[
https://issues.apache.org/jira/browse/HDDS-17562?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17562:
------------------------------
Status: Patch Available (was: In Progress)
> Use a separate encryption IV for each multipart upload part
> -----------------------------------------------------------
>
> Key: HDDS-17562
> URL: https://issues.apache.org/jira/browse/HDDS-17562
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Ozone Client, Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> In an encrypted bucket, every part of a multipart upload is encrypted with
> the IV of the upload's {{FileEncryptionInfo}}, which is created when the
> upload is initiated.
> This change gives each part its own random IV:
> * OM generates the IV for each part in CreateKey {{preExecute}} and stores it
> in the open part key ({{KeyInfo.partIv}}). Commit part copies it onto the
> part's blocks ({{KeyLocation.partIv}}). The upload's {{FileEncryptionInfo}}
> (EDEK and its IV) is unchanged.
> * The client encrypts a part with its IV, and decrypts each part with the IV
> stored on its blocks, falling back to the key IV.
> * New OM setting {{ozone.om.mpu.part.encryption.iv.enabled}} (default
> {{true}}) turns this off.
> Compatibility:
> * New {{OzoneManagerVersion.MULTIPART_PART_IV}} and
> {{ClientVersion.MULTIPART_PART_IV_SUPPORT}}. OM sets part IVs only after it
> is finalized and only for clients that support them.
> * Older clients, including older S3 Gateways and {{ozone sh}}, get
> {{NOT_SUPPORTED_OPERATION}} from LookupKey, GetKeyInfo and LookupFile for
> keys that have part IVs. Upgrade S3 Gateways and other clients before
> finalizing OM.
> * Existing keys, regular keys and keys in unencrypted buckets are read as
> before.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
