[NIFI-12033] Add Processors Supporting age-encryption.org

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0-M1, 1.24.0
• Component/s: Extensions, Security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 10/Sep/23 01:27
• Updated: 21/Sep/23 19:50
• Resolved: 21/Sep/23 18:27

Description

The age-encryption.org/v1 specification provides a modern alternative to protocols such as OpenPGP for encrypting and decrypting files. The age specification uses ChaCha20-Poly1305 for authenticated encryption of file payloads, and supports asymmetric key pairs using the Curve25519 algorithm with Diffie-Hellman key exchange, known as X25519. The age X25519 recipient type represents public and private keys using a human-readable encoding named Bech32. The age command is available on all modern operating systems. These security and usability properties make it a better solution for file encryption use cases than current custom processing strategies in Processors such as EncryptContent.

The Jagged project provides an implementation of the age encryption specification for Java. New EncryptContentAge and DecryptContentAge Processors should be implemented that support the X25519 recipient type, with options for property-based or file-based keys. The age standard supports ASCII armored encoding, which is helpful for some use cases that cannot handle raw binary. The default file encoding setting should be binary for optimal size and performance characteristics.

Java 11 and 17 support ChaCha20-Poly1305 and X25519, but Java 8 requires another Security Provider, such as Bouncy Castle. Cryptographic algorithm support can be checked at runtime to support transparent fallback to Bouncy Castle. These new Processors should be functional on both the support branch and main branch to provide a migration path from other solutions.

Issue Links

• relates to: NIFI-12094 Remove EncryptContent and CryptographicHashAttribute Processors
• links to: GitHub Pull Request #7676