[
https://issues.apache.org/jira/browse/OAK-3761?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15112371#comment-15112371
]
Timothee Maret edited comment on OAK-3761 at 1/22/16 12:32 PM:
---------------------------------------------------------------
Thanks for the detailed feedback [~chetanm]! I think we may be aiming at two
different goals, which I'll detail below
h3. G0. Allow to unprotect OSGI configuration properties on demand
This feature request is contained in OAK-3626.
This feature could consist of the {{CredentialStore}} API proposed in the
previous comment.
The API would specially cover fetching unprotected credentials from any
sort of data store (local or remote).
h3. G1. Add support for a general crypto API
This feature could be used in Oak for implementing the local version of the
{{CredentialStore}} API (G0.).
This feature could also be used in Oak for supporting "automatic encryption
of properties" as described by [~anchela] in OAK-3626.
This feature could incidentally be used by application leveraging Apache
Jackrabbit Oak (such as Apache Sling).
The API for this feature would be the {{SymmetricCipher}} (as in the patch)
which would initially contain only support for symmetric authenticated
encryption/decryption, but could be extended in the future with symmetric
crypto features (e.g. stream ciphers, password based encryption) if there is a
need for it.
I think Apache Oak team should decide whether there see a need to support use
cases that motivate G1., by answering the question:
Does Oak need automatic encryption or has other use case for encryption ?
Assuming the answer is "yes", then we may keep the {{SymmetricCipher}} API ;
expose the {{encryption}} signature in the API ; add the {{CredentialStore}}
API as part of OAK-3626 ; implement the {{CredentialStore}} API using the
{{SymmetricCipher}} API.
Assuming the answer to this is "no", then I suggest we ditch the current issue
OAK-3761 ; propose the {{SymmetricCipher}} API to Apache Sling ; add the
{{CredentialStore}} API as part of OAK-3626 ; implement the {{CredentialStore}}
API with a mechanism that does not necessarily involve encryption (AFAIU
protected/unprotected is a rather lose definition) ; offer the ability to plug
a custom implementation of the {{CredentialStore}} API which may involve
encryption.
wdyt ?
was (Author: marett):
Thanks for the detailed feedback [~chetanm]! I think we may be aiming at two
different goals, which I'll detail below
h3. G0. Allow to unprotect OSGI configuration properties on demand
This feature request is contained in OAK-3626.
This feature could consist of the {{CredentialStore}} API proposed in the
previous comment.
The API would specially cover fetching unprotected credentials from any
sort of data store (local or remote).
h3. G1. Add support for a general crypto API
This feature could be used in Oak for I. implementing the local version of
the {{CredentialStore}} API (G0.).
This feature could also be used in Oak for supporting "automatic encryption
of properties" as described by [~anchela] in OAK-3626.
This feature could incidentally be used by application leveraging Apache
Jackrabbit Oak (such as Apache Sling).
The API for this feature would be the {{SymmetricCipher}} (as in the patch)
which would initially contain only support for symmetric authenticated
encryption/decryption, but could be extended in the future with symmetric
crypto features (e.g. stream ciphers, password based encryption) if there is a
need for it.
I think Apache Oak team should decide whether there see a need to support use
cases that motivate G1., by answering the question:
Does Oak need automatic encryption or has other use case for encryption ?
Assuming the answer is "yes", then we may keep the {{SymmetricCipher}} API ;
expose the {{encryption}} signature in the API ; add the {{CredentialStore}}
API as part of OAK-3626 ; implement the {{CredentialStore}} API using the
{{SymmetricCipher}} API.
Assuming the answer to this is "no", then I suggest we ditch the current issue
OAK-3761 ; propose the {{SymmetricCipher}} API to Apache Sling ; add the
{{CredentialStore}} API as part of OAK-3626 ; implement the {{CredentialStore}}
API with a mechanism that does not necessarily involve encryption (AFAIU
protected/unprotected is a rather lose definition) ; offer the ability to plug
a custom implementation of the {{CredentialStore}} API which may involve
encryption.
wdyt ?
> Oak crypto API and implementation
> ---------------------------------
>
> Key: OAK-3761
> URL: https://issues.apache.org/jira/browse/OAK-3761
> Project: Jackrabbit Oak
> Issue Type: New Feature
> Components: security
> Affects Versions: 1.3.12
> Reporter: Timothee Maret
> Assignee: angela
> Attachments: OAK-3761.patch, OAK-3761.patch
>
>
> As discussed in [0], this issue tracks adding a simple API and implementation
> for encryption/decryption in Oak.
> [0]
> http://oak.markmail.org/search/?q=crypto#query:crypto+page:1+mid:iwsfd66lku2dzs2n+state:results
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
