[HBASE-16463] Improve transparent table/CF encryption with Commons Crypto

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Component/s: encryption
• Hadoop Flags: Reviewed

Release Note

Improve transparent table/CF encryption with Commons Crypto. The change introduces a new optional CryptoCipherProvider (CommonsCryptoAES) for transparent table/CF encryption. And the encryption performance would be accelerated by hardware in modern CPU (AES-NI). This feature could be enabled by updating the configuration "hbase.crypto.cipherprovider" to "org.apache.hadoop.hbase.io.crypto.CryptoCipherProvider" in hbase-site.xml. For detailed information about transparent table/CF encryption including configuration examples see the Security section of the HBase manual.

• Assignee: Dapeng Sun
• Reporter: Dapeng Sun
• Created: 22/Aug/16 05:28
• Updated: 24/Jun/22 18:30
• Resolved: 24/Oct/16 10:55

Description

Apache Commons Crypto (https://commons.apache.org/proper/commons-crypto/index.html) is a cryptographic library optimized with AES-NI.
HBASE-7544 introduces a framework for transparent encryption feature for protecting HFile and WAL data at rest. Currently JCE cipher is used bu default, the improvement will use Commons Crypto to accelerate the transparent encryption of HBase. new crypto provider with Commons CRYPTO will be provided for Transparent encryption.

Issue Links

• is related to: HBASE-16988 Document for improve transparent table/CF encryption with Commons Crypto
• relates to: HBASE-13506 AES-GCM cipher support where available
• relates to: HBASE-25304 Support AES-192 and AES-256 in DefaultCipherProvider
• relates to: HBASE-7544 Transparent table/CF encryption
• relates to: HADOOP-13635 Replace Hadoop Common crypto code with Apache Commons Crypto
• relates to: HBASE-16414 Improve performance for RPC encryption with Apache Common Crypto
• relates to: HBASE-13503 Encryption improvements umbrella