AlinsRan opened a new pull request, #13756:
URL: https://github.com/apache/apisix/pull/13756
### Description
`core.data_encryption.init_iv_tbl` only ever built AES-128 ciphers:
```lua
tbl.insert(iv_tbl, assert(aes:new(iv, nil, aes.cipher(128, "cbc"), {iv =
iv})))
```
So a 32-byte `apisix.data_encryption.keyring` key could not be used for
AES-256, and any key whose length is not exactly 16 bytes was forced through
`aes.cipher(128, ...)` and errored via the `assert`.
This selects the cipher by key length: a 16-byte key → AES-128, a 32-byte
key → AES-256. Keys of any other length are skipped rather than crashing.
No schema change is needed — the keyring is read from config without a
length constraint.
### Which issue(s) this PR fixes
Lets operators use a stronger AES-256 keyring for `encrypt_fields` / SSL key
encryption.
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
(`t/core/data_encryption.t`: 16-byte, 32-byte, mixed keyring, unsupported
length)
- [x] I have updated the documentation accordingly
- [ ] I have verified locally (full CI covers the rest)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
