[NIFI-2961] Create EncryptAttribute processor

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.0.0
• Component/s: Extensions
• Labels: attributes encryption security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 27/Oct/16 22:33
• Updated: 10/Feb/22 16:06

Description

Similar to EncryptContent, the EncryptAttribute processor would allow individual (and multiple) flowfile attributes to be encrypted (either in-place or to a new attribute key) with various encryption algorithms (AES, RSA, PBE, and PGP).

Specific compatibility with the OpenSSL EVP_BytesToKey, PBKDF2, scrypt, and bcrypt key derivation functions should be included.

The processor should provide the boolean option to encrypt or decrypt (only one operation per instance of the processor). The processor should also allow Base64 encoding (aka ASCII armor) for the encrypted attributes to prevent byte escaping/data loss.

If dangerous processor annotations are introduced, this processor should be marked as such and the corresponding attribute protection (i.e. provenance before/after, etc.) should be applied.

Originally requested in this Stack Overflow question.

Issue Links

• relates to: NIFI-1885 Extend HashAttribute to provide multiple algorithms
• links to: GitHub Pull Request #1294