S3 SSE-C Support

[udf2457]

Would be good if you provided support for the SSE-C encryption option on S3.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html

[corylanou]

Hi @benbjohnson,

I've researched implementing SSE-C support and want to discuss the scope and value before potentially working on this.

Implementation Scope

This would be S3-specific only with no interface changes. The ReplicaClient interface stays unchanged - SSE-C parameters would be config fields on the s3.ReplicaClient struct used internally in S3 API calls. Other storage backends (GCS, Azure, SFTP, etc.) unaffected.

Changes required:

• Add 3 config fields to S3 replica config (sse-customer-algorithm, sse-customer-key, sse-customer-key-md5)
• Update S3 operations (WriteLTXFile, OpenLTXFile, HeadObject) to include SSE-C parameters
• Add validation (HTTPS requirement, key format validation)
• Testing and documentation

Note: Supporting both SSE-C and SSE-KMS would be straightforward - they're mutually exclusive options that add different parameters to the same API calls.

Value Question

AWS S3 Encryption Options:

1. SSE-S3: AWS-managed keys, automatic, free
2. SSE-KMS: Key Management Service, audit trails, automated rotation, enterprise standard
3. SSE-C: Customer-provided keys, full control but full responsibility

SSE-C operational challenges:

• Customer must securely store keys forever (lost key = lost data permanently)
• No automated key rotation (requires re-uploading all data)
• Must send key with every request (HTTPS required)
• Rare use case in modern AWS best practices

Questions

@benbjohnson: Is this a priority given the "bug fixes only" contribution policy? How much user demand have you seen for this?

@udf2457: What's your specific use case? A few questions:

• Would SSE-KMS work instead? It's more operationally sound (managed rotation, audit trails, no key-loss risk)
• Is there a compliance/regulatory requirement driving SSE-C specifically?
• Are you currently using v0.3.x for age encryption and looking to upgrade to v0.5?

If both SSE-C and SSE-KMS are useful, we could support both. Just want to understand the real-world need before implementing.

Thoughts?

[udf2457]

@corylanou Thank you for your detailed thoughts.

In reply to your questions:

• No. Specifically I'm thinking about support for "S3-compatible" providers. For example Exoscale only have SSE-C suppport.
• Only the "don't put your eggs in one basket" of trusting the (same) provider with both the key and the data. 😆
• Currently using nothing at all. This is my first use, I have been lurking for a while though following developments.

[joeblew999]

Please check because it’s seemed AWS is disabling it? SSE-KMS Will replace it

https://aws.amazon.com/blogs/storage/advanced-notice-amazon-s3-to-disable-the-use-of-sse-c-encryption-by-default-for-all-new-buckets-and-select-existing-buckets-in-april-2026/

Nats has an issue for this too btw:

nats-io/nats-server#4622

[udf2457]

@joeblew999 i shouldn’t have to spell this out but AWS is not the only S3 service in the world.

None of the ones I am using are planning to phase out SSE-C. In addition, on-prem solutions like Minio are unlikely to phase out SSE~C