[HDDS-7733] Symmetric Key For Ozone Token Signatures

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Fix Version/s: 1.4.0
• Component/s: Ozone Datanode, Ozone Manager, SCM
• Labels: ozone-performance pull-request-available
• Assignee: Duong
• Reporter: Duong
• Created: 06/Jan/23 01:44
• Updated: 18/Nov/24 08:51
• Resolved: 18/Nov/24 08:50

Description

Today, Ozone uses RSA to sign its issued tokens like block read/write tokens. This contributes significantly to Ozone Manager latency, i.e. > 80% of key read latency.

The absolute solution is to use symmetric keys algorithms, e.g. HmacSha256, to sign the tokens.

This Jira is the epic story of all the efforts to design and implement token signatures using symmetric key algorithms.

Design proposal: https://docs.google.com/document/d/1es32PId8XwDGONSRmp_NLvbSeALlf-fyXp0RJB5O3hg

Issue Links

• fixes: HDDS-7256 Revisit Ozone Block Token Design
• relates to: HDDS-8775 Cleanup unnecessary logic from CertificateClients after symmetric key based tokens
• relates to: HDDS-8829 Symmetric Keys for Delegation Tokens
• links to: GitHub Pull Request #4863
• mentioned in: Page Loading...

Sub-Tasks

• SCM: Implement symmetric SecretKeys lifescycle management: Resolved
• SCM: API for OM and Datanode to get secret keys: Resolved
• DN: Fetch symmetric secret keys from SCM to verify block tokens: Resolved
• OM and DN: Use symmetric secret keys to sign and verify tokens: Resolved
• Evaluate symmetric tokens performance: Resolved
• Integration test cases for block token: Resolved
• SCM: Authorize secret key APIs: Resolved
• Integrate secret keys to SCM snapshot: Resolved
• SecretKey related admin CLIs: Resolved
• Monitoring metrics around SecretKey.: Open
• OM perf with and without improvements: Resolved
• Update Ozone document for symmetric block token: Resolved
• Adapt TestBlockTokens to build with Hadoop 3.3: Resolved