mccheah commented on issue #20: Encryption in Data Files URL: https://github.com/apache/incubator-iceberg/issues/20#issuecomment-443878166 One other way we could solve for both use cases would be as follows: ``` interface KeyManager { default String generateNewKeyName(String filePath) { return "iceberg-key-" + UUID.randomUUID(); } // Create a key for a single file. FileKey createFileKey(String keyName); // Decrypt a single file key byte[] decryptKey(KeyDescription key, byte[] encryptedKey); // Decrypt a list of keys List<byte[]> decryptKeys(KeyDescription key, List<byte[]> encryptedKeys); } ``` What this allows is for implementations that want to write their own key name derivation to do so. So for example the name could be derived from the path, but by default for the traditional KMS use case it is completely random. The key name generator could also be its own module / interface.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services
