Mailing-List: contact commits-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cassandra.apache.org
Date: Wed, 23 Nov 2016 14:16:58 +0000 (UTC)
From: "Jason Brown (JIRA)" <jira@apache.org>
To: commits@cassandra.apache.org
Message-ID: <JIRA.12839540.1434977169000.350841.1479910618629@Atlassian.JIRA>
In-Reply-To: <JIRA.12839540.1434977169000@Atlassian.JIRA>
References: <JIRA.12839540.1434977169000@Atlassian.JIRA> <JIRA.12839540.1434977169495@arcas>
Subject: [jira] [Commented] (CASSANDRA-9633) Add ability to encrypt sstables
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Wed, 23 Nov 2016 14:17:00 -0000


    [ https://issues.apache.org/jira/browse/CASSANDRA-9633?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15690211#comment-15690211 ] 

Jason Brown commented on CASSANDRA-9633:
----------------------------------------

[~spodxx@gmail.com] It's already configurable for different key providers. {{CipherFactory}} create an instance of a {{KeyProvider}}, as configured via the yaml. The default {{KeyProvider}}, {{JKSKeyProvider}}, reads from a keystore, but it's pluggable and you could easily add in a Vault provider, as well. 

> Add ability to encrypt sstables
> -------------------------------
>
>                 Key: CASSANDRA-9633
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-9633
>             Project: Cassandra
>          Issue Type: New Feature
>            Reporter: Jason Brown
>            Assignee: Jason Brown
>              Labels: encryption, security, sstable
>             Fix For: 3.x
>
>
> Add option to allow encrypting of sstables.
> I have a version of this functionality built on cassandra 2.0 that piggy-backs on the existing sstable compression functionality and ICompressor interface (similar in nature to what DataStax Enterprise does). However, if we're adding the feature to the main OSS product, I'm not sure if we want to use the pluggable compression framework or if it's worth investigating a different path. I think there's a lot of upside in reusing the sstable compression scheme, but perhaps add a new component in cqlsh for table encryption and a corresponding field in CFMD.
> Encryption configuration in the yaml can use the same mechanism as CASSANDRA-6018 (which is currently pending internal review).


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)