Skip to content

Conversation

@vikaskr22
Copy link
Contributor

What changes were proposed in this pull request?

In FIPS enabled env, saltSize is recalculated to be complaint with FIPS algorithm. This new saltSize was being calculated at runtime for MK encryption/decryption but configured saltSize ( or default) was being updated into the DB.

This PR contains code changes to fix this behaviour. With this PR, whatever saltSize calculated and used will be updated into the DB records. It gives clarity on the actual MK metadata and removes dependency to re-calculate the saltSize while decrypting the MK.

Earlier minSaltSize was kept fixed (at least 16 length) for FIPS algorithm, KMS has only one FIPS algorithm right now but with addition of other algorithms, this 16 might not be sufficient for any better/stronger algorithm. So it should be per algorithm. This PR handles this aspect as well.

How was this patch tested?

  • mvn clean install
  • Manual Testing with non-fips env in docker container
  • Manual testing with fips env in docker container. Here I tested fresh installation and upgrade scenario where re-encryption of MK happened from "PBEWithMD5AndDES" to "PBKDF2WithHmacSHA256"
  • Manually verified that DB MK record contains the actual saltSize.

Copy link
Contributor

@spolavarpau1 spolavarpau1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comment. Please check

@dhavalshah9131 dhavalshah9131 merged commit 4008d96 into apache:master Nov 5, 2025
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants