[
https://issues.apache.org/jira/browse/HADOOP-10693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14042802#comment-14042802
]
Andrew Purtell commented on HADOOP-10693:
-----------------------------------------
bq. Is it possible to use something like this?
http://www.literatecode.com/aes256 This implementation is just two files, a .c
and a .h, and doesn't require any libraries to be installed.
What is really of value in the OpenSSL crypto implementation are the highly
optimized (assembler) implementations of the AES algorithm. I took a quick look
at the provided URL and the author himself says:
{quote}
It is a straightforward and rather naïve byte-oriented portable C
implementation, where all the lookup tables replaced with on-the-fly
calculations. Certainly it is slower and more subjective to side-channel
attacks by nature.
{quote}
If there are concerns about OpenSSL, there is always NSS. Using NSS instead
won't isolate the project from potential security advisories involving the
crypto library, you've just chosen a different library with a different
pedigree, and perhaps not quite the same level of scrutiny (after heartbleed).
> Implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> ----------------------------------------------------------
>
> Key: HADOOP-10693
> URL: https://issues.apache.org/jira/browse/HADOOP-10693
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: security
> Affects Versions: fs-encryption (HADOOP-10150 and HDFS-6134)
> Reporter: Yi Liu
> Assignee: Yi Liu
> Fix For: fs-encryption (HADOOP-10150 and HDFS-6134)
>
> Attachments: HADOOP-10693.1.patch, HADOOP-10693.patch
>
>
> In HADOOP-10603, we have an implementation of AES-CTR CryptoCodec using Java
> JCE provider.
> To get high performance, the configured JCE provider should utilize native
> code and AES-NI, but in JDK6,7 the Java embedded provider doesn't support it.
>
> Considering not all hadoop user will use the provider like Diceros or able to
> get signed certificate from oracle to develop a custom provider, so this JIRA
> will have an implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> directly.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
