KMS Encryption Context

• Additional Authenticated Data (AAD):

  • Non secret data that is provided to encryption and decryption operations to add an additional integrity and authenticity check on the encrypted data.

  • Typically, the decrypt operation fails if the AAD provided to the encrypt operation does not match the AAD provided to the decrypt operation.

• All KMS cryptographic operations with symmetric CMKs accept an encryption context, an optional set of key-value pairs that can contain additional contextual information about the data.

• KMS uses the encryption context as additional authenticated data (AAD) to support authenticated encryption.

• You cannot specify an encryption context in a cryptographic operation with an asymmetric CMK.