[
https://issues.apache.org/jira/browse/HADOOP-10693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14042782#comment-14042782
]
Alejandro Abdelnur commented on HADOOP-10693:
---------------------------------------------
[~cmccabe], regarding your suggestion on using the aes256 library you pointed
out. The issues I see with that are:
* Hadoop should not be in the business of writing/shipping/supporting crypto
implementations but simply using them.
* If we ship cryptographic code Apache Hadoop needs to seek US export approval.
By using OpenSSL there is no need for.
* OpenSSL is being kept up to date to the latest AES NI instruction sets and
Linux distros are picking up those changes quite fast. By using the aes256 we
have to do that.
* One thing is to say you are fully compatible with FIPS, the other is to be
FIPS certified. OpenSSL versions get FIPS certification, I doubt it is the case
for aes256.
> Implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> ----------------------------------------------------------
>
> Key: HADOOP-10693
> URL: https://issues.apache.org/jira/browse/HADOOP-10693
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: security
> Affects Versions: fs-encryption (HADOOP-10150 and HDFS-6134)
> Reporter: Yi Liu
> Assignee: Yi Liu
> Fix For: fs-encryption (HADOOP-10150 and HDFS-6134)
>
> Attachments: HADOOP-10693.1.patch, HADOOP-10693.patch
>
>
> In HADOOP-10603, we have an implementation of AES-CTR CryptoCodec using Java
> JCE provider.
> To get high performance, the configured JCE provider should utilize native
> code and AES-NI, but in JDK6,7 the Java embedded provider doesn't support it.
>
> Considering not all hadoop user will use the provider like Diceros or able to
> get signed certificate from oracle to develop a custom provider, so this JIRA
> will have an implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> directly.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
