[
https://issues.apache.org/jira/browse/RANGER-5498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18061281#comment-18061281
]
Vikas Kumar commented on RANGER-5498:
-------------------------------------
PR has been reviewed and merged, hence resolving the JIRA.
PR: https://github.com/apache/ranger/pull/860
{code:java}
commit 05035e57ee3567442c676a7f7574e75a9204659b{code}
> [KMS]: Use provided saltSize parameter at all places in generateSalt method
> instead of static member
> ----------------------------------------------------------------------------------------------------
>
> Key: RANGER-5498
> URL: https://issues.apache.org/jira/browse/RANGER-5498
> Project: Ranger
> Issue Type: Bug
> Components: kms
> Reporter: Vikas Kumar
> Assignee: Vikas Kumar
> Priority: Minor
> Time Spent: 10m
> Remaining Estimate: 0h
>
> *Issue:*
> Issue is in
> {code:java}
> RangerMasterKey.generateSalt(int saltSize) {code}
> method.
> In some cases, It creates salt of size 16, creating holder byte[] of size 16
> but may copy different number of bits into the target array (default size) if
> RangerMasterKey.saltSize contains a different value. As a result, a weak salt
> will be generated.
> This method should use the provided saltSize in the parameter, not
> RangerMasterKey.saltSize.
>
> {code:java}
> System.arraycopy(saltGen, 0, salt, 0, RangerMasterKey.saltSize);{code}
> Since this code has not yet been released and being targeted for 3.0. There
> would not be any upgrade failure but it would be better to to fix this.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
