[jira] [Updated] (HDDS-17096) Document GDPR bucket guarantees in THREAT_MODEL.md

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HDDS-17096?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated HDDS-17096:
----------------------------------
    Labels: pull-request-available  (was: )

> Document GDPR bucket guarantees in THREAT_MODEL.md
> --------------------------------------------------
>
>                 Key: HDDS-17096
>                 URL: https://issues.apache.org/jira/browse/HDDS-17096
>             Project: Apache Ozone
>          Issue Type: Task
>          Components: documentation, Security
>            Reporter: Siyao Meng
>            Assignee: Siyao Meng
>            Priority: Major
>              Labels: pull-request-available
>
> THREAT_MODEL.md does not say what a GDPR bucket (created with {{--enforcegdpr}}) guarantees, so findings about it cannot be routed to a §8 property or a §9 non-property. The feature is a crypto-erasure aid: the Ozone shell marks keys written into such a bucket with the GDPR flag, the client encrypts them with a random per-key secret that the OM stores in the key metadata (in a TDE bucket the key is encrypted with TDE instead), and on delete the OM removes the secret (and, in a TDE bucket, the encrypted data key). It is not encryption at rest; TDE is (§8 item 6).
> Add a §9 entry stating this, including what it does not cover: the secret is returned to readers of the key and has copies in the Ratis log and RocksDB files until purged or compacted, in OM DB copies (checkpoints, Recon) and in OM snapshots; stored blocks are not authenticated; keys written through the S3 Gateway or ofs/o3fs are not marked, so they are not GDPR encrypted.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org