[MAPREDUCE-7189] Generating secrets for authenticating shuffle transfer is not Fedramp compliant

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: job submission
• Assignee: Gopi Krishnan Nambiar
• Reporter: Gopi Krishnan Nambiar
• Created: 01/Mar/19 20:04
• Updated: 07/Mar/19 17:42

Description

Currently, the mode of generating secrets for authenticating shuffle transfers is not Fedramp compliant. 

See https://github.com/apache/hadoop/blob/a49cb4465e6849a4346dcfa6f4a235d6fde917d3/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/JobSubmitter.java#L177 to see the relevant sections.

Specifically the HMAC/SHA1 algorithm does not have the requisite key length of at least 112 bits for Fedramp High compliance and the HMAC/SHA1 is not compliant and needs to be changed to SHA-256/HMAC instead,