[NIFI-3098] Investigate possible issues with cluster flow synchronization when encryption key has been migrated multiple times

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.1.0
• Component/s: Core Framework, Tools and Build
• Labels: cluster encryption migration security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 23/Nov/16 21:15
• Updated: 28/Nov/16 23:23

Description

YolandaMDavis encountered an issue when running a 3 node cluster and using the encrypt-config.sh tool to migrate the nifi.sensitive.props.key used to encrypt the flow.xml.gz contents more than once. Running the tool once was fine and the cluster started up without any issue. Stopping the cluster and running the tool again generated a pad block corrupted error, which almost always indicates that the cipher text is being decrypted by the wrong key.

She can offer more details, including the exact steps to reproduce, but I wanted to capture this issue (much of it documented on PR 1261) for further investigation.

Issue Links

• relates to: NIFI-3024 Encrypted configuration migrator should be able to update sensitive properties key and migrate flow.xml.gz