[
https://issues.apache.org/jira/browse/CAMEL-24506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110640#comment-18110640
]
Federico Mariani commented on CAMEL-24506:
------------------------------------------
PR: https://github.com/apache/camel-spring-boot/pull/1931
*1. Default algorithm*
{{camel.component.jasypt.algorithm}} now defaults to
{{PBEWITHHMACSHA256ANDAES_256}}. No new machinery was required: the starter
already lists that algorithm in
{{JasyptEncryptedPropertiesUtils.ALGORITHMS_THAT_REQUIRE_IV}}, so
{{getIVGenerator}} installs {{RandomIvGenerator}} automatically when
{{iv-generator-class-name}} is not set.
Breaking for values encrypted under the old default. The opt-back is
{{camel.component.jasypt.algorithm = PBEWithMD5AndDES}}; otherwise the values
must be re-encrypted. An upgrade-guide entry has been drafted for the
{{camel-spring-boot}} section of {{camel-4x-upgrade-guide-4_23.adoc}} and will
be submitted to apache/camel separately.
*Upstream coordination*
Upstream {{camel-jasypt}} does *not* currently match this default.
{{JasyptPropertiesParser.initEncryptor}} only calls {{setAlgorithm}} when the
{{algorithm}} field is non-null, and it is null by default, so the parser falls
back to the Jasypt library default
{{StandardPBEByteEncryptor.DEFAULT_ALGORITHM}} = {{PBEWithMD5AndDES}}. The same
holds for the {{camel-jasypt}} CLI
({{org.apache.camel.component.jasypt.Main}}), where {{-a}} is optional.
The upstream default should follow in a separate change in apache/camel; this
PR does not make it. Until then the two diverge, so the starter documentation
now states explicitly that the encryption tooling must be passed a matching
algorithm. It also warns that the Jasypt CLI installs no IV generator unless
asked ({{StandardPBEByteEncryptor}} falls back to {{NoIvGenerator}}), so
{{-riga SHA1PRNG}} is required alongside {{-a PBEWITHHMACSHA256ANDAES_256}} or
the resulting value cannot be decrypted at runtime.
*2. Usage example*
{{src/main/doc/usage.adoc}} now uses {{camel.component.jasypt.password =
sysenv:JASYPT_PASSWORD}}, carries a WARNING that the master password must come
from the environment or an external secret store and must never live in the
same file or repository as the encrypted values, and documents the {{sysenv:}}
and {{sys:}} prefixes. The encryption command was also corrected, since {{camel
jasypt encrypt --password= --input=}} is not a real command.
*Tests*
New {{JasyptDefaultAlgorithmTest}} (4 tests): default algorithm and IV
generator, encrypt/decrypt round trip under the new default, decryption of a
legacy-algorithm ciphertext with the opt-back set, and the failure of that same
ciphertext under the new default. {{EncryptedPropertiesUtilsTest}} updated for
the IV auto-detection now triggered by the default, plus a new case for an
algorithm that does not require an IV.
{{mvn install -pl components-starter/camel-jasypt-starter}}: Tests run: 71,
Failures: 0, Errors: 0, Skipped: 0 — BUILD SUCCESS.
{{src/main/docs/jasypt.json}} and
{{docs/spring-boot/modules/ROOT/pages/starters/jasypt.adoc}} regenerated and
committed.
_Comment added by Claude Code on behalf of Federico Mariani._
> camel-jasypt-starter - modernise the default algorithm and fix the usage
> example's password placement
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24506
> URL: https://issues.apache.org/jira/browse/CAMEL-24506
> Project: Camel
> Issue Type: Improvement
> Components: camel-jasypt, camel-spring-boot-starters
> Reporter: Andrea Cosentino
> Assignee: Federico Mariani
> Priority: Major
> Fix For: 4.23.0
>
>
> Two items in the same starter, distinct root causes.
> *1. Default algorithm*
> {code:java}
> /**
> * The algorithm to be used for decryption. Default: PBEWithMD5AndDES
> */
> private String algorithm = "PBEWithMD5AndDES";
> {code}
> (JasyptEncryptedPropertiesConfiguration:42)
> {{PBEWithMD5AndDES}} is a 56-bit DES cipher with an MD5-based key derivation.
> The starter already carries {{PBEWITHHMACSHA256ANDAES_256}} in its
> {{ALGORITHMS_THAT_REQUIRE_IV}} set, so the {{RandomIvGenerator}} path engages
> automatically if it becomes the default.
> Changing the default is a breaking change for values encrypted under the old
> one, so it needs an upgrade-guide entry and an explicit opt-back
> ({{camel.component.jasypt.algorithm=PBEWithMD5AndDES}}), and should be
> coordinated with the upstream camel-jasypt component default rather than
> diverging from it.
> *2. Usage example places the master password beside the ciphertext*
> {code:properties}
> my.secret = ENC(encrypted-value-here)
> camel.component.jasypt.password = the-master-password
> {code}
> (src/main/doc/usage.adoc:6)
> The example puts the decryption key in the same file as the encrypted value,
> which removes the benefit of encrypting it. The starter already supports
> {{sysenv:}} and {{sys:}} prefixes for exactly this, and {{jasypt.json}}
> documents them.
> *Proposal*: change the example to {{camel.component.jasypt.password =
> sysenv:JASYPT_PASSWORD}} and add a sentence stating the master password must
> come from the environment or an external secret store and must not live
> alongside the encrypted values.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
