Skip to content

Commit b02674c

Browse files
committed
chore(shared-cache): Update hkeyring and cachingcmm spec
1 parent 8d6bb56 commit b02674c

File tree

2 files changed

+10
-20
lines changed

2 files changed

+10
-20
lines changed

framework/aws-kms/aws-kms-hierarchical-keyring.md

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -520,10 +520,10 @@ If a user has two or more Hierarchical Keyrings with:
520520

521521
then they WILL share the cache entries in the `Shared` Cache.
522522

523-
Any keyring that has access to the `Shared` cache MAY be able to use materials
524-
that it MAY or MAY NOT have direct access to.
523+
Any keyring that has access to the `Shared` cache may be able to use materials
524+
that it may or may not have direct access to.
525525

526-
Users MUST make sure that all of Partition ID, Logical Key Store Name of the Key Store for the Hierarchical Keyring
526+
Users should make sure that all of Partition ID, Logical Key Store Name of the Key Store for the Hierarchical Keyring
527527
and Branch Key ID are set to be the same for two Hierarchical Keyrings if and only they want the keyrings to share
528528
cache entries.
529529

@@ -535,16 +535,17 @@ Partition ID is an optional parameter provided to the Hierarchical Keyring input
535535
which distinguishes Cryptographic Material Providers (i.e: Hierarchical Keyrings) writing to a cache.
536536

537537
- (Default) A a random 16-byte UUID, which makes
538-
it unique for every Hierarchical Keyring. In this case, two Hierarchical Keyrings (or another Material Provider)
539-
CANNOT share the same cache entries in the cache.
538+
it unique for every Hierarchical Keyring.
539+
In this case, two Hierarchical Keyrings (or another Material Provider)
540+
WILL NOT share the same cache entries in the cache.
540541
- If the Partition ID is set by the user and is the same for two Hierarchical Keyrings (or another Material Provider),
541542
they CAN share the same cache entries in the cache.
542543
- If the Partition ID is set by the user and is different for two Hierarchical Keyrings (or another Material Provider),
543-
they CANNOT share the same cache entries in the cache.
544+
they WILL NOT share the same cache entries in the cache.
544545

545546
### Logical Key Store Name
546547

547-
> Note: Users MUST NEVER have two different physical Key Stores with the same Logical Key Store Name.
548+
> Note: Users should not have two different physical Key Stores with the same Logical Key Store Name.
548549
549550
Logical Key Store Name is set by the user when configuring the Key Store for
550551
the Hierarchical Keyring. This is a logical name for the key store.

framework/caching-cmm.md

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -203,22 +203,11 @@ We establish the following definitions for the Cache Entry Identifier formula:
203203

204204
#### Resource Identifier
205205

206-
A Hex value that indicates if an element is from a Caching_CMM, Hierarchical_Keyring, or some other future resource.
207-
208-
```
209-
Caching_CMM : 0x01 (0001)
210-
Hierarchical_Keyring : 0x02 (0010)
211-
```
206+
Resource Identifier is defined in the [Hierarchical Keyring specification](./aws-kms/aws-kms-hierarchical-keyring.md/#resource-identifier).
212207

213208
#### Scope Identifier
214209

215-
A Hex value that indicates if an element is used for Encryption, Decryption, Searchable Encryption, or some other future purpose.
216-
217-
```
218-
Encrypt : 0x01 (0001)
219-
Decrypt : 0x02 (0010)
220-
Searchable Encryption : 0x03 (0011)
221-
```
210+
Scope Identifier is defined in the [Hierarchical Keyring specification](./aws-kms/aws-kms-hierarchical-keyring.md/#scope-identifier).
222211

223212
#### Partition ID
224213

0 commit comments

Comments
 (0)