You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@hive.apache.org by "rubenada (via GitHub)" <gi...@apache.org> on 2026/10/19 13:40:25 UTC

[PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

rubenada opened a new pull request, #6896:
URL: https://github.com/apache/hive/pull/6896

   <!--
   Thanks for sending a pull request!  Here are some tips for you:
     1. If this is your first time, please read our contributor guidelines: https://cwiki.apache.org/confluence/display/Hive/HowToContribute
     2. Ensure that you have created an issue on the Hive project JIRA: https://issues.apache.org/jira/projects/HIVE/summary
     3. Ensure you have added or run the appropriate tests for your PR: 
     4. If the PR is unfinished, add '[WIP]' in your PR title, e.g., '[WIP]HIVE-XXXXX:  Your PR title ...'.
     5. Be sure to keep the PR description updated to reflect all changes.
     6. Please write your PR title to summarize what this PR proposes.
     7. If possible, provide a concise example to reproduce the issue for a faster review.
   
   -->
   
   ### What changes were proposed in this pull request?
   <!--
   Please clarify what changes you are proposing. The purpose of this section is to outline the changes and how this PR fixes the issue. 
   If possible, please consider writing useful notes for better and faster reviews in your PR. See the examples below.
     1. If you refactor some codes with changing classes, showing the class hierarchy will help reviewers.
     2. If you fix some SQL features, you can provide some references of other DBMSes.
     3. If there is design documentation, please add the link.
     4. If there is a discussion in the mailing list, please add the link.
   -->
   Document mask_hash and aes_encrypt limitations: `mask_hash` is a deterministic, unsalted, unkeyed SHA-256/512 digest (so masked values remain joinable); `aes_encrypt`/`aes_decrypt` currently use AES/ECB/PKCS5Padding (no IV, no authentication) by default, for compatibility with existing ciphertexts and MySQL-style `AES_ENCRYPT`. These functions do not provide semantic security or resistance to dictionary/enumeration attacks (and Hive does not claim they do).
   
   ### Why are the changes needed?
   <!--
   Please clarify why the changes are needed. For instance,
     1. If you propose a new API, clarify the use case for a new API.
     2. If you fix a bug, you can clarify why it is a bug.
   -->
   Clarify the limitations of `mask_hash` and `aes_encrypt`.
   
   ### Does this PR introduce _any_ user-facing change?
   <!--
   Note that it means *any* user-facing change including all aspects such as the documentation fix.
   If yes, please clarify the previous behavior and the change this PR proposes - provide the console output, description, screenshot and/or a reproducible example to show the behavior difference if possible.
   If possible, please also clarify if this is a user-facing change compared to the released Hive versions or within the unreleased branches such as master.
   If no, write 'No'.
   -->
   No.
   
   ### How was this patch tested?
   <!--
   If tests were added, say they were added here. Please make sure to add some test cases that check the changes thoroughly including negative and positive cases if possible.
   If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future.
   If tests were not added, please describe why they were not added and/or why it was difficult to add.
   -->
   N/A


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6896:
URL: https://github.com/apache/hive/pull/6896#issuecomment-6271619328

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6896) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [1 New issue](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6896&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6896&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6896&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6896&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6896&metric=new_duplicated_lines_density&view=list)  
     
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6896)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326180020


##########
THREAT_MODEL.md:
##########
@@ -212,6 +212,15 @@ controls. *(maintainer — okumin)*
   (e.g. `hive.query.max.length`) and YARN resource pools, and — where stronger
   isolation than HS2 + YARN can provide is required — separate HS2 instances or
   separate Hadoop/YARN clusters. *(maintainer — okumin, §14 Q11)*
+- **Cryptographic strength of built-in masking / encryption UDFs.**
+  `mask_hash` is a deterministic, unsalted, unkeyed SHA-256/512 digest (so
+  masked values remain joinable); `aes_encrypt`/`aes_decrypt` currently use
+  AES/ECB/PKCS5Padding (no IV, no authentication) by default, for
+  compatibility with existing ciphertexts and MySQL-style `AES_ENCRYPT`. These
+  functions do not provide semantic security or resistance to
+  dictionary/enumeration attacks, and Hive does not claim they do. Choosing a
+  masking type appropriate to the data (e.g. nullify/redact for low-entropy
+  columns) is the policy author's responsibility.

