[NIFI-8549] Upgrade MiNiFi default sensitive properties algorithm

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.16.0
• Component/s: MiNiFi
• Assignee: David Handermann
• Reporter: Andy LoPresto
• Created: 08/Jul/16 17:14
• Updated: 25/Jan/22 18:33
• Resolved: 25/Jan/22 18:33

Description

• Could we please change the default algorithm for protecting sensitive property values to something stronger than the current selection? I would open a Jira if necessary, but this is one of those things that is really better to do before the first release so users have a backward-compatible config.yml file moving forward. If we change it in a subsequent release, we will need to do significant migration hand-holding. My suggestion would be "PBEWITHSHA256AND256BITAES-CBC-BC” which is significantly stronger, but after trying a few BC options, I continue to get EncryptionExceptions even though I have the JCE unlimited cryptographic strength jurisdiction policy files installed, so this may be a 0.0.2 fix. Is BouncyCastle not enabled by default?

Issue Links

• links to: GitHub Pull Request #5687