Siyao Meng created HDDS-17096:
---------------------------------
Summary: Document GDPR bucket guarantees in THREAT_MODEL.md
Key: HDDS-17096
URL: https://issues.apache.org/jira/browse/HDDS-17096
Project: Apache Ozone
Issue Type: Task
Components: documentation, Security
Reporter: Siyao Meng
Assignee: Siyao Meng
THREAT_MODEL.md does not say what a GDPR bucket (created with
{{--enforcegdpr}}) guarantees, so findings about it cannot be routed to a §8
property or a §9 non-property. The feature is a crypto-erasure aid: keys
written with the GDPR flag are encrypted with a random per-key secret that the
OM keeps in the key metadata and removes on delete. It is not encryption at
rest; TDE is (§8 item 6).
Add a §9 entry stating this, including what it does not cover: the secret is
visible to readers of the key and stays in the Ratis log, RocksDB files until
compaction and OM snapshots; stored blocks are not authenticated; keys written
through the S3 Gateway or ofs/o3fs are not encrypted.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