Review Comment:
   ```suggestion
     columns) is the policy author's responsibility.  *(documented: GenericUDFMaskHash, GenericUDFAesEncrypt, GenericUDFAesDecrypt)*.
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326133802


##########
THREAT_MODEL.md:
##########
@@ -303,6 +312,10 @@ These are the dispositions the PMC has recorded; confirm and extend
   the operator has not configured the blacklist → `OUT-OF-MODEL:
   operator responsibility`, unless the report shows a
   *bypass* of a configured blacklist. *(maintainer — okumin.)*
+- **"`mask_hash` is invertible / `aes_encrypt` uses ECB / a built-in hash UDF
+  is weak."** By design — see §7. Valid only if the report shows a bypass of a
+  configured masking policy (e.g. reading the unmasked column), not the
+  inherent properties of the function. `BY-DESIGN`.

Review Comment:
   ```suggestion
     inherent properties of the function. `BY-DESIGN`. *(documented: GenericUDFMaskHash, GenericUDFAesEncrypt, GenericUDFAesDecrypt))*.
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "rubenada (via GitHub)" <gi...@apache.org>.
rubenada commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326325876


##########
ql/src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFAesDecrypt.java:
##########
@@ -31,6 +31,8 @@
     + "Key lengths of 128, 192 or 256 bits can be used. 192 and 256 bits keys can be used if "
     + "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files are installed. "
     + "If either argument is NULL or the key length is not one of the permitted values, the return value is NULL.\n"
+    + "Note: this function uses AES in ECB mode (AES/ECB/PKCS5Padding, MySQL-style) with no IV and no "

Review Comment:
   I run some tests, it seems Hive and MySQL agree only when MySQL's `block_encryption_mode` matches the key length. With MySQL's default mode, that means 16-byte keys; with MySQL's `block_encryption_mode = 'aes-192-ecb'` it means 24-byte keys; and with MySQL's `block_encryption_mode = 'aes-256-ecb'` it means 32-byte keys.
   
   This means that this code in Hive:
   ```
   select base64(aes_encrypt('ABC', '1234567890123456'));
   -- y6Ss+zCYObpCbgfWfyNWTw==
   
   select base64(aes_encrypt('ABC', '123456789012345678901234'));
   -- iSwHg+qOErVgUCj8EVEAmw==
   
   select base64(aes_encrypt('ABC', '12345678901234567890123456789012'));
   -- E1zl+pDv/GY4JLk254KAIQ==
   ```
   
   Would match this code in MySQL (tested on 8)
   ```
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '1234567890123456'));
   -- y6Ss+zCYObpCbgfWfyNWTw==
   
   SET SESSION block_encryption_mode = 'aes-192-ecb';
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '123456789012345678901234'));
   -- iSwHg+qOErVgUCj8EVEAmw==
   
   SET SESSION block_encryption_mode = 'aes-256-ecb';
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '12345678901234567890123456789012'));
   -- E1zl+pDv/GY4JLk254KAIQ==
   ```
   
   Any other combination, e.g. a 24-byte key using MySQL default mode, will mismatch:
   ```
   select base64(aes_encrypt('ABC', '123456789012345678901234'));
   -- Hive: iSwHg+qOErVgUCj8EVEAmw==
   -- MySql default: m4TQ3WlUBBJr8qqE/Fm7Sg== │
   ```
   
   Note that MySQL seems to accept keys of any length; whereas Hive returns NULL for anything other than 16, 24 or 32 bytes.
   
