[
https://issues.apache.org/jira/browse/NIFI-1525?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15150947#comment-15150947
]
Andy LoPresto commented on NIFI-1525:
-------------------------------------
Description from re-opened tickets:
I am re-opening this ticket and suggest adding a property to this processor to
explicitly allow an empty passphrase on a private key, but by default requiring
a passphrase. I think we should raise the status quo to enforce good security
practices, which require a passphrase to protect this extremely sensitive data.
We should instruct the user on the proper process to add a passphrase to their
key if necessary. If there are legacy requirements/blockers to doing this, the
administrator/dataflow manager will be required to explicitly acknowledge that
this is unsafe and set the override property. As an example, this has been
implemented for weak legacy cryptographic combinations in {{EncryptContent}}
processor in [NIFI-1463]. This should also be done for all other uses of
"private keys" throughout the application.
> Audit use of private keys throughout application
> ------------------------------------------------
>
> Key: NIFI-1525
> URL: https://issues.apache.org/jira/browse/NIFI-1525
> Project: Apache NiFi
> Issue Type: Task
> Components: Core Framework
> Affects Versions: 0.5.0
> Reporter: Andy LoPresto
> Labels: keys, security
>
> Throughout the application, private keys are used for authentication and
> encryption in a number of scenarios. These uses are handled independently and
> sometimes inconsistently.
> Identify any outstanding issues with the use and protection of private keys
> (lack of enforcement of passphrases, etc.) and possibly provide a consumable
> framework service to handle this task to deduplicate effort/code and provide
> a consistent experience.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
