2

Server Side Encryption SSE C

chrislusf edited this page 2025-09-15 21:19:52 -07:00

Table of Contents

• Server-Side Encryption with Customer-provided Keys (SSE-C)
• Overview
• Required Headers
• HTTP Examples
• Upload Encrypted Object
• Download Encrypted Object
• Get Object Metadata
• Copy Operations
• AWS CLI Usage
• Error Codes
• Common Issues
• Related Documentation

Server-Side Encryption with Customer-provided Keys (SSE-C)

With SSE-C, you bring your own keys and SeaweedFS does the heavy lifting. Your app sends the key with each request, and we encrypt/decrypt on the server side—without ever storing your key.

Overview

SSE-C gives you client-side key management with server-side encryption:

• Client provides: AES-256 encryption key and MD5 hash
• SeaweedFS handles: Encryption/decryption operations transparently
• Security: Keys are never stored on the server

Required Headers

For all SSE-C operations, include these headers:

X-Amz-Server-Side-Encryption-Customer-Algorithm: AES256
X-Amz-Server-Side-Encryption-Customer-Key: <base64-encoded-256-bit-key>
X-Amz-Server-Side-Encryption-Customer-Key-MD5: <md5-of-key>

HTTP Examples

Upload Encrypted Object

# Generate a 256-bit key
KEY=$(openssl rand -base64 32)
KEY_MD5=$(echo -n "$KEY" | base64 -d | md5sum | cut -d' ' -f1)

# Upload encrypted object
curl -X PUT "http://localhost:8333/bucket/encrypted-file.txt" \
  -H "X-Amz-Server-Side-Encryption-Customer-Algorithm: AES256" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key: $KEY" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key-MD5: $KEY_MD5" \
  -H "Content-Type: text/plain" \
  --data "This content will be encrypted"

Download Encrypted Object

# Download and decrypt object (must use same key)
curl "http://localhost:8333/bucket/encrypted-file.txt" \
  -H "X-Amz-Server-Side-Encryption-Customer-Algorithm: AES256" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key: $KEY" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key-MD5: $KEY_MD5"

Get Object Metadata

# Get metadata for encrypted object
curl -I "http://localhost:8333/bucket/encrypted-file.txt" \
  -H "X-Amz-Server-Side-Encryption-Customer-Algorithm: AES256" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key: $KEY" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key-MD5: $KEY_MD5"

Copy Operations

# Copy encrypted object to new location (same key)
curl -X PUT "http://localhost:8333/bucket/copied-file.txt" \
  -H "x-amz-copy-source: /bucket/encrypted-file.txt" \
  -H "X-Amz-Server-Side-Encryption-Customer-Algorithm: AES256" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key: $KEY" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key-MD5: $KEY_MD5" \
  -H "x-amz-copy-source-server-side-encryption-customer-algorithm: AES256" \
  -H "x-amz-copy-source-server-side-encryption-customer-key: $KEY" \
  -H "x-amz-copy-source-server-side-encryption-customer-key-md5: $KEY_MD5"

# Copy encrypted object with different key
NEW_KEY=$(openssl rand -base64 32)
NEW_KEY_MD5=$(echo -n "$NEW_KEY" | base64 -d | md5sum | cut -d' ' -f1)

curl -X PUT "http://localhost:8333/bucket/reencrypted-file.txt" \
  -H "x-amz-copy-source: /bucket/encrypted-file.txt" \
  -H "X-Amz-Server-Side-Encryption-Customer-Algorithm: AES256" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key: $NEW_KEY" \
  -H "X-Amz-Server-Side-Encryption-Customer-Key-MD5: $NEW_KEY_MD5" \
  -H "x-amz-copy-source-server-side-encryption-customer-algorithm: AES256" \
  -H "x-amz-copy-source-server-side-encryption-customer-key: $KEY" \
  -H "x-amz-copy-source-server-side-encryption-customer-key-md5: $KEY_MD5"

AWS CLI Usage

# Upload with SSE-C
aws s3 cp file.txt s3://mybucket/file.txt \
  --sse-c AES256 \
  --sse-c-key fileb://customer-key.bin

# Download with SSE-C
aws s3 cp s3://mybucket/file.txt downloaded-file.txt \
  --sse-c AES256 \
  --sse-c-key fileb://customer-key.bin

# Copy with SSE-C (same key)
aws s3 cp s3://mybucket/file.txt s3://mybucket/file-copy.txt \
  --sse-c AES256 \
  --sse-c-key fileb://customer-key.bin \
  --sse-c-copy-source AES256 \
  --sse-c-copy-source-key fileb://customer-key.bin

Error Codes

Error	HTTP Status	Description
InvalidEncryptionAlgorithmError	400	Algorithm must be "AES256"
InvalidArgument	400	Invalid key format or MD5 mismatch
InvalidRequest	400	Missing SSE-C headers

Common Issues

Wrong algorithm:

X-Amz-Server-Side-Encryption-Customer-Algorithm: AES128  # Error!

