[GitHub] [inlong] luchunliang commented on a diff in pull request #4795: [INLONG-4790][SDK] Upgrade DES encryption decryption to AES

[GitBox <gi...@apache.org>]

luchunliang commented on code in PR #4795:
URL: https://github.com/apache/inlong/pull/4795#discussion_r909244176


##########
inlong-sdk/dataproxy-sdk/src/main/java/org/apache/inlong/sdk/dataproxy/codec/ProtocolEncoder.java:
##########
@@ -134,9 +135,9 @@ private ByteBuf constructBody(byte[] body, EncodeObject object,
                     }
                     EncryptInfo encryptInfo = encryptEntry.getRsaEncryptInfo();
                     endAttr = endAttr + "_userName=" + object.getUserName()
-                        + "&_encyVersion=" + encryptInfo.getVersion()
-                        + "&_encyDesKey=" + encryptInfo.getRsaEncryptedKey();
-                    body = EncryptUtil.desEncrypt(body, encryptInfo.getDesKey());
+                            + "&_encyVersion=" + encryptInfo.getVersion()
+                            + "&_encyAesKey=" + encryptInfo.getRsaEncryptedKey();
+                    body = EncryptUtil.aesEncrypt(body, encryptInfo.getDesKey());

Review Comment:
   It is not fit that getDesKey is a AES Key.
   body = EncryptUtil.aesEncrypt(body, encryptInfo.getDesKey());



##########
inlong-sdk/dataproxy-sdk/src/main/java/org/apache/inlong/sdk/dataproxy/codec/ProtocolEncoder.java:
##########
@@ -287,8 +288,8 @@ private ByteBuf writeToBuf5(EncodeObject object) {
                         EncryptInfo encryptInfo = encryptEntry.getRsaEncryptInfo();
                         msgAttrs = msgAttrs + "_userName=" + object.getUserName()
                                 + "&_encyVersion=" + encryptInfo.getVersion()
-                                + "&_encyDesKey=" + encryptInfo.getRsaEncryptedKey();
-                        body = EncryptUtil.desEncrypt(body, encryptInfo.getDesKey());
+                                + "&_encyAesKey=" + encryptInfo.getRsaEncryptedKey();
+                        body = EncryptUtil.aesEncrypt(body, encryptInfo.getDesKey());

Review Comment:
   It is not fit that getDesKey is a AES Key.
   body = EncryptUtil.aesEncrypt(body, encryptInfo.getDesKey());



##########
inlong-sdk/dataproxy-sdk/src/main/java/org/apache/inlong/sdk/dataproxy/example/UdpClientExample.java:
##########
@@ -92,6 +92,16 @@ public static void main(String[] args) {
         }
     }
 
+    public static String getRandomString(int length) {
+        StringBuffer sb = new StringBuffer();
+        String string = "i am bus test client!";
+        for (int i = 0; i < length; i++) {
+            int number = new Random().nextInt(string.length());
+            sb.append(string.charAt(number));
+        }
+        return sb.toString();
+    }
+

Review Comment:
   Class "Random" is not secure. Please use SecureRandom and different seed.
   
   Is getRandomString invalid code?



##########
inlong-sdk/dataproxy-sdk/src/main/java/org/apache/inlong/sdk/dataproxy/config/EncryptConfigEntry.java:
##########
@@ -99,20 +108,20 @@ public EncryptInfo getRsaEncryptInfo() {
         synchronized (this.lastUpdateTime) {
             if (visitTime == this.lastUpdateTime.get()) {
                 RSAPublicKey rsaKey = EncryptUtil.loadPublicKeyByText(pubKey);
-                this.desKey = EncryptUtil.generateDesKey();
+                this.aesKey = EncryptUtil.generateAesKey();
                 try {
-                    byte[] encryptedKey = EncryptUtil.rsaEncrypt(rsaKey, this.desKey);
+                    byte[] encryptedKey = EncryptUtil.rsaEncrypt(rsaKey, this.aesKey);
                     String tmpKey = Base64.encodeBase64String(encryptedKey);
                     rsaEncryptedKey = URLEncoder.encode(tmpKey, "utf8");
                     this.lastUpdateTime.set(System.currentTimeMillis());
-                    return new EncryptInfo(this.version, this.rsaEncryptedKey, this.desKey);
+                    return new EncryptInfo(this.version, this.rsaEncryptedKey, this.aesKey);

Review Comment:
   These codes is same with getRsaEncryptedKey.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org