[NIFI-3929] Allow external key management for EncryptContent processor

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Component/s: Extensions
• Labels: encryption key-management security
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 17/May/17 16:02
• Updated: 20/Sep/23 01:21
• Resolved: 20/Sep/23 01:21

Description

Currently the EncryptContent processor (and a future EncryptAttribute processor) can only use a static key (or password-derived key) to encrypt/decrypt data. Similar to the KeyProvider interface used in the EncryptedWriteAheadProvenanceRepository that exposes multiple back-end implementations (StaticKeyProvider, FileBasedKeyProvider, etc.), a generic key management controller service is proposed in NIFI-3890, and this processor should add support for consuming the CS and using it to dynamically access provided keys for encryption/decryption operations.

Issue Links

• depends upon: NIFI-3890 Create Key Management Controller Service
• is related to: NIFI-12094 Remove EncryptContent and CryptographicHashAttribute Processors