Siyao Meng created HDDS-17562:
---------------------------------
Summary: Use a separate encryption IV for each multipart upload
part
Key: HDDS-17562
URL: https://issues.apache.org/jira/browse/HDDS-17562
Project: Apache Ozone
Issue Type: Improvement
Components: Ozone Manager, Ozone Client
Reporter: Siyao Meng
Assignee: Siyao Meng
In an encrypted bucket, every part of a multipart upload is encrypted with the
IV of the upload's {{FileEncryptionInfo}}, which is created when the upload is
initiated.
This change gives each part its own random IV:
* OM generates the IV for each part in CreateKey {{preExecute}} and stores it
in the open part key ({{KeyInfo.partIv}}). Commit part copies it onto the
part's blocks ({{KeyLocation.partIv}}). The upload's {{FileEncryptionInfo}}
(EDEK and its IV) is unchanged.
* The client encrypts a part with its IV, and decrypts each part with the IV
stored on its blocks, falling back to the key IV.
* New OM setting {{ozone.om.mpu.part.encryption.iv.enabled}} (default {{true}})
turns this off.
Compatibility:
* New {{OzoneManagerVersion.MULTIPART_PART_IV}} and
{{ClientVersion.MULTIPART_PART_IV_SUPPORT}}. OM sets part IVs only after it is
finalized and only for clients that support them.
* Older clients, including older S3 Gateways and {{ozone sh}}, get
{{NOT_SUPPORTED_OPERATION}} from LookupKey, GetKeyInfo and LookupFile for keys
that have part IVs. Upgrade S3 Gateways and other clients before finalizing OM.
* Existing keys, regular keys and keys in unencrypted buckets are read as
before.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
