[
https://issues.apache.org/jira/browse/HDDS-17057?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chung-En Lee reassigned HDDS-17057:
-----------------------------------
Assignee: Huang Kuan Hao
> Document S3 signed multi-chunks upload verification behavior and limitations
> ----------------------------------------------------------------------------
>
> Key: HDDS-17057
> URL: https://issues.apache.org/jira/browse/HDDS-17057
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Chung-En Lee
> Assignee: Huang Kuan Hao
> Priority: Major
>
> Draft a comprehensive document/design doc explaining how Apache Ozone handles
> S3 chunked uploads (signed multi-chunks payload verification), detailing the
> verification workflows, supported algorithms, and current limitations.
> h4. *Key Points to Cover in the Doc*
> # *Verification Conditions & Behavior:*
> ** Clearly document *under which specific circumstances signature
> verification actually takes place* during chunked uploads (e.g., specific
> {{x-amz-content-sha256}} header types such as
> {{{}STREAMING-AWS4-HMAC-SHA256-PAYLOAD{}}}, presence of derived keys, payload
> vs. trailer verification).
> # *Algorithm Support & ECDSA Limitation:*
> ** *HMAC-SHA256:* Fully supported for chunk payload and trailer signature
> verification.
> ** *ECDSA (e.g., {{STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD}} / SigV4a):*
> *** *Verification is currently NOT supported.*
> *** *Upload behavior:* Even though Ozone cannot verify ECDSA chunk
> signatures, *the upload will still succeed* without failing the request
> (payload is accepted/streamed, but signatures are not verified).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
