[NIFI-7125] Extend SecureHasher interface to provide implementation-specific "full hash output" string representation

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Affects Version/s: 1.11.1
• Component/s: Core Framework, Security
• Labels: hashing security
• Epic Link: Improve secure hasher architecture
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 10/Feb/20 23:24
• Updated: 03/Jan/24 03:04
• Resolved: 03/Jan/24 03:04

Description

The current SecureHasher interface only provides methods which output the "pure" hash of the input (in raw, hex, and Base64 encodings). There should be additional methods which provide the output in the "full" representation, including the algorithm indicator, cost parameters, and salt.

Example: $2a$10$ABCDEFGHIJKLMNOPQRSTUV$<pure hash output>

It may be sufficient to simply output the full string representation, or a new POJO datatype may be necessary. The benefit of such container should be weighed against the need for algorithm-specific containers in the event the fields are not sufficiently generic.

The interface should also provide a boolean matches(String input, String hash) method to determine if an existing input value matches a generated ("full") hash output.

Issue Links

• is depended upon by: NIFI-7122 Refactor existing KDF implementations to use SecureHasher interface