[SPARK-37666] Set `GCM` as the default mode in `aes_encrypt()`/`aes_decrypt()`

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.0
• Fix Version/s: 3.3.0
• Component/s: SQL
• Assignee: Max Gekk
• Reporter: Max Gekk
• Created: 16/Dec/21 19:14
• Updated: 10/Jan/22 19:26
• Resolved: 17/Dec/21 01:50

Description

Change the default mode from ECB to GCM in AES functions: aes_encrypt() and aes_decrypt(). GCM is much more preferable because it is semantically secure. Also the mode is used the default one in other systems like Snowflake, see https://docs.snowflake.com/en/sql-reference/functions/encrypt.html

Issue Links

• is caused by: SPARK-37591 Support the GCM mode by aes_encrypt()/aes_decrypt()
• is related to: SPARK-37858 Throw Spark exceptions from AES functions
• links to: [Github] Pull Request #34925 (MaxGekk)