Envelope encryption limits blast radius by wrapping data-encryption keys with higher-level keys. If a wrapping key is compromised, the attacker can unwrap every descendant key beneath it, but unrelated key trees remain protected.
Design an EnvelopeKeyImpactAnalyzer class:
parent[i] is the key that wraps key i, or -1 if key i is a root key.recordKeys[j] is the key that directly encrypts record j.affectedRecords(parent, recordKeys, compromisedKey) returns the indexes of exposed records in ascending input order.
The compromised key itself is exposed. Every key whose parent chain reaches it is also exposed. Keys above the compromised key, sibling branches, and separate trees are not exposed by this incident.
Assume the attacker has the relevant wrapped keys and ciphertext. This exercise analyzes key scope; it does not implement encryption.
Example 1:
Input:
Output:
Explanation: Key 1 exposes itself and descendants 3 and 4. Records 0 and 1 use those keys.
Example 2:
Input:
Output:
Explanation: Root key 0 can unwrap every key in this hierarchy, exposing all five records.
Constraints
1 <= parent.length <= 10^5parent[i] is -1 or a valid key index.parent describes an acyclic forest.0 <= recordKeys.length <= 10^5- Every value in
recordKeys is a valid key index. 0 <= compromisedKey < parent.length- At most
100 calls are made to affectedRecords.
Analyze Encryption-Key Blast Radiusmedium