[
https://issues.apache.org/jira/browse/RANGER-3174?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17986586#comment-17986586
]
Vikas Kumar edited comment on RANGER-3174 at 6/27/25 5:35 PM:
--------------------------------------------------------------
With this commit, now KMS will start supporting P{_}BKDF2WithHmacSHA256
algorithm if FIPS is enabled{_}. This algorithm is FIPS complaint and being
provided by many SecurityProviders.
Currently I have kept this if FIPS is enabled, means, if keyStoreType is
*"bcfks"*
So if FIPS is enabled, then following will happen:
# All new keys material will be encrypted/decrypted using PBKDF2WithHmacSHA256
algorithm.
# Any older keys (including MasterKey) will be re-encrypted using
PBKDF2WithHmacSHA256 on KMS service start. This is an one time operation. Here
re-encryption means, decrypting the older keys using older algorithm and
re-encryption it using the current PBKDF2WithHmacSHA256 algorithm.
Please note that key material is not changing, only it is being re-encrypted
before storing into DB. hence, there is no risk of data loss.
h2. How was this patch tested?
# basic mvn build and UnitTest cases.
# {*}Manual testing in docker setup{*}. I used following steps to prepare
docker container for this testing:
** I used *bc-fips-2.0.0.jar* as SecurityProvider for PBKDF2WithHmacSHA256
*
** Copied **
{code:java}
bc-fips-2.0.0.jar jar to the
/usr/lib/jvm/java-8-openjdk-arm64/jre/lib/ext/{code}
*
** Updated
{code:java}
java.security file at /etc/java-8-openjdk/security/java.security{code}
to contain following content:
{code:java}
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
org.bouncycastle.fips.approved_only=true{code}
*
** *For rangerkms.jceks* (that contains MasterKey password and DB password) :
created corresponding keystore in bcfks formart named rangerkms.localbcfks
*
** *dbks-site.xml* : Updated following properties in this file:
{code:java}
Key: ranger.ks.jpa.jdbc.credential.provider.path
Value:
localbcfks://file/opt/ranger/kms/ews/webapp/WEB-INF/classes/conf/rangerkms.localbcfks
Key: ranger.keystore.file.type
Value: bcfks
{code}
*Scenarios Tested:*
# *Fresh setup:* Masterkey and Zone keys got created using latest algorithm.
And basic encryption/decryption was working fine.
# *Cluster having old keys with older algorithm:*
** Here created one zone key (zonekey1) and one encryption Zone and copied one
test file inside the zone key
** Means, file got encrypted using DEK , and this DEK was encrypted using
corresponding zone keys . This zone keys was encrypted using PBEWithMD5AndDES.
** Then, created a new ranger-kms docker image with new changes. And started
the container.
** Here Masterkey and all zone keys got re-encypted using new algorithm.
** Files kept inside encryptionZone was accessible after keys re-encryption.
** Also, basic key life cycle like create/rotate/delete was also working.
PR: [https://github.com/apache/ranger/pull/593]
was (Author: JIRAUSER295683):
With this commit, now KMS will start supporting P{_}BKDF2WithHmacSHA256
algorithm if FIPS is enabled{_}. This algorithm is FIPS complaint and being
provided by many SecurityProviders.
Currently I have kept this if FIPS is enabled, means, if keyStoreType is
*"bcfks"*
So if FIPS is enabled, then following will happen:
# All new keys material will be encrypted/decrypted using PBKDF2WithHmacSHA256
algorithm.
# Any older keys (including MasterKey) will be re-encrypted using
PBKDF2WithHmacSHA256 on KMS service start. This is an one time operation. Here
re-encryption means, decrypting the older keys using older algorithm and
re-encryption it using the current PBKDF2WithHmacSHA256 algorithm.
Please note that key material is not changing, only it is being re-encrypted
before storing into DB. hence, there is no risk of data loss.
h2. How was this patch tested?
# basic mvn build and UnitTest cases.
# {*}Manual testing in docker setup{*}. I used following steps to prepare
docker container for this testing:
** I used *bc-fips-2.0.0.jar* as SecurityProvider for PBKDF2WithHmacSHA256
** Copied **
{code:java}
bc-fips-2.0.0.jar jar to the
/usr/lib/jvm/java-8-openjdk-arm64/jre/lib/ext/{code}
{{}}
** Updated
{code:java}
java.security file at /etc/java-8-openjdk/security/java.security{code}
to contain following content:
{code:java}
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
org.bouncycastle.fips.approved_only=true{code}
** *For rangerkms.jceks* (that contains MasterKey password and DB password) :
created corresponding keystore in bcfks formart named rangerkms.localbcfks
** *dbks-site.xml* : Updated following properties in this file:
{code:java}
Key: ranger.ks.jpa.jdbc.credential.provider.path
Value:
localbcfks://file/opt/ranger/kms/ews/webapp/WEB-INF/classes/conf/rangerkms.localbcfks
Key: ranger.keystore.file.type
Value: bcfks
{code}
*Scenarios Tested:*
# *Fresh setup:* Masterkey and Zone keys got created using latest algorithm.
And basic encryption/decryption was working fine.
# *Cluster having old keys with older algorithm:*
** Here created one zone key (zonekey1) and one encryption Zone and copied one
test file inside the zone key
** Means, file got encrypted using DEK , and this DEK was encrypted using
corresponding zone keys . This zone keys was encrypted using PBEWithMD5AndDES.
** Then, created a new ranger-kms docker image with new changes. And started
the container.
** Here Masterkey and all zone keys got re-encypted using new algorithm.
** Files kept inside encryptionZone was accessible after keys re-encryption.
** Also, basic key life cycle like create/rotate/delete was also working.
PR: [https://github.com/apache/ranger/pull/593]
> Weak Cryptographic Algorithm and hash function used for PBE encryption
> ----------------------------------------------------------------------
>
> Key: RANGER-3174
> URL: https://issues.apache.org/jira/browse/RANGER-3174
> Project: Ranger
> Issue Type: Improvement
> Components: kms
> Reporter: Vicky Zhang
> Assignee: Vikas Kumar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> PBEWithMD5AndTripleDES is used in the file
> /kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java line 310
> *Security impact*:
> MD5 is a deprecated hash algorithm and DES also not recommend for symmetric
> encryption. The use of a broken or risky cryptographic algorithm is an
> unnecessary risk that may result in the exposure of sensitive information.
> Useful resources: [https://cwe.mitre.org/data/definitions/327.html]
> *suggestions*:
> According to the
> [https://tools.ietf.org/html/rfc2898.|https://tools.ietf.org/html/rfc2898,]
> PBKDF2 is highly recommended while doing PBE encryption
> *Please share with us your opinions/comments if there is any:*
> Is the bug report helpful?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
