[HDFS-9899] The implication of auth-conf is not followed in optimized HDFS data transfer encryption

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6.0
• Component/s: encryption
• Assignee: Unassigned
• Reporter: Haifeng Chen
• Due: 31/Mar/18
• Created: 04/Mar/16 03:45
• Updated: 31/Aug/17 23:38

Description

HDFS-6606 provided an optimized way of HDFS data transfer encryption. The optimized encryption is build on top of SASL wrap/unwrap when auth-conf is configured.

When user specifies auth-conf, he wants both integrity and confidential. While the current implementation of the optimization implements only confidential with AES/CTR and there is no integrity grantees, which means the implications of auth-conf were not strictly followed.

Issue Links

• duplicates: HDFS-9900 The implication of auth-conf is not followed in optimized HDFS data transfer encryption
• is related to: HDFS-6606 Optimize HDFS Encrypted Transport performance