Crate aws_kms_tls_auth 

The KMS TLS PSK Provider provides a way to get a mutually authenticated TLS connection using IAM credentials, KMS, and the external PSK feature of TLS 1.3.

Design

aws-kms-tls-auth allows a fleet of instances to mutually authenticate each other. You will configure a single KMS HMAC Key with a SHA384 signing spec and grant all of the instances IAM permissions to call kms:GenerateMAC on the KMS key. Clients and servers are considered interchangeable.

Instances will call kms:GenerateMAC(days_since_unix_epoch) to obtain a secret that is shared across the fleet. This is referred to as the epoch_secret. This secret will rotate daily.

For each new connection, the instance will generate a nonce (session_name) and use that along with the epoch_secret to derive a connection-specific secret. This unique secret will then be used for RFC-standard, TLS 1.3 PSK authentication (PSK with (EC)DHE handshake mode).

The authenticated identity of a peer is “the peer has IAM permissions to call kms:GenerateMAC on the trusted KMS key”.

Deployment Concerns

The KMS Key ARN that the PskProvider is configured with must be supplied to the PskReceiver. Otherwise handshakes will fail.

Note that the PskReceiver supports lists for both of these items, so zero-downtime migrations are possible. Example: if the client fleet wanted to switch from Key A to Key B it would go through the following stages

1. clients -> [A] server -> [A]
2. clients -> [A] server -> [A & B]
3. clients -> [A][B], server -> [A & B]
4. clients -> [B], server -> [A & B]
5. clients -> [B], server -> [B]

Structs

PresharedKeyClientHello

PskProvider

PskReceiver

The PskReceiver is used along with the [PskProvider] to perform TLS 1.3 out-of-band PSK authentication, using PSK’s generated from KMS.

Enums

PskVersion

Traits

DecodeValue

This trait defines a type that can be decoded from bytes.

Type Aliases

KeyArn