hive-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Thejas M Nair (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HIVE-17226) Use strong hashing as security improvement
Date Mon, 11 Sep 2017 18:44:00 GMT

    [ https://issues.apache.org/jira/browse/HIVE-17226?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16161760#comment-16161760
] 

Thejas M Nair commented on HIVE-17226:
--------------------------------------

[~taoli-hwx]
Can you please split this into two jiras ? No. 1 seems like a candidate for backport to older
releases as well, while no. 2 seems like a better fit only for new releases.


> Use strong hashing as security improvement
> ------------------------------------------
>
>                 Key: HIVE-17226
>                 URL: https://issues.apache.org/jira/browse/HIVE-17226
>             Project: Hive
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Tao Li
>            Assignee: Tao Li
>         Attachments: HIVE-17226.1.patch
>
>
> There have been 2 places identified where weak hashing needs to be replaced by SHA256.
> 1. CookieSigner.java uses MessageDigest.getInstance("SHA"). Mostly SHA is mapped to SHA-1,
which is not secure enough according to today's standards. We should use SHA-256 instead.
> 2. GenericUDFMaskHash.java uses DigestUtils.md5Hex. MD5 is considered weak and should
be replaced by DigestUtils.sha256Hex.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message