[
https://issues.apache.org/jira/browse/HADOOP-14246?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Robert Kanter updated HADOOP-14246:
-----------------------------------
Attachment: HADOOP-14246.001.patch
The 001 patch:
- Changes {{Random}} to {{SecureRanom}} in {{RandomSignerSecretProvider}} and
{{ZKSignerSecretProvider}}. Unit tests continue to use {{Random}} because we
need to be able to predict the RNG to verify in the tests and {{SecureRandom}}
ignores the seed on linux platforms.
- Changes the length of the secret from 160 bits (a Long converted to a String)
to 256 bits in {{RandomSignerSecretProvider}} and {{ZKSignerSecretProvider}}.
We luckily store the length of the secret in the data written to ZooKeeper, so
there's no compatibility problems changing the length of the secret.
- Added a unit test to for changing the length of the secret
- Reduced execution time of {{TestRandomSignerSecretProvuder}} from ~50 seconds
to less than 1 second by mocking the rollover scheduling like we already did in
{{TestZKSignerSecretProvider}}
I still need to go and verify in an actual cluster, but here is the patch in
the meantime.
> Authentication Tokens should use SecureRandom instead of Random and 256 bit
> secrets
> -----------------------------------------------------------------------------------
>
> Key: HADOOP-14246
> URL: https://issues.apache.org/jira/browse/HADOOP-14246
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.9.0
> Reporter: Robert Kanter
> Assignee: Robert Kanter
> Attachments: HADOOP-14246.001.patch
>
>
> {{RandomSignerSecretProvider}} and {{ZKSignerSecretProvider}} currently use a
> {{long}} generated by {{Random}} (which is then converted to a {{String}} and
> is 160 bits) for secrets.
> We should improve this to use 256 bit secrets generated by {{SecureRandom}}.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
