Can I use AWS KMS encryption for client side encryption in Android?

Question

There is no method for KMS encryption in Android AWS SDK. On the server side we use KMSEncryptionMaterialsProvider to create AmazonS3EncryptionClient object, but this class is not available in Android SDK. I tried using the Java SDK in my Android project but it threw an exception

Code:

KMSEncryptionMaterialsProvider materialProvider = new KMSEncryptionMaterialsProvider(kms_cmk_id);
encryptionClient = new AmazonS3EncryptionClient(new ProfileCredentialsProvider(), materialProvider,
                new CryptoConfiguration())
            .withRegion(Region.getRegion(Regions.US_WEST_2));

Exception

Caused by: java.lang.ClassNotFoundException: Didn't find class "javax.management.MBeanServerFactory" on path: DexPathList

What exactly are you trying to achieve? Business use case, I mean. — ketan vijayvargiya, Feb 15 '17 at 06:54
@ketanvijayvargiya i am trying to secure the data transfer to amazon s3 bucket, follow this link [link](http://docs.aws.amazon.com/AmazonS3/latest/dev/client-side-using-kms-java.html) — Paxcel Labs, Feb 15 '17 at 07:12
I hope you know that Kms supports very less TPS. So if your android app is going to be used by lot of people, you shouldn't be using KMS. Check their limits first. — ketan vijayvargiya, Feb 15 '17 at 08:03
@ketanvijayvargiya but is it possible to implement it on the android side? — Paxcel Labs, Feb 17 '17 at 08:00

score 1 · Answer 1 · answered Mar 16 '17 at 14:49

Yes, it is possible. I'll give you three options, but all of them require getting your hands a little dirtier.

Option 1: You can derive your own implementation of a KMS Encryption Materials Provider. Even though that specific class (and likely some of its dependencies) are not present in the AWS Android SDK, you have the interface you need on the SDK: EncryptionMaterialsProvider. It should be possible to implement your own provider based on that.

Option 2: Use the KMS Client provided in the Android SDK to retrieve your own encryption materials from KMS and then pass a StaticEncryptionMaterialsProvider to the S3 client.

Option 3: Deal with encryption/decryption yourself. It's technically possible for you to retrieve the encryption materials using the KMS client, and then follow the KMS guidance on the official documentation to encrypt/decrypt your data. Please just do this if you are comfortable with cryptography.

Can I use AWS KMS encryption for client side encryption in Android?

1 Answers1