[NIFI-7397] Detect encryption metadata attributes on incoming flowfile and use for decryption

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Component/s: Extensions, Security
• Labels: attribute encryption kdf security
• Assignee: David Handermann
• Reporter: Andy LoPresto
• Created: 24/Apr/20 18:07
• Updated: 02/May/23 15:36
• Resolved: 02/May/23 15:36

Description

After NIFI-3889 / NIFI-7122 / NIFI-7396 are complete, incoming flowfiles containing content encrypted by the EncryptContent processor will have encryption metadata in the attributes, which should allow arbitrary decryption from a variety of algorithms and KDFs rather than having a specific instance of the EncryptContent processor in decrypt mode for every possible encryption type. However, this will likely depend on the introduction of key management service (KMS) controller services for the processor to encapsulate key derivation & provision and allow for unique identifiers to reference those services & keys.

Issue Links

• depends upon: NIFI-7324 Introduce controller service for KDFs
• depends upon: NIFI-3889 EncryptContent processor should add encryption metadata as attributes
• depends upon: NIFI-7122 Refactor existing KDF implementations to use SecureHasher interface
• depends upon: NIFI-7396 Add encryption metadata attributes for PGP encryption
• is superceded by: NIFI-11022 Add Decrypt Processors Compatible with EncryptContent Encoding