[NIFI-1242] Password-based encryption is not compatible with OpenSSL

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.4.0
• Fix Version/s: 0.4.0
• Component/s: Extensions
• Labels: security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 02/Dec/15 20:40
• Updated: 05/Dec/15 01:11
• Resolved: 05/Dec/15 01:11

Description

Despite the algorithm names indicating compatibility with OpenSSL, the current password-based encryption processors cannot decrypt data that was encrypted with OpenSSL external to NiFi.

I will create a new OpenSSLPBEEncryptor implementation, a new EncryptionMethod, and wire the logic in EncryptContent to select the correct encryptor.

I have a more in-depth explanation of the issue at https://github.com/alopresto/opensslpbeencryptor/blob/master/blog.md, but the fix is done in a sandbox and will be moved into NiFi by morning 12/03/15.

Issue Links

• relates to: NIFI-1255 Evaluate JCE cryptography with PBE and limited strength cryptography
• relates to: NIFI-1257 Provide additional KDFs for EncryptContent
• relates to: NIFI-1259 Provide keyed symmetric encryption capability