Mailing-List: contact core-dev-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: core-dev@hadoop.apache.org
Received-SPF: pass (athena.apache.org: domain of amansk@gmail.com designates
 209.85.198.234 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=ZPZdp6X85t66QmvMoRJ0p6K//OUrq4jzwxqGw9MrMDZBGTJgFtL/FCpMbMPQfSLw9v
         A6jleAksc9rS7FWY7qCTrE8DYqcoCbHZYiLMIIHFMss+x2fmmmttS0wVJxanoZq88WMy
         wVdVxohb+Oe+CHh4BuxsrNLP1+VgI0czn8nPA=
MIME-Version: 1.0
In-Reply-To: <C5EFCD87.10354%kan@yahoo-inc.com>
References: <35a22e220903201447y15a2b901r41f59f5c7fcb9e23@mail.gmail.com>
	 <C5EFCD87.10354%kan@yahoo-inc.com>
Date: Wed, 25 Mar 2009 12:12:57 -0700
Message-ID: <35a22e220903251212p5622748dtc2eebe00947ea067@mail.gmail.com>
Subject: Re: Design for security in Hadoop
From: Amandeep Khurana <amansk@gmail.com>
To: core-dev@hadoop.apache.org
Content-Type: multipart/alternative; boundary=000e0cd147f29644880465f6490a

--000e0cd147f29644880465f6490a
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

>
>
> On 3/20/09 2:47 PM, "Amandeep Khurana" <amansk@gmail.com> wrote:
>
> >
> > 2. The Jira doesnt have cover the access control aspect of things. As a
> > client, I can skip talking to the NN and get blocks from the DN straight
> > away. There is no way to prevent it. This paper takes care of that aspect
> as
> > well.
> >
>
> Have you looked at HADOOP-4359? In that JIRA, we discussed the idea of
> using
> public-key signed capabilities and dismissed it in favor of symmetric-key
> based capabilities. That said, you're welcome to explore the public-key
> idea
> further.


Yes, I read through that. The issue with that approach is that the moment a
single DN gets compromised somehow (which isnt a big deal in a big system
containing 1000s of nodes), the symmetric key gets exposed and the entire
system is compromised. The whole idea of asymmetric key crypto is to allow
only a single authorized prinicipal to sign stuff.


> Kan
>
>

--000e0cd147f29644880465f6490a--