[jira] [Created] (IGNITE-13583) Check current master key digest on key change request

["Amelchev Nikita (Jira)" <ji...@apache.org>]

Amelchev Nikita created IGNITE-13583:
----------------------------------------

             Summary: Check current master key digest on key change request
                 Key: IGNITE-13583
                 URL: https://issues.apache.org/jira/browse/IGNITE-13583
             Project: Ignite
          Issue Type: Bug
            Reporter: Amelchev Nikita
            Assignee: Amelchev Nikita


Need to check the current master key digest on the key change request. Concurrent key change produces unclear reject message in case:
1. The first thread creates a request but not send to the cluster.  A request contains an encrypted MK name.
2. The second thread performs MK change. The cluster set a new MK.
3. The first thread sends a request but the cluster can't decrypt MK name under the new MK. The change request will be rejected with the message:
{noformat}
class org.apache.ignite.IgniteException: Master key change was rejected [nodeId=00e9fe88-d0c3-430a-93f4-27341ee8a000]
	at org.apache.ignite.internal.managers.encryption.GridEncryptionManager.prepareMasterKeyChange(GridEncryptionManager.java:1044)
	at org.apache.ignite.internal.util.distributed.DistributedProcess.lambda$new$2(DistributedProcess.java:149)
	at org.apache.ignite.internal.managers.discovery.GridDiscoveryManager$4.onDiscovery0(GridDiscoveryManager.java:722)
	at org.apache.ignite.internal.managers.discovery.GridDiscoveryManager$4.lambda$onDiscovery$0(GridDiscoveryManager.java:531)
	at org.apache.ignite.internal.managers.discovery.GridDiscoveryManager$DiscoveryMessageNotifierWorker.body0(GridDiscoveryManager.java:2696)
	at org.apache.ignite.internal.managers.discovery.GridDiscoveryManager$DiscoveryMessageNotifierWorker.body(GridDiscoveryManager.java:2734)
	at org.apache.ignite.internal.util.worker.GridWorker.run(GridWorker.java:120)
	at java.lang.Thread.run(Thread.java:748)
Caused by: class org.apache.ignite.IgniteException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
	at org.apache.ignite.internal.managers.encryption.GridEncryptionManager.withMasterKeyChangeReadLock(GridEncryptionManager.java:1185)
	at org.apache.ignite.internal.managers.encryption.GridEncryptionManager.decryptKeyName(GridEncryptionManager.java:1251)
	at org.apache.ignite.internal.managers.encryption.GridEncryptionManager.prepareMasterKeyChange(GridEncryptionManager.java:1029)
	... 7 more
Caused by: class org.apache.ignite.spi.IgniteSpiException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
	at org.apache.ignite.spi.encryption.keystore.KeystoreEncryptionSpi.decrypt(KeystoreEncryptionSpi.java:209)
	at org.apache.ignite.spi.encryption.keystore.KeystoreEncryptionSpi.decryptKey(KeystoreEncryptionSpi.java:280)
	at org.apache.ignite.spi.encryption.keystore.KeystoreEncryptionSpi.decryptKey(KeystoreEncryptionSpi.java:64)
	at org.apache.ignite.internal.managers.encryption.GridEncryptionManager.lambda$decryptKeyName$10(GridEncryptionManager.java:1264)
	at org.apache.ignite.internal.managers.encryption.GridEncryptionManager.withMasterKeyChangeReadLock(GridEncryptionManager.java:1182)
	... 9 more
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
	at com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:975)
	at com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:1056)
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:853)
	at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)
	at javax.crypto.Cipher.doFinal(Cipher.java:2222)
	at org.apache.ignite.spi.encryption.keystore.KeystoreEncryptionSpi.decrypt(KeystoreEncryptionSpi.java:205)
	... 13 more
{noformat}




--
This message was sent by Atlassian Jira
(v8.3.4#803005)