RANGER-5388: Actual calculated salt size should be updated into the DB #721
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
In FIPS enabled env, saltSize is recalculated to be complaint with FIPS algorithm. This new saltSize was being calculated at runtime for MK encryption/decryption but configured saltSize ( or default) was being updated into the DB.
This PR contains code changes to fix this behaviour. With this PR, whatever saltSize calculated and used will be updated into the DB records. It gives clarity on the actual MK metadata and removes dependency to re-calculate the saltSize while decrypting the MK.
Earlier minSaltSize was kept fixed (at least 16 length) for FIPS algorithm, KMS has only one FIPS algorithm right now but with addition of other algorithms, this 16 might not be sufficient for any better/stronger algorithm. So it should be per algorithm. This PR handles this aspect as well.
How was this patch tested?