Chung-En Lee created HDDS-17057:
-----------------------------------
Summary: Document S3 signed multi-chunks upload verification
behavior and limitations
Key: HDDS-17057
URL: https://issues.apache.org/jira/browse/HDDS-17057
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Chung-En Lee
Draft a comprehensive document/design doc explaining how Apache Ozone handles
S3 chunked uploads (signed multi-chunks payload verification), detailing the
verification workflows, supported algorithms, and current limitations.
h4. *Key Points to Cover in the Doc*
# *Verification Conditions & Behavior:*
** Clearly document *under which specific circumstances signature verification
actually takes place* during chunked uploads (e.g., specific
{{x-amz-content-sha256}} header types such as
{{{}STREAMING-AWS4-HMAC-SHA256-PAYLOAD{}}}, presence of derived keys, payload
vs. trailer verification).
# *Algorithm Support & ECDSA Limitation:*
** *HMAC-SHA256:* Fully supported for chunk payload and trailer signature
verification.
** *ECDSA (e.g., {{STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD}} / SigV4a):*
*** *Verification is currently NOT supported.*
*** *Upload behavior:* Even though Ozone cannot verify ECDSA chunk signatures,
*the upload will still succeed* without failing the request (payload is
accepted/streamed, but signatures are not verified).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
