[
https://issues.apache.org/jira/browse/HBASE-25181?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sean Busbey resolved HBASE-25181.
---------------------------------
Fix Version/s: 2.4.0
3.0.0-alpha-1
Release Note:
<!-- markdown -->
This change adds options for disabling column family encryption and choosing
hash algorithm for wrapped encryption keys. Changes are done such that defaults
will keep the same behavior prior to this issue.
Prior to this change HBase always used the MD5 hash algorithm to store a hash
for encryption keys. This hash is needed to verify the secret key of the
subject. (e.g. making sure that the same secrey key is used during encrypted
HFile read and write). The MD5 algorithm is considered weak, and can not be
used in some (e.g. FIPS compliant) clusters. Having a configurable hash enables
us to use newer and more secure hash algorithms like SHA-384 or SHA-512 (which
are FIPS compliant).
The hash is set via the configuration option `hbase.crypto.key.hash.algorithm`.
It should be set to a JDK `MessageDigest` algorithm like "MD5", "SHA-256" or
"SHA-384". The default is "MD5" for backward compatibility.
Alternatively, clusters which rely on an encryption at rest mechanism outside
of HBase (e.g. those offered by HDFS) and wish to ensure HBase's encryption at
rest system is inactive can set `hbase.crypto.enabled` to `false`.
Resolution: Fixed
Pushed to master and branch-2. I started backporting to branch-1, it was close
but there were enough conflicts for me to step away from it. If folks would
like to see it in branch-1 please post a backport PR.
> Add options for disabling column family encryption and choosing hash
> algorithm for wrapped encryption keys.
> -----------------------------------------------------------------------------------------------------------
>
> Key: HBASE-25181
> URL: https://issues.apache.org/jira/browse/HBASE-25181
> Project: HBase
> Issue Type: Improvement
> Affects Versions: 2.3.2
> Reporter: Mate Szalay-Beko
> Assignee: Mate Szalay-Beko
> Priority: Major
> Fix For: 3.0.0-alpha-1, 2.4.0
>
>
> Currently we are using MD5 hash algorithm to store a hash for encryption
> keys. This hash is needed to verify the secret key of the subject. (e.g.
> making sure that the same secret key is used during encrypted HFile / WalFile
> read and write). The MD5 algorithm is considered weak, and can not be used in
> some (e.g. FIPS compliant) clusters. However, currently it is not possible to
> use different hash algorithm, or to disable the whole column family
> encryption globally on the cluster.
> In this patch:
> * I introduce a backward compatible way of specifying the hash algorithm.
> This enable us to use newer and/or more secure hash algorithms like SHA-384
> or SHA-512 (which are FIPS compliant).
> * I added a configuration parameter to globally enable / disable the column
> family encryption feature. (enabled by default for backward compatibility).
> This is handy if someone wants to operate an HBase cluster making sure that
> uses are only relying on other (e.g. HDFS based) encryption mechanisms.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
