[Python] Decryption of a AES+RSA lambda pressigned URL

I am doing an OTA updater for an ESP32. I am using AWS Lambda for encrypting a presigned URL that is being generated for a certain element from an S3 bucket. I am first doing an AES encryption and then after that, I am doing an RSA encryption just as shown in the code snippet below.

def encrypt_aes_key_rsa(aes_key, public_key_pem):
rsa_key = RSA.import_key(public_key_pem)
cipher_rsa = PKCS1_v1_5.new(rsa_key)
encrypted_key = cipher_rsa.encrypt(aes_key)
return base64.b64encode(encrypted_key).decode()

def encrypt_url_with_aes(url, aes_key):
iv = get_random_bytes(16)
cipher = AES.new(aes_key, AES.MODE_CBC, iv)
padded_url = pad(url.encode(), AES.block_size)
encrypted_url = cipher.encrypt(padded_url)
return base64.b64encode(iv + encrypted_url).decode()

def lambda_handler(event, context):
try:
latest_key = get_latest_s3_key(BUCKET_NAME)
presigned_url = generate_presigned_url(BUCKET_NAME, latest_key)

aes_key = get_random_bytes(16)
encrypted_url = encrypt_url_with_aes(presigned_url, aes_key)
encrypted_aes_key = encrypt_aes_key_rsa(aes_key, PUBLIC_KEY_PEM)
return {
"statusCode": 200,
"headers": {"Content-Type": "application/json"},
"body": json.dumps({
"key": encrypted_aes_key,
"data": encrypted_url
}),
"isBase64Encoded": False
}


I want to be able on the ESP32 to decrypt the presigned url but can't figure out how. I tried using mbedtls but have not been successful at decrypting the AES-encrypted data. Could somebody point me out to a library or method for decryption? I am not very familiar with C.

Continue reading...