Details
-
Sub-task
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
None
-
None
Description
Key Write Path (Encryption)
When a bucket metadata has gdprEnabled=true, we generate the GDPRSymmetricKey and add it to Key Metadata before we create the Key.
This ensures that key is encrypted before writing.
Key Read Path(Decryption)
While reading the Key, we check for gdprEnabled=true and they get the GDPRSymmetricKey based on secret/algorithm as fetched from Key Metadata.
Create a stream to decrypt the key and pass it on to client.
Test
Create Key in GDPR Enabled Bucket -> Read Key -> Verify content is as expected -> Update Key Metadata to remove the gdprEnabled flag -> Read Key -> Confirm the content is not as expected.
Attachments
Issue Links
- links to
