[
https://issues.apache.org/jira/browse/KUDU-3316?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17522687#comment-17522687
]
kirby zhou commented on KUDU-3316:
----------------------------------
for EEK header
Your header if fixed-length of kEncryptionHeaderSize = 64;
And the encrypted key size is determined by algorithm.
I think this is not flexible enough, because 'DoEncryptV(&kDummyEncryptionKey,
0, clear, cipher)' may be replaced by a real KMS RPC calling in future, and the
size of returned EEK is very flexible. Some metadata is stored inside EEK
together, you can not split them without undocumented knowledge. For example,
tencent KMS will store zoneKeyName, version and a signature inside EEK, and the
detail is undocumented.
{code:java}
Status WriteEncryptionHeader(int fd, const string& filename, const
EncryptionHeader& eh) {
vector<Slice> headerv = { kEncryptionHeaderMagic };
//...
headerv.emplace_back(Slice(algorithm, 1));
Slice file_key(eh.key, key_size);
uint8_t encrypted_file_key[32];
Slice efk(encrypted_file_key, key_size);
vector<Slice> clear = {file_key};
vector<Slice> cipher = {efk};
RETURN_NOT_OK(DoEncryptV(&kDummyEncryptionKey, 0, clear, cipher));
headerv.emplace_back(efk);
// Add the encrypted file key and trailing zeros to the header.
static const uint8_t padding[40] = {0};
// 7 bytes of magic + 1 byte of algorithm and key length.
constexpr int kMagicAndAlgorithmSize = 8;
Slice padding_slice(padding, kEncryptionHeaderSize - kMagicAndAlgorithmSize -
key_size);
headerv.emplace_back(padding_slice);
return DoWriteV(fd, filename, 0, headerv, nullptr);
}
{code}
for IV
My concern is non-randomized IV is easier to be exploited by plaintext attack.
If we store a 8-octet IV at the header of file, it is not costly.
In particular, some KMS generate an IV at the same time as the EEK.
For example, Ranger KMS:
{code:java}
curl -u: --negotiate
'http://kirbytest01.sa:9292/kms/v1/key/hello-world/_eek?eek_op=generate&num_keys=1'
[ {
"encryptedKeyVersion" : {
"material" : "yzq3IQXiQXnaYCHsH-8prA",
"name" : "hello-world",
"versionName" : "EEK"
},
"versionName" : "hello-world@1",
"iv" : "rbwS8T0aXPBKYdq9DpZvaw"
} ]
{code}
> Store encrypted encryption keys in encrypted files
> --------------------------------------------------
>
> Key: KUDU-3316
> URL: https://issues.apache.org/jira/browse/KUDU-3316
> Project: Kudu
> Issue Type: Sub-task
> Reporter: Attila Bukor
> Assignee: Attila Bukor
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
