[NIFI-7669] Add flow protection key caching mechanism for derived keys

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.12.0
• Component/s: Configuration, Core Framework
• Labels: caching encryption kdf performance security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 24/Jul/20 02:22
• Updated: 29/Jul/20 07:43
• Resolved: 29/Jul/20 07:29

Description

The specific algorithm introduced in NIFI-7638 introduces a ~1 sec delay in every encryption operation (which occurs during every flow synchronization and serialization to disk) due to the Argon2 KDF process. This is an acceptable tradeoff for security-conscious users at this time, but can be improved through a key caching mechanism in memory. Deriving the key once at application startup and using it directly will remove this delay, and the key cannot change without an application restart.

Issue Links

• is related to: NIFI-7638 Add PBE AEAD sensitive flow property protection scheme
• is related to: NIFI-7668 Add configurable PBE AEAD algorithms to flow encryption
• links to: GitHub Pull Request #4435