Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support storing initialization vector alongside ciphertext when using CipherCodec #2994

Open
tmccombs opened this issue Sep 26, 2024 · 1 comment
Labels
status: help-wanted An issue that a contributor can help us with type: feature A new feature

Comments

@tmccombs
Copy link

Feature Request

Is your feature request related to a problem? Please describe

Some encryption algorithms (for example AES/GCM) require an initialization vector that is unique for each message. The typical way to work this this is to store the IV alongside the ciphertext.

However, doing this with Lettuce is somewhat complicated since CipherCodec doesn't have native support for it.

I'd like CipherCodec (or possibly a subclass of it?) to support storing the IV as a prefix during encoding, and extracting the IV from the prefix when decoding.

Describe the solution you'd like

Add an API that would allow including the IV in the serialized value.

It could probably be implemented with something like:

In encodeValue, right before callin doWithCipher:

byte[] iv = cipher.getIV();
if (iv != null) {
  target.writeBytes(iv);
}

decoding is a little more complicated, since the IV is needed for initializing the Cipher.

Probably there would need to be a way for the CipherSupplier to specify the size of the IV nad for decrypting get access to that the bytes for the IV during creation.

Alternatively, add a field to the KeyDescriptor for the IV.

Describe alternatives you've considered

Encoding the IV in as part of the "name" of the KeyDescriptor. This is kind of awkward, and requires Base64 encoding the IV, or similar, which is a little wasteful.

Wrapping a CipherSupplier, so that I can write/read the IV myself. Which involves a fair amount of boilerplate.

Not using the CipherCodec, and encrypting/decrypting the data before passing it in.

@tishun tishun added type: feature A new feature for: team-attention An issue we need to discuss as a team to make progress labels Sep 27, 2024
@tishun tishun added status: help-wanted An issue that a contributor can help us with and removed for: team-attention An issue we need to discuss as a team to make progress labels Oct 18, 2024
@tishun
Copy link
Collaborator

tishun commented Oct 18, 2024

Seems like a reasonable improvement, but currently I can commit to implementing it in a specific timeline.
Meanwhile community contributions are welcome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: help-wanted An issue that a contributor can help us with type: feature A new feature
Projects
None yet
Development

No branches or pull requests

2 participants