{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
        "slug": "keep-kms-encryption-context-reproducible-and-free-of-secrets",
        "url": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/keep-kms-encryption-context-reproducible-and-free-of-secrets/"
        },
        "title": "Keep KMS encryption context reproducible and free of secrets",
        "summary": "Authenticated context must match for decryption and may be visible in audit records.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:13:38+00:00",
        "modified_at": "2026-10-20T18:34:29+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 243,
        "potentially_affected": "This concerns KMS symmetric encryption context; asymmetric and HMAC operations do not support it.",
        "dse_recommendation": "DSE recommends defining a stable context schema before an application writes protected data.",
        "primary_source": {
            "name": "AWS Documentation",
            "url": "https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Authenticated context must match for decryption and may be visible in audit records.</p>\n<h2>Source facts</h2>\n<p>For symmetric encryption KMS operations, an encryption context contains non-secret key/value pairs bound cryptographically to the ciphertext. Decryption requires the same context. The context is not encrypted and appears in CloudTrail logs. AWS also supports context conditions and grant constraints for applicable key operations.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html\">AWS Documentation</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns KMS symmetric encryption context; asymmetric and HMAC operations do not support it.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends defining a stable context schema before an application writes protected data. Choose identifiers that help enforce the intended data boundary without including passwords, private content or unnecessary personal information. Store the required context alongside the encrypted-data recovery metadata under appropriate access controls. Review schema changes as compatibility changes rather than cosmetic renaming. Have the application and key owners agree who may supply each value and how older data will retain its original context. Define how a restore operator obtains the original context without guessing it from current application settings. Keep a harmless example in the runbook and require schema migrations to include recovery of a record written under the previous approved context format.</p>\n<h2>Verification</h2>\n<p>Proposed verification: encrypt disposable data with the approved context, decrypt with the identical values, then try a missing or changed value. Inspect authorized audit output for unintended disclosure. Verify that the recovery procedure retains the context required for older application records.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html\">AWS Documentation</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Authenticated context must match for decryption and may be visible in audit records.\nSource facts\nFor symmetric encryption KMS operations, an encryption context contains non-secret key/value pairs bound cryptographically to the ciphertext. Decryption requires the same context. The context is not encrypted and appears in CloudTrail logs. AWS also supports context conditions and grant constraints for applicable key operations.\nSource: AWS Documentation.\nApplicability\nThis concerns KMS symmetric encryption context; asymmetric and HMAC operations do not support it.\nDSE recommendation\nDSE recommends defining a stable context schema before an application writes protected data. Choose identifiers that help enforce the intended data boundary without including passwords, private content or unnecessary personal information. Store the required context alongside the encrypted-data recovery metadata under appropriate access controls. Review schema changes as compatibility changes rather than cosmetic renaming. Have the application and key owners agree who may supply each value and how older data will retain its original context. Define how a restore operator obtains the original context without guessing it from current application settings. Keep a harmless example in the runbook and require schema migrations to include recovery of a record written under the previous approved context format.\nVerification\nProposed verification: encrypt disposable data with the approved context, decrypt with the identical values, then try a missing or changed value. Inspect authorized audit output for unintended disclosure. Verify that the recovery procedure retains the context required for older application records.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
        "content_markdown": "Authenticated context must match for decryption and may be visible in audit records.\n\n## Source facts\n\nFor symmetric encryption KMS operations, an encryption context contains non-secret key/value pairs bound cryptographically to the ciphertext. Decryption requires the same context. The context is not encrypted and appears in CloudTrail logs. AWS also supports context conditions and grant constraints for applicable key operations.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html).\n\n## Applicability\n\nThis concerns KMS symmetric encryption context; asymmetric and HMAC operations do not support it.\n\n## DSE recommendation\n\nDSE recommends defining a stable context schema before an application writes protected data. Choose identifiers that help enforce the intended data boundary without including passwords, private content or unnecessary personal information. Store the required context alongside the encrypted-data recovery metadata under appropriate access controls. Review schema changes as compatibility changes rather than cosmetic renaming. Have the application and key owners agree who may supply each value and how older data will retain its original context. Define how a restore operator obtains the original context without guessing it from current application settings. Keep a harmless example in the runbook and require schema migrations to include recovery of a record written under the previous approved context format.\n\n## Verification\n\nProposed verification: encrypt disposable data with the approved context, decrypt with the identical values, then try a missing or changed value. Inspect authorized audit output for unintended disclosure. Verify that the recovery procedure retains the context required for older application records.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
                "url": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Keep KMS encryption context reproducible and free of secrets",
                        "item": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/#article",
                "identifier": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
                "url": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/",
                "headline": "Keep KMS encryption context reproducible and free of secrets",
                "description": "Authenticated context must match for decryption and may be visible in audit records.",
                "abstract": "Authenticated context must match for decryption and may be visible in audit records.",
                "articleBody": "Authenticated context must match for decryption and may be visible in audit records.\nSource facts\nFor symmetric encryption KMS operations, an encryption context contains non-secret key/value pairs bound cryptographically to the ciphertext. Decryption requires the same context. The context is not encrypted and appears in CloudTrail logs. AWS also supports context conditions and grant constraints for applicable key operations.\nSource: AWS Documentation.\nApplicability\nThis concerns KMS symmetric encryption context; asymmetric and HMAC operations do not support it.\nDSE recommendation\nDSE recommends defining a stable context schema before an application writes protected data. Choose identifiers that help enforce the intended data boundary without including passwords, private content or unnecessary personal information. Store the required context alongside the encrypted-data recovery metadata under appropriate access controls. Review schema changes as compatibility changes rather than cosmetic renaming. Have the application and key owners agree who may supply each value and how older data will retain its original context. Define how a restore operator obtains the original context without guessing it from current application settings. Keep a harmless example in the runbook and require schema migrations to include recovery of a record written under the previous approved context format.\nVerification\nProposed verification: encrypt disposable data with the approved context, decrypt with the identical values, then try a missing or changed value. Inspect authorized audit output for unintended disclosure. Verify that the recovery procedure retains the context required for older application records.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:13:38+00:00",
                "dateModified": "2026-10-20T18:34:29+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/keep-kms-encryption-context-reproducible-and-free-of-secrets/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep KMS encryption context reproducible and free of secrets"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 243,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS Documentation",
                    "url": "https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html"
                }
            }
        ]
    }
}