[NIFI-7836] Add Encrypt and Decrypt CMS Processors and Services

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.12.0
• Component/s: Extensions
• Labels: cms encryption security smime x509
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 22/Sep/20 23:49
• Updated: 24/Jan/24 13:45
• Resolved: 24/Jan/24 13:45

Description

The purpose of this issue is to add new Processors and Controller Services supporting encryption and decryption using Cryptographic Message Syntax as defined in RFC 5652.

CMS provides the underlying specification for S/MIME messages and also supports encryption and decryption using X.509 certificates.  Standard Java Key Stores can be used to support encrypting messages for one or more recipients. Decrypting messages can also be supported based on matching certificate serial number and issuer attributes.

The current EncryptContent Processor supports encryption using passwords and PGP keys, but does not support encryption using X.509 certificates. New Processors for encryption and decryption would support encryption using X.509 certificates using CMS classes in the Bouncy Castle library.  New Controller Services would provide access to certificate and private key information from standard Java Key Stores.

Issue Links

• is related to: NIFI-3889 EncryptContent processor should add encryption metadata as attributes
• is related to: NIFI-5346 Allow EncryptContent processor to specify PGP key as processor property
• is related to: NIFI-5335 PGP processor cannot handle multiple passworded keys in a pgp keyring.
• is related to: NIFI-6708 Improve DSA/El Gamal PGP compatibility issues
• is related to: NIFI-7396 Add encryption metadata attributes for PGP encryption
• links to: GitHub Pull Request #4557