okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326133802
##########
THREAT_MODEL.md:
##########
@@ -303,6 +312,10 @@ These are the dispositions the PMC has recorded; confirm
and extend
the operator has not configured the blacklist โ `OUT-OF-MODEL:
operator responsibility`, unless the report shows a
*bypass* of a configured blacklist. *(maintainer โ okumin.)*
+- **"`mask_hash` is invertible / `aes_encrypt` uses ECB / a built-in hash UDF
+ is weak."** By design โ see ยง7. Valid only if the report shows a bypass of a
+ configured masking policy (e.g. reading the unmasked column), not the
+ inherent properties of the function. `BY-DESIGN`.
Review Comment:
```suggestion
inherent properties of the function. `BY-DESIGN`. *(documented:
GenericUDFMaskHash, GenericUDFAesEncrypt, GenericUDFAesDecrypt))*.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
