rubenada commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326325876
##########
ql/src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFAesDecrypt.java:
##########
@@ -31,6 +31,8 @@
+ "Key lengths of 128, 192 or 256 bits can be used. 192 and 256 bits keys
can be used if "
+ "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction
Policy Files are installed. "
+ "If either argument is NULL or the key length is not one of the
permitted values, the return value is NULL.\n"
+ + "Note: this function uses AES in ECB mode (AES/ECB/PKCS5Padding,
MySQL-style) with no IV and no "
Review Comment:
I run some tests, it seems Hive and MySQL agree only when MySQL's
`block_encryption_mode` matches the key length. With MySQL's default mode, that
means 16-byte keys; with MySQL's `block_encryption_mode = 'aes-192-ecb'` it
means 24-byte keys; and with MySQL's `block_encryption_mode = 'aes-256-ecb'` it
means 32-byte keys.
This means that this code in Hive:
```
select base64(aes_encrypt('ABC', '1234567890123456'));
-- y6Ss+zCYObpCbgfWfyNWTw==
select base64(aes_encrypt('ABC', '123456789012345678901234'));
-- iSwHg+qOErVgUCj8EVEAmw==
select base64(aes_encrypt('ABC', '12345678901234567890123456789012'));
-- E1zl+pDv/GY4JLk254KAIQ==
```
Would match this code in MySQL (tested on 8)
```
SELECT TO_BASE64(AES_ENCRYPT('ABC', '1234567890123456'));
-- y6Ss+zCYObpCbgfWfyNWTw==
SET SESSION block_encryption_mode = 'aes-192-ecb';
SELECT TO_BASE64(AES_ENCRYPT('ABC', '123456789012345678901234'));
-- iSwHg+qOErVgUCj8EVEAmw==
SET SESSION block_encryption_mode = 'aes-256-ecb';
SELECT TO_BASE64(AES_ENCRYPT('ABC', '12345678901234567890123456789012'));
-- E1zl+pDv/GY4JLk254KAIQ==
```
Any other combination, e.g. a 24-byte key using MySQL default mode, will
mismatch:
```
select base64(aes_encrypt('ABC', '123456789012345678901234'));
-- Hive: iSwHg+qOErVgUCj8EVEAmw==
-- MySql default: m4TQ3WlUBBJr8qqE/Fm7Sg== │
```
That's why I chose "MySQL-style", instead of "MySQL compatible".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
