jlfsdtc opened a new pull request, #2359: URL: https://github.com/apache/kylin/pull/2359
Add kylin.security.encryption-mode (or KYLIN_SECURITY_ENCRYPTION_MODE) to choose the cipher for newly encrypted values: ECB, the default and the only format older releases can read, or GCM with a random IV per value. An unsupported mode fails on encrypt instead of silently falling back to ECB. The mode only governs writing. On read the format is taken from the ciphertext length: AES/ECB output is always a whole number of blocks, and the GCM plaintext is PKCS#7 padded so that iv || ciphertext || tag is always 12 modulo 16 bytes. Values in either format therefore stay readable whatever mode a JVM runs with, and a GCM value that fails authentication is never retried as ECB. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