   That's why I chose "MySQL-style", instead of "MySQL compatible".
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4332015840


##########
ql/src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFAesDecrypt.java:
##########
@@ -31,6 +31,8 @@
     + "Key lengths of 128, 192 or 256 bits can be used. 192 and 256 bits keys can be used if "
     + "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files are installed. "
     + "If either argument is NULL or the key length is not one of the permitted values, the return value is NULL.\n"
+    + "Note: this function uses AES in ECB mode (AES/ECB/PKCS5Padding, MySQL-style) with no IV and no "

Review Comment:
   Sure. OK.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "rubenada (via GitHub)" <gi...@apache.org>.
rubenada commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326325876


##########
ql/src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFAesDecrypt.java:
##########
@@ -31,6 +31,8 @@
     + "Key lengths of 128, 192 or 256 bits can be used. 192 and 256 bits keys can be used if "
     + "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files are installed. "
     + "If either argument is NULL or the key length is not one of the permitted values, the return value is NULL.\n"
+    + "Note: this function uses AES in ECB mode (AES/ECB/PKCS5Padding, MySQL-style) with no IV and no "

Review Comment:
   I run some tests, it seems Hive and MySQL agree only when MySQL's `block_encryption_mode` matches the key length. With MySQL's default mode, that means 16-byte keys; with MySQL's `block_encryption_mode = 'aes-192-ecb'` it means 24-byte keys; and with MySQL's `block_encryption_mode = 'aes-256-ecb'` it means 32-byte keys.
   
   This means that this code in Hive:
   ```
   select base64(aes_encrypt('ABC', '1234567890123456'));
   -- y6Ss+zCYObpCbgfWfyNWTw==
   
   select base64(aes_encrypt('ABC', '123456789012345678901234'));
   -- iSwHg+qOErVgUCj8EVEAmw==
   
   select base64(aes_encrypt('ABC', '12345678901234567890123456789012'));
   -- E1zl+pDv/GY4JLk254KAIQ==
   ```
   
   Would match this code in MySQL (tested on 8)
   ```
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '1234567890123456'));
   -- y6Ss+zCYObpCbgfWfyNWTw==
   
   SET SESSION block_encryption_mode = 'aes-192-ecb';
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '123456789012345678901234'));
   -- iSwHg+qOErVgUCj8EVEAmw==
   
   SET SESSION block_encryption_mode = 'aes-256-ecb';
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '12345678901234567890123456789012'));
   -- E1zl+pDv/GY4JLk254KAIQ==
   ```
   
   Any other combination, e.g. a 24-byte key using MySQL default mode, will mismatch:
   ```
   select base64(aes_encrypt('ABC', '123456789012345678901234'));
   -- Hive: iSwHg+qOErVgUCj8EVEAmw==
   -- MySql default: m4TQ3WlUBBJr8qqE/Fm7Sg==
   ```
   
   Note that MySQL seems to accept keys of any length; whereas Hive returns NULL for anything other than 16, 24 or 32 bytes.
   
   That's why I chose "MySQL-style", instead of "MySQL compatible".
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin merged PR #6896:
URL: https://github.com/apache/hive/pull/6896


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6896:
URL: https://github.com/apache/hive/pull/6896#issuecomment-6313477575

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6896) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [1 New issue](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6896&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6896&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6896&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6896&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6896&metric=new_duplicated_lines_density&view=list)  
     
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6896)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "rubenada (via GitHub)" <gi...@apache.org>.
rubenada commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326325876


##########
ql/src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFAesDecrypt.java:
##########
@@ -31,6 +31,8 @@
     + "Key lengths of 128, 192 or 256 bits can be used. 192 and 256 bits keys can be used if "
     + "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files are installed. "
     + "If either argument is NULL or the key length is not one of the permitted values, the return value is NULL.\n"
+    + "Note: this function uses AES in ECB mode (AES/ECB/PKCS5Padding, MySQL-style) with no IV and no "

Review Comment:
   I run some tests, it seems Hive and MySQL agree only when MySQL's `block_encryption_mode` matches the key length. With MySQL's default mode, that means 16-byte keys; with MySQL's `block_encryption_mode = 'aes-192-ecb'` it means 24-byte keys; and with MySQL's `block_encryption_mode = 'aes-256-ecb'` it means 32-byte keys.
   
