[
https://issues.apache.org/jira/browse/HADOOP-10693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yi Liu updated HADOOP-10693:
----------------------------
Attachment: HADOOP-10693.3.patch
[~cmccabe] :-), I update the patch for your comments.
Add test cases _TestCryptoCodec#testJCEAESCTRCryptoCodec_ and
_TestCryptoCodec#testOpenSSLAESCTRCryptoCodec_
Add _TestOpenSSLCipher_
We originally had _TestCryptoStreamsWithOpenSSLAESCTRCryptoCodec_
{quote}
Tucu is right here... rather than configuring a single codec class, why don't
we make this configuration contain a comma-separated list of codecs to try?
That way it would be pretty simple to configure the system to use openssl with
fallback to JCE, etc. We would simply keep trying entries in the list until one
was available.
{quote}
I get your point, I will handle the fallback in HADOOP-10735.
I’m thinking we can do it more simpler: If openssl native is not available, in
{{OpenSSLAESCTRCryptoCodec}}, we use {{javax.crypto.Cipher}} instead of
{{org.apache.hadoop.crypto.OpenSSLCipher}} if fallback is allowed by
configuration. JCE is always available, we don’t need a comma list, because
fallback codec should be the same algorithm and padding, it’s better not
allowed user to configure. Otherwise if user configure several codecs,
different codec may be chose in different environments, decryption may fail.
{quote}
These casts could be avoided if you just made the type of {{output_bytes}} and
{{input_bytes}} unsigned.
{quote}
Right, I update it.
{quote}
We need to do error checking here in case the {{GetByteArrayElements}} calls
fail.
{quote}
I update it.
{quote}
Rather than having stuff like this, let's just change the CMakeLists.txt file
to not include this file unless openssl is found. #ifdefing out a whole file is
just weird, and has led to bugs in the past.
{quote}
I update it. Actually we just need to remove the {{if defined}}, we had that
logic in CMakeList.txt.
> Implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> ----------------------------------------------------------
>
> Key: HADOOP-10693
> URL: https://issues.apache.org/jira/browse/HADOOP-10693
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: security
> Affects Versions: fs-encryption (HADOOP-10150 and HDFS-6134)
> Reporter: Yi Liu
> Assignee: Yi Liu
> Fix For: fs-encryption (HADOOP-10150 and HDFS-6134)
>
> Attachments: HADOOP-10693.1.patch, HADOOP-10693.2.patch,
> HADOOP-10693.3.patch, HADOOP-10693.patch
>
>
> In HADOOP-10603, we have an implementation of AES-CTR CryptoCodec using Java
> JCE provider.
> To get high performance, the configured JCE provider should utilize native
> code and AES-NI, but in JDK6,7 the Java embedded provider doesn't support it.
>
> Considering not all hadoop user will use the provider like Diceros or able to
> get signed certificate from oracle to develop a custom provider, so this JIRA
> will have an implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> directly.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
