zqr10159 opened a new pull request, #4235: URL: https://github.com/apache/hertzbeat/pull/4235
## What changed - generate a fresh 16-byte IV for every AES-CBC encryption - store the IV in a versioned Base64 payload alongside the ciphertext - keep decoding compatible with ciphertext written by the previous format - cover IV uniqueness, payload format, round-trip behavior, and legacy decoding ## Why AES-CBC requires an unpredictable IV for each encryption. The existing utility derived the IV from the encryption key, so encrypting the same plaintext with the same key produced identical ciphertext. ## Impact Newly encrypted values use per-message IVs. Existing persisted ciphertext continues to decrypt without a data migration and will adopt the new format when it is written again. ## Validation - `./mvnw -q -pl hertzbeat-common-core -Dtest=AesUtilTest test -DskipITs -Dsurefire.failIfNoSpecifiedTests=false -DfailIfNoTests=false` - `./mvnw -q -pl hertzbeat-common-core test -DskipITs` (490 tests) - `./mvnw -q -pl hertzbeat-manager -Dtest=PasswordParamValidatorTest test -DskipITs -Dsurefire.failIfNoSpecifiedTests=false -DfailIfNoTests=false` - `./mvnw -q -pl hertzbeat-startup -am -DskipTests package` - `git diff --cached --check` AI assistance: used for draft implementation and test iteration. Human validation: focused and module-level Maven tests passed; the startup source package proof passed. Risk notes: legacy values remain in the old format until rewritten; decoding compatibility is retained intentionally. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
