class Aws::S3::Encryption::DecryptHandler

def v2_envelope(envelope)
  unless POSSIBLE_ENCRYPTION_FORMATS.include? envelope['x-amz-cek-alg']
    alg = envelope['x-amz-cek-alg'].inspect
    msg = "unsupported content encrypting key (cek) format: #{alg}"
    raise Errors::DecryptionError, msg
  end
  unless envelope['x-amz-wrap-alg'] == 'kms'
    # possible to support
    #   RSA/ECB/OAEPWithSHA-256AndMGF1Padding
    alg = envelope['x-amz-wrap-alg'].inspect
    msg = "unsupported key wrapping algorithm: #{alg}"
    raise Errors::DecryptionError, msg
  end
  unless V2_ENVELOPE_KEYS.sort == envelope.keys.sort
    msg = "incomplete v2 encryption envelope:\n"
    msg += "  expected: #{V2_ENVELOPE_KEYS.join(',')}\n"
    msg += "  got: #{envelope_keys.join(', ')}"
    raise Errors::DecryptionError, msg
  end
  envelope
end