Sailesh Mukil has posted comments on this change. ( http://gerrit.cloudera.org:8080/8510 )
Change subject: IMPALA-6128: Spill-to-disk Encryption(AES-CFB + SHA256) is slow ...................................................................... Patch Set 4: > > Thanks for doing this. It seems reasonable to me to switch to > CTR. > > > > One concern I have is were you able to test this on a system with > > OpenSSL 1.0.0? Their documentation isn't clear, so I'm not sure > if > > this API is supported in that version. > > The best I could see was this line of code that was under an #if > 0: > > https://github.com/openssl/openssl/blob/OpenSSL_1_0_0-stable/crypto/evp/evp.h#L782-L783 > > > > It would be great if you could verify that. > > Thank Sailesh for your comments. aes_256_ctr was supported since > openssl 1.0.1. Luckily, Impala add openssl to toolchain and upgrade > to version 1.0.1p (see IMPALA-5714) Xianda, we don't statically link against OpenSSL. So the version you see in the toolchain is just what we build against, but we may be running against an older version of OpenSSL. Impala supports OpenSSL 1.0.0 onwards, so we wouldn't want this to break for users that are still running against that version. One way to fix this would be to use SSLeay() to check the runtime version of OpenSSL, like we do here, and use CTR mode or CFB mode accordingly: https://github.com/apache/incubator-impala/blob/1ca3adf46c5ef5055c13fd3ce57e7c53218c219c/be/src/rpc/thrift-server.cc#L92 It isn't ideal to add more runtime version checks in the code, but this would be nice to have for the majority of the users that run on newer OpenSSL versions. -- To view, visit http://gerrit.cloudera.org:8080/8510 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ib97939f2334838263364b53ef3413871638bf53e Gerrit-Change-Number: 8510 Gerrit-PatchSet: 4 Gerrit-Owner: Xianda Ke <[email protected]> Gerrit-Reviewer: Jim Apple <[email protected]> Gerrit-Reviewer: Mike Yoder <[email protected]> Gerrit-Reviewer: Sailesh Mukil <[email protected]> Gerrit-Reviewer: Tim Armstrong <[email protected]> Gerrit-Reviewer: Xianda Ke <[email protected]> Gerrit-Comment-Date: Fri, 17 Nov 2017 00:15:57 +0000 Gerrit-HasComments: No