   This means that this code in Hive:
   ```
   select base64(aes_encrypt('ABC', '1234567890123456'));
   -- y6Ss+zCYObpCbgfWfyNWTw==
   
   select base64(aes_encrypt('ABC', '123456789012345678901234'));
   -- iSwHg+qOErVgUCj8EVEAmw==
   
   select base64(aes_encrypt('ABC', '12345678901234567890123456789012'));
   -- E1zl+pDv/GY4JLk254KAIQ==
   ```
   
   Would match this code in MySQL (tested on 8)
   ```
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '1234567890123456'));
   -- y6Ss+zCYObpCbgfWfyNWTw==
   
   SET SESSION block_encryption_mode = 'aes-192-ecb';
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '123456789012345678901234'));
   -- iSwHg+qOErVgUCj8EVEAmw==
   
   SET SESSION block_encryption_mode = 'aes-256-ecb';
   SELECT TO_BASE64(AES_ENCRYPT('ABC', '12345678901234567890123456789012'));
   -- E1zl+pDv/GY4JLk254KAIQ==
   ```
   
   Any other combination, e.g. a 24-byte key using MySQL default mode, will mismatch:
   ```
   select base64(aes_encrypt('ABC', '123456789012345678901234'));
   -- Hive: iSwHg+qOErVgUCj8EVEAmw==
   -- MySql default: m4TQ3WlUBBJr8qqE/Fm7Sg== │
   ```
   
   That's why I chose "MySQL-style", instead of "MySQL compatible".
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4325996516


##########
ql/src/java/org/apache/hadoop/hive/ql/udf/generic/GenericUDFAesDecrypt.java:
##########
@@ -31,6 +31,8 @@
     + "Key lengths of 128, 192 or 256 bits can be used. 192 and 256 bits keys can be used if "
     + "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files are installed. "
     + "If either argument is NULL or the key length is not one of the permitted values, the return value is NULL.\n"
+    + "Note: this function uses AES in ECB mode (AES/ECB/PKCS5Padding, MySQL-style) with no IV and no "

Review Comment:
   How compatible is this with MySQL?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on code in PR #6896:
URL: https://github.com/apache/hive/pull/6896#discussion_r4326180020


##########
THREAT_MODEL.md:
##########
@@ -212,6 +212,15 @@ controls. *(maintainer — okumin)*
   (e.g. `hive.query.max.length`) and YARN resource pools, and — where stronger
   isolation than HS2 + YARN can provide is required — separate HS2 instances or
   separate Hadoop/YARN clusters. *(maintainer — okumin, §14 Q11)*
+- **Cryptographic strength of built-in masking / encryption UDFs.**
+  `mask_hash` is a deterministic, unsalted, unkeyed SHA-256/512 digest (so
+  masked values remain joinable); `aes_encrypt`/`aes_decrypt` currently use
+  AES/ECB/PKCS5Padding (no IV, no authentication) by default, for
+  compatibility with existing ciphertexts and MySQL-style `AES_ENCRYPT`. These
+  functions do not provide semantic security or resistance to
+  dictionary/enumeration attacks, and Hive does not claim they do. Choosing a
+  masking type appropriate to the data (e.g. nullify/redact for low-entropy
+  columns) is the policy author's responsibility.

Review Comment:
   ```suggestion
     columns) is the policy author's responsibility.  *(documented: GenericUDFMaskHash, GenericUDFAesBase)*.
   ```



##########
THREAT_MODEL.md:
##########
@@ -303,6 +312,10 @@ These are the dispositions the PMC has recorded; confirm and extend
   the operator has not configured the blacklist → `OUT-OF-MODEL:
   operator responsibility`, unless the report shows a
   *bypass* of a configured blacklist. *(maintainer — okumin.)*
+- **"`mask_hash` is invertible / `aes_encrypt` uses ECB / a built-in hash UDF
+  is weak."** By design — see §7. Valid only if the report shows a bypass of a
+  configured masking policy (e.g. reading the unmasked column), not the
+  inherent properties of the function. `BY-DESIGN`.

Review Comment:
   ```suggestion
     inherent properties of the function. `BY-DESIGN`. *(documented: GenericUDFMaskHash, GenericUDFAesBase)*.
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

Re: [PR] HIVE-29970: Document mask_hash and aes_encrypt limitations [hive]

Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on PR #6896:
URL: https://github.com/apache/hive/pull/6896#issuecomment-6342821697

   @rubenada Merged. Thank you!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org