Invalid key length:

X-Amz-Server-Side-Encryption-Customer-Key: dGVzdA==      # Error! (too short)

Missing key for encrypted object:

curl http://localhost:8333/bucket/encrypted-file.txt     # Error!

Related Documentation

• Server-Side Encryption
• Amazon S3 API

Introduction

• Components
• Getting Started
• Production Setup
• Benchmarks
• FAQ
• Applications

API

• Master Server API
• Volume Server API
• Filer Server API
• Client Libraries
• SeaweedFS Java Client

Configuration

• Replication
• Store file with a Time To Live
• Failover Master Server
• Erasure coding for warm storage
• Server Startup via Systemd
• Environment Variables

Filer

• Filer Setup
• Directories and Files
• File Operations Quick Reference
• Data Structure for Large Files
• Filer Data Encryption
• Filer Commands and Operations
• Filer JWT Use

Filer Stores

• Filer Cassandra Setup
• Filer Redis Setup
• Super Large Directories
• Path-Specific Filer Store
• Choosing a Filer Store
• Customize Filer Store

Management

• Admin UI
• Worker

Advanced Filer Configurations

• Migrate to Filer Store
• Add New Filer Store
• Filer Store Replication
• Filer Active Active cross cluster continuous synchronization
• Filer as a Key-Large-Value Store
• Path Specific Configuration
• Filer Change Data Capture

FUSE Mount

• FIO benchmark
• fstab

WebDAV

Cloud Drive

• Cloud Drive Benefits
• Cloud Drive Architecture
• Configure Remote Storage
• Mount Remote Storage
• Cache Remote Storage
• Cloud Drive Quick Setup
• Gateway to Remote Object Storage

AWS S3 API

• S3 Credentials
• Amazon S3 API
• S3 Conditional Operations
• S3 CORS
• S3 Object Lock and Retention
• S3 Object Versioning
• AWS CLI with SeaweedFS
• s3cmd with SeaweedFS
• rclone with SeaweedFS
• restic with SeaweedFS
• nodejs with Seaweed S3
• S3 API Benchmark
• S3 API FAQ
• S3 Bucket Quota
• S3 API Audit log
• S3 Nginx Proxy
• Docker Compose for S3

Server-Side Encryption

• Server-Side Encryption
• Server-Side Encryption SSE-KMS
• Server-Side Encryption SSE-C

AWS IAM

• Amazon IAM API
• AWS IAM CLI
• Keycloak Integration

Machine Learning

• TensorFlow with SeaweedFS

HDFS

• Hadoop Compatible File System
• run Spark on SeaweedFS
• run HBase on SeaweedFS
• run Presto on SeaweedFS
• Hadoop Benchmark
• HDFS via S3 connector

Replication and Backup

• Async Replication to another Filer [Deprecated]
• Async Backup
• Async Filer Metadata Backup
• Async Replication to Cloud [Deprecated]
• Kubernetes Backups and Recovery with K8up

Metadata Change Events

• Filer Metadata Events

Messaging

• Structured Data Lake with SMQ and SQL
• Seaweed Message Queue
• SQL Queries on Message Queue
• SQL Quick Reference
• PostgreSQL-compatible Server weed db
• Pub-Sub to SMQ to SQL
• Kafka to Kafka Gateway to SMQ to SQL

Use Cases

• Use Cases
• Actual Users

Operations

• System Metrics
• weed shell
• Data Backup
• Deployment to Kubernetes and Minikube

Advanced

• Large File Handling
• Optimization
• Volume Management
• Tiered Storage
• Cloud Tier
• Cloud Monitoring
• Load Command Line Options from a file
• SRV Service Discovery
• Volume Files Structure

Security

• Security Overview
• Security Configuration
• Run Blob Storage on Public Internet

Misc Use Case Examples

• UrBackup with SeaweedFS
• Docker Image Registry with SeaweedFS
• SeaweedFS in Docker Swarm
• Words from SeaweedFS Users
• Independent Benchmarks
• Hardware