[NIFI-8319] EncryptContent should support decrypting AES/CBC/NoPadding

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.13.0
• Fix Version/s: 1.14.0
• Component/s: Security
• Labels: encryption security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 12/Mar/21 21:23
• Updated: 17/Mar/21 21:41
• Resolved: 17/Mar/21 21:41

Description

The EncryptContent Processor current supports AES_CBC as an option for the Encryption Algorithm property. This option translates to the use of AES/CBC/PKCS7Padding as the cipher algorithm for encryption or decryption.

Supporting decryption using AES/CBC/NoPadding will allow integration with external systems requiring the use of that particular cipher algorithm. Encryption support for AES/CBC/NoPadding is not recommended due to potential padding vulnerabilities in AES-CBC as well as the requirement for padding input to match the required cipher block size.

Issue Links

• links to: GitHub Pull Request #4894