kylin-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Shaofeng SHI (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (KYLIN-3356) Constant in SecretKeySpec
Date Fri, 14 Sep 2018 01:56:00 GMT

     [ https://issues.apache.org/jira/browse/KYLIN-3356?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Shaofeng SHI updated KYLIN-3356:
--------------------------------
         Priority: Minor  (was: Major)
    Fix Version/s: v2.6.0

> Constant in SecretKeySpec
> -------------------------
>
>                 Key: KYLIN-3356
>                 URL: https://issues.apache.org/jira/browse/KYLIN-3356
>             Project: Kylin
>          Issue Type: Improvement
>            Reporter: liyang
>            Priority: Minor
>             Fix For: v2.6.0
>
>
> Reported by Rumen Paletov <rumen.paletov@gmail.com>: 
>  As part of some research about the common crypto mistakes that developers
>  make <[https://cs.ucsb.edu/~chris/research/doc/ccs13_cryptolint.pdf]>, I
>  noticed that your application has one of them.
>  
>  In particular, there's a violation of Rule 3 in
>  org.apache.kylin.common.util.EncryptUtil
>  <[https://github.com/apache/kylin/blob/5552164ba09eba989b9ddccdf3f1e4f83ed0b799/core-common/src/main/java/org/apache/kylin/common/util/EncryptUtil.java#L36]>.
>  That is, SecretKeySpec is being initialized with a constant key
>  <[https://github.com/apache/kylin/blob/5552164ba09eba989b9ddccdf3f1e4f83ed0b799/core-common/src/main/java/org/apache/kylin/common/util/EncryptUtil.java#L30]>
>  instead of a randomly generated one.
>  
>  One solution would be to generate a key using SecureRandom:
>  
>  > byte[] key = new byte[16];
>  > new SecureRandom.nextBytes(key);
>  
>  



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message