[
https://issues.apache.org/jira/browse/HDDS-17096?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17096:
------------------------------
Description:
THREAT_MODEL.md does not say what a GDPR bucket (created with
{{--enforcegdpr}}) guarantees, so findings about it cannot be routed to a §8
property or a §9 non-property. The feature is a crypto-erasure aid: the Ozone
shell marks keys written into such a bucket with the GDPR flag, the client
encrypts them with a random per-key secret that the OM stores in the key
metadata (in a TDE bucket the key is encrypted with TDE instead), and on delete
the OM removes the secret (and, in a TDE bucket, the encrypted data key). It is
not encryption at rest; TDE is (§8 item 6).
Add a §9 entry stating this, including what it does not cover: the secret is
returned to readers of the key and has copies in the Ratis log and RocksDB
files until purged or compacted, in OM DB copies (checkpoints, Recon) and in OM
snapshots; stored blocks are not authenticated; keys written through the S3
Gateway or ofs/o3fs are not marked, so they are not GDPR encrypted.
was:
THREAT_MODEL.md does not say what a GDPR bucket (created with
{{--enforcegdpr}}) guarantees, so findings about it cannot be routed to a §8
property or a §9 non-property. The feature is a crypto-erasure aid: keys
written with the GDPR flag are encrypted with a random per-key secret that the
OM keeps in the key metadata and removes on delete. It is not encryption at
rest; TDE is (§8 item 6).
Add a §9 entry stating this, including what it does not cover: the secret is
visible to readers of the key and stays in the Ratis log, RocksDB files until
compaction and OM snapshots; stored blocks are not authenticated; keys written
through the S3 Gateway or ofs/o3fs are not encrypted.
> Document GDPR bucket guarantees in THREAT_MODEL.md
> --------------------------------------------------
>
> Key: HDDS-17096
> URL: https://issues.apache.org/jira/browse/HDDS-17096
> Project: Apache Ozone
> Issue Type: Task
> Components: documentation, Security
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> THREAT_MODEL.md does not say what a GDPR bucket (created with
> {{--enforcegdpr}}) guarantees, so findings about it cannot be routed to a §8
> property or a §9 non-property. The feature is a crypto-erasure aid: the Ozone
> shell marks keys written into such a bucket with the GDPR flag, the client
> encrypts them with a random per-key secret that the OM stores in the key
> metadata (in a TDE bucket the key is encrypted with TDE instead), and on
> delete the OM removes the secret (and, in a TDE bucket, the encrypted data
> key). It is not encryption at rest; TDE is (§8 item 6).
> Add a §9 entry stating this, including what it does not cover: the secret is
> returned to readers of the key and has copies in the Ratis log and RocksDB
> files until purged or compacted, in OM DB copies (checkpoints, Recon) and in
> OM snapshots; stored blocks are not authenticated; keys written through the
> S3 Gateway or ofs/o3fs are not marked, so they are not GDPR encrypted.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
