile, outfile):
  client = aes.EncryptionSDKClient(
      commitment_policy=aes.CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT,
  )
  key_provider = aes.StrickAwsKmsMasterKeyProvider(
    key_ids=[
      __myKeyArn__
    ],
  )
  with client.stream(mode="e", source=infile, key_provider=key_provider) as encryptor:
    for chunk in encryptor:
      outfile.write(chunk)

if __name__ == "__main__":
  parser = argparse.ArgumentParser(description="Encrypt a file")
  parser.add_argument("--input", type=argparse.FileType("rb"), help="File to encrypt", default=sys.stdin, required=False)
  parser.add_argument("--output", type=argparse.FileType("wb"), help="Encrypted output file", required=True)
  args = parser.parse_args()
  main(args.input, args.output)

Edit: My attempt to decrypt chunk by chunk was along these lines, got a Incomplete message: ReadFramedMessageBody :

func(input io.Reader, output io.Reader) {
  // For brevity not doing any error handling
  buffer := make([]byte, 4096) // 4096 byte frames

  var n int
  var err error
  for {
    n, err = input.Read(buffer)
    
    if n <= 0 {
        break
    }

    decryptResp, err := encryptionClient.Decrypt(context.TODO(), esdktypes.DecryptInput{
        Keyring: keyring, // Created using the mrk example
        Ciphertext: buffer[:n]
    })
    
    //  handle err
     
    output.Write(decryptResp.Plaintext)
  }

// ...
}
Dominant language
Rust
Stars
68
Forks
29
Avg merge
5d 2h
Merged PRs (30d)
1

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/aws-encryption-sdk

All issues in aws/aws-encryption-sdk

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.