You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@avro.apache.org by "Orayani, Marylou" <mo...@hp.com> on 2013/10/24 19:31:32 UTC
SHA support
We are using Java avro in one of our products and found out that it only supports MD5 to generate the hash for protocol texts. We have customers who require FIPS which, in turn, require a hash algorithm stronger than MD5, i.e., SHA. My searches did not yield any requests for this in the past. It seems to me that it may be fairly straightforward to add this support, namely, modifying Protocol.java to add SHA support. Since we're only using Java, this is our focus. Does this sound right?
Marylou
RE: SHA support
Posted by "Orayani, Marylou" <mo...@hp.com>.
Looked at the places in the code that uses MD5. I can see the places where a different hash algorithm can be specified. However, the handshake schemas use a MD5 fixed field with a length of 16. Different hashing algorithms will yield different hash lengths, e.g., 20 bytes for SHA-1 (vs 16 bytes for MD5). This can certainly be changed but I do see 16 assumed elsewhere in the code (along with unit tests). Changing the handshake schemas will break compatibility with other implementations. Any suggestions on minimizing compatibility impact?
Marylou
-----Original Message-----
From: Orayani, Marylou
Sent: Friday, October 25, 2013 6:18 PM
To: dev@avro.apache.org
Subject: RE: SHA support
On that note, is there a configuration framework we can leverage so we can just specify the hash to use there?
Marylou
-----Original Message-----
From: Orayani, Marylou
Sent: Friday, October 25, 2013 4:04 PM
To: dev@avro.apache.org
Subject: RE: SHA support
That's what I figured after looking at the code. We'll take a stab at it and see how far we get.
Thanks,
Marylou
-----Original Message-----
From: Doug Cutting [mailto:cutting@apache.org]
Sent: Friday, October 25, 2013 3:47 PM
To: dev@avro.apache.org
Subject: Re: SHA support
On Thu, Oct 24, 2013 at 11:48 AM, Orayani, Marylou <mo...@hp.com> wrote:
> As I'm new to avro, how do I go about changing the handshake hash to SHA?
This is not a user-configurable option. One would need to find the places in the RPC code where MD5 is used and replace it with SHA, or, better yet, with code that uses a configuration to determine which hashing algorithm to use. If you need this feature then you should probably file an issue in Jira. If you're not a developer yourself, hopefully you can find someone to implement it.
https://cwiki.apache.org/confluence/display/AVRO/How+To+Contribute
Cheers,
Doug
RE: SHA support
Posted by "Orayani, Marylou" <mo...@hp.com>.
On that note, is there a configuration framework we can leverage so we can just specify the hash to use there?
Marylou
-----Original Message-----
From: Orayani, Marylou
Sent: Friday, October 25, 2013 4:04 PM
To: dev@avro.apache.org
Subject: RE: SHA support
That's what I figured after looking at the code. We'll take a stab at it and see how far we get.
Thanks,
Marylou
-----Original Message-----
From: Doug Cutting [mailto:cutting@apache.org]
Sent: Friday, October 25, 2013 3:47 PM
To: dev@avro.apache.org
Subject: Re: SHA support
On Thu, Oct 24, 2013 at 11:48 AM, Orayani, Marylou <mo...@hp.com> wrote:
> As I'm new to avro, how do I go about changing the handshake hash to SHA?
This is not a user-configurable option. One would need to find the places in the RPC code where MD5 is used and replace it with SHA, or, better yet, with code that uses a configuration to determine which hashing algorithm to use. If you need this feature then you should probably file an issue in Jira. If you're not a developer yourself, hopefully you can find someone to implement it.
https://cwiki.apache.org/confluence/display/AVRO/How+To+Contribute
Cheers,
Doug
RE: SHA support
Posted by "Orayani, Marylou" <mo...@hp.com>.
That's what I figured after looking at the code. We'll take a stab at it and see how far we get.
Thanks,
Marylou
-----Original Message-----
From: Doug Cutting [mailto:cutting@apache.org]
Sent: Friday, October 25, 2013 3:47 PM
To: dev@avro.apache.org
Subject: Re: SHA support
On Thu, Oct 24, 2013 at 11:48 AM, Orayani, Marylou <mo...@hp.com> wrote:
> As I'm new to avro, how do I go about changing the handshake hash to SHA?
This is not a user-configurable option. One would need to find the places in the RPC code where MD5 is used and replace it with SHA, or, better yet, with code that uses a configuration to determine which hashing algorithm to use. If you need this feature then you should probably file an issue in Jira. If you're not a developer yourself, hopefully you can find someone to implement it.
https://cwiki.apache.org/confluence/display/AVRO/How+To+Contribute
Cheers,
Doug
Re: SHA support
Posted by Doug Cutting <cu...@apache.org>.
On Thu, Oct 24, 2013 at 11:48 AM, Orayani, Marylou <mo...@hp.com> wrote:
> As I'm new to avro, how do I go about changing the handshake hash to SHA?
This is not a user-configurable option. One would need to find the
places in the RPC code where MD5 is used and replace it with SHA, or,
better yet, with code that uses a configuration to determine which
hashing algorithm to use. If you need this feature then you should
probably file an issue in Jira. If you're not a developer yourself,
hopefully you can find someone to implement it.
https://cwiki.apache.org/confluence/display/AVRO/How+To+Contribute
Cheers,
Doug
RE: SHA support
Posted by "Orayani, Marylou" <mo...@hp.com>.
As I'm new to avro, how do I go about changing the handshake hash to SHA?
Marylou
-----Original Message-----
From: Doug Cutting [mailto:cutting@apache.org]
Sent: Thursday, October 24, 2013 11:37 AM
To: dev@avro.apache.org
Subject: Re: SHA support
Avro's RPC handshake mechanism was designed so that clients and servers can in fact use different hashing algorithms. So if you change the handshake hashing to SHA in Java then you will not break compatibility with other implementations. You might reduce the efficiency somewhat, requiring an extra round-trip the first time a given server is contacted by a different client implementation.
Doug
On Thu, Oct 24, 2013 at 10:31 AM, Orayani, Marylou <mo...@hp.com> wrote:
> We are using Java avro in one of our products and found out that it only supports MD5 to generate the hash for protocol texts. We have customers who require FIPS which, in turn, require a hash algorithm stronger than MD5, i.e., SHA. My searches did not yield any requests for this in the past. It seems to me that it may be fairly straightforward to add this support, namely, modifying Protocol.java to add SHA support. Since we're only using Java, this is our focus. Does this sound right?
>
> Marylou
>
Re: SHA support
Posted by Doug Cutting <cu...@apache.org>.
Avro's RPC handshake mechanism was designed so that clients and
servers can in fact use different hashing algorithms. So if you
change the handshake hashing to SHA in Java then you will not break
compatibility with other implementations. You might reduce the
efficiency somewhat, requiring an extra round-trip the first time a
given server is contacted by a different client implementation.
Doug
On Thu, Oct 24, 2013 at 10:31 AM, Orayani, Marylou <mo...@hp.com> wrote:
> We are using Java avro in one of our products and found out that it only supports MD5 to generate the hash for protocol texts. We have customers who require FIPS which, in turn, require a hash algorithm stronger than MD5, i.e., SHA. My searches did not yield any requests for this in the past. It seems to me that it may be fairly straightforward to add this support, namely, modifying Protocol.java to add SHA support. Since we're only using Java, this is our focus. Does this sound right?
>
> Marylou
>