vikaskr22 opened a new pull request, #721: URL: https://github.com/apache/ranger/pull/721
## What changes were proposed in this pull request? In FIPS enabled env, saltSize is recalculated to be complaint with FIPS algorithm. This new saltSize was being calculated at runtime for MK encryption/decryption but configured saltSize ( or default) was being updated into the DB. This PR contains code changes to fix this behaviour. With this PR, whatever saltSize calculated and used will be updated into the DB records. It gives clarity on the actual MK metadata and removes dependency to re-calculate the saltSize while decrypting the MK. Earlier minSaltSize was kept fixed (at least 16 length) for FIPS algorithm, KMS has only one FIPS algorithm right now but with addition of other algorithms, this 16 might not be sufficient for any better/stronger algorithm. So it should be per algorithm. This PR handles this aspect as well. ## How was this patch tested? - mvn clean install - Manual Testing with non-fips env in docker container - Manual testing with fips env in docker container. Here I tested fresh installation and upgrade scenario where re-encryption of MK happened from "PBEWithMD5AndDES" to "PBKDF2WithHmacSHA256" - Manually verified that DB MK record contains the actual saltSize. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
