Open mattsb42-aws opened 4 years ago
The Raw AES Keyring uses the message format AAD serialization in the AAD for the wrapping key. This AAD has limits on size and the number of pairs. But for raw or static keyrings I do not see why there should be any such limit on the AAD. This is not a fully flushed out requirement, but I wanted to record this edge case.
The "raw" keyrings have a variety of issues that make them less than ideal to use. Unfortunately, these issues cannot be addressed without introducing breaking changes, and those changes are significant enough to warrant an entirely new keyring concept. We have clear customer demand for "keyrings that can operate directly with master key material", so this is worth doing.
For the purposes of this issue, I will refer to this new keyring category as "static" keyrings, but that name MAY change before it is created.
The characteristics that static keyrings MUST have include: