feat(sdk): DSPX-4495 remove 64GiB TDF limit, use counter-based payload IVs (DSP… - #393
Open
sujankota wants to merge 1 commit into
Open
feat(sdk): DSPX-4495 remove 64GiB TDF limit, use counter-based payload IVs (DSP…#393sujankota wants to merge 1 commit into
sujankota wants to merge 1 commit into
Conversation
…X-4495) Removes MAX_TDF_INPUT_SIZE (68719476736) and the size check in createTDF. That constant was GCM's per-invocation plaintext limit (2^39-256 bits) misapplied to the whole TDF input; each segment is its own invocation and is capped at 4MiB by Config.MAX_SEGMENT_SIZE, so the bound was never relevant. SDK.DataSizeNotSupported is retained as public API but is no longer thrown. Replaces the random per-segment AES-GCM nonce with a deterministic unsigned 96-bit big-endian counter (TDF.IvCounter). NIST SP 800-38D prefers the deterministic construction; the RBG-based one it replaces carries a birthday bound that a counter does not have. Metadata is encrypted with the per-split symKey while the payload uses the XOR of all split keys, so with a single key split the two are the same key. IV 0 is therefore reserved for the metadata and payload segments start at IV 1. The counter enforces the SP 800-38D 8.3 cap of 2^32 invocations per key and refuses to wrap, so an IV can never be issued twice. Neither limit is reachable in practice - at the 16KiB minimum segment size the cap is 64TiB of input - but the invariant now holds by construction rather than by assumption. Every segment is still prefixed with its 12-byte IV, so the wire format is unchanged and existing TDFs continue to decrypt. Signed-off-by: sujan kota <sujankota@gmail.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughChangesTDF encryption contract
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: 🔵 Low · up to The SDK now supports inputs beyond 64 GiB, but callers that pass untrusted or non-terminating streams must enforce their own byte, duration, cancellation, and output limits to avoid unbounded encryption work, output growth, and memory use. This is a bounded owner-awareness follow-up rather than a demonstrated merge blocker. Sequence Diagram(s)sequenceDiagram
participant TDF
participant IvCounter
participant AesGcm
participant TDFOutput
TDF->>IvCounter: metadataIv()
TDF->>AesGcm: encrypt(IV 0, metadata)
AesGcm-->>TDF: encrypted metadata
TDF->>IvCounter: forPayload()
loop Each payload segment
TDF->>IvCounter: next()
IvCounter-->>TDF: next sequential IV
TDF->>AesGcm: encrypt(payload IV, segment)
AesGcm-->>TDF: encrypted segment
TDF->>TDFOutput: write IV and ciphertext
end
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes MAX_TDF_INPUT_SIZE (68719476736) and the size check in createTDF. That constant was GCM's per-invocation plaintext limit (2^39-256 bits) misapplied to the whole TDF input; each segment is its own invocation and is capped at 4MiB by Config.MAX_SEGMENT_SIZE, so the bound was never relevant. SDK.DataSizeNotSupported is retained as public API but is no longer thrown.
Replaces the random per-segment AES-GCM nonce with a deterministic unsigned 96-bit big-endian counter (TDF.IvCounter). NIST SP 800-38D prefers the deterministic construction; the RBG-based one it replaces carries a birthday bound that a counter does not have.
Metadata is encrypted with the per-split symKey while the payload uses the XOR of all split keys, so with a single key split the two are the same key. IV 0 is therefore reserved for the metadata and payload segments start at IV 1.
The counter enforces the SP 800-38D 8.3 cap of 2^32 invocations per key and refuses to wrap, so an IV can never be issued twice. Neither limit is reachable in practice - at the 16KiB minimum segment size the cap is 64TiB of input - but the invariant now holds by construction rather than by assumption.
Every segment is still prefixed with its 12-byte IV, so the wire format is unchanged and existing TDFs continue to decrypt.
Summary by CodeRabbit
New Features
Documentation