vikaskr22 opened a new pull request, #721:
URL: https://github.com/apache/ranger/pull/721

   ## What changes were proposed in this pull request?
   
   In FIPS enabled env, saltSize is recalculated to be complaint with FIPS 
algorithm. This new saltSize was being calculated at runtime for MK 
encryption/decryption but configured saltSize ( or default) was being updated 
into the DB.
   
   This PR contains code changes to fix this behaviour. With this PR, whatever 
saltSize calculated and used will be updated into the DB records. It gives 
clarity on the actual MK metadata and removes dependency to re-calculate the 
saltSize while decrypting the MK.
   
   Earlier minSaltSize was kept fixed (at least 16 length) for FIPS algorithm, 
KMS has only one FIPS algorithm right now but with addition of other 
algorithms, this 16 might not be sufficient for any better/stronger algorithm. 
So it should be per algorithm. This PR handles this aspect as well.
   
   ## How was this patch tested?
   
   - mvn clean install
   - Manual Testing with non-fips env in docker container
   - Manual testing with fips env in docker container. Here I tested fresh 
installation  and upgrade scenario where re-encryption of MK happened from 
"PBEWithMD5AndDES" to "PBKDF2WithHmacSHA256"
   - Manually verified that DB MK record contains the actual saltSize. 
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to