okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326180020
##########
THREAT_MODEL.md:
##########
@@ -212,6 +212,15 @@ controls. *(maintainer — okumin)*
(e.g. `hive.query.max.length`) and YARN resource pools, and — where stronger
isolation than HS2 + YARN can provide is required — separate HS2 instances or
separate Hadoop/YARN clusters. *(maintainer — okumin, §14 Q11)*
+- **Cryptographic strength of built-in masking / encryption UDFs.**
+ `mask_hash` is a deterministic, unsalted, unkeyed SHA-256/512 digest (so
+ masked values remain joinable); `aes_encrypt`/`aes_decrypt` currently use
+ AES/ECB/PKCS5Padding (no IV, no authentication) by default, for
+ compatibility with existing ciphertexts and MySQL-style `AES_ENCRYPT`. These
+ functions do not provide semantic security or resistance to
+ dictionary/enumeration attacks, and Hive does not claim they do. Choosing a
+ masking type appropriate to the data (e.g. nullify/redact for low-entropy
+ columns) is the policy author's responsibility.
Review Comment:
```suggestion
columns) is the policy author's responsibility. *(documented:
GenericUDFMaskHash, GenericUDFAesEncrypt, GenericUDFAesDecrypt)*.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
