diff --git a/hetu-docs/en/images/password-encryption-principal.PNG b/hetu-docs/en/images/password-encryption-principal.PNG old mode 100644 new mode 100755 index 13100bce8..f1bf51380 Binary files a/hetu-docs/en/images/password-encryption-principal.PNG and b/hetu-docs/en/images/password-encryption-principal.PNG differ diff --git a/hetu-docs/en/security/password-encryption.md b/hetu-docs/en/security/password-encryption.md old mode 100644 new mode 100755 index e3e7f261a..e5089f679 --- a/hetu-docs/en/security/password-encryption.md +++ b/hetu-docs/en/security/password-encryption.md @@ -1,73 +1,107 @@ - -Password Encryption -=================== - -Overview -------------------------- -openLooKeng manages configuration details in properties files of catalogs. These files may need to include values such as usernames, passwords and other strings, the password often required to be kept secret, that can't be stored as plaintext. -Here is a typical configuration file of a MySQL connector: -``` -connector.name=mysql -connection-url=jdbc:mysql://localhost:3306 -connection-user=root -connection-password=123456 -``` -openLooKeng can be configured to enable password encryption, these passwords will be encrypted. - -Principle -------------------------- -The asymmetric encryption algorithm (RSA) is used for encrypting password. - -![principle](../images/password-encryption-principal.PNG) - -* Private Key: for encryption, client can use private key to encrypt plaintext. -* Public Key: for decryption, server store the public key as a keystore file in [filesystem](../develop/filesystem.md), and server can use public key to decrypt the ciphertext. - -The user saves the secret key and gives the public key to openLooKeng to decrypt the encrypted ciphertext. - -The key suggested size of RSA is 3072 bits, the minimum is 2048 bits. - -Configuration -------------------------- - -To enable password encryption, you need add these properties in the `etc/config.properties` -``` -security.password.decryption-type=RSA -security.key.manager-type=keystore -security.key.keystore-password=my-keystore-pwd -security.key.store-file-path=/openlookeng/keystore/keystore.jks -``` - -| Property | Description | -| :-------------------------------- | :----------------------------------------------------------- | -| `security.password.decryption-type` | The type of password decryption. Should be set to `NONE` or `RSA`. | -| `security.key.manager-type=keystore` | The type of password encryption key storage. Should be set to `keystore`. | -| `security.key.keystore-password` | The password of keystore. | -| `security.key.store-file-path` | The [filesystem](../develop/filesystem.md) path of keystore file. | - -Use Case -------------------------- -### Case 1. Dynamic Catalog -A http request has the following shape (MySQL connector as an example): -``` -request: POST/PUT -header: 'X-Presto-User: admin' -form: ' - catalogInformation={ - "catalogName":"mysql", - "connectorName":"mysql", - "securityKey":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1Z4yap2cI1u6zg/R8vTcltOy8xxeOt/VG0xEArud+c5rI9h2kWy8Uo7hTFN/JapVDENT17fEzd+SqrlvcmD8ceDH07+OW2RRGcQjR0GKpKGSmubEHdH01xzpuQ1+m83B84Ir5eqcWx6QIwBPQsqqjeNpHhYdJLMpSrX1V+c7UUQIDAQAB", - "properties":{ - "connection-url":"jdbc:mysql://localhost:3306", - "connection-user":"root", - "connection-password":"iRSxl1KNY06d34JGLooey0re4akzr+iJlTz1eCK1hEq8aYaX1SlzANCF7KTq6o2cF71OjINGvNjR0DXRed6gu3QYODw1Src0wiY0OvO9xfcffVt2rFvM/o238MJz1yhIcPn1BrrEgW5qVjzbbvzkS/fX+pTDqKNGAd3qefDLCuc=", - "encrypted-properties":"connection-password", - } - } -' -``` -* `securityKey`: The public key. -* `connection-password`: The ciphertext encrypted with private key. -* `encrypted-properties`: The encrypted property names. - + +Password Encryption +=================== + +Overview +------------------------- +openLooKeng manages configuration details in properties files of catalogs. These files may need to include values such as usernames, passwords and other strings, the password often required to be kept secret, that can't be stored as plaintext. +Here is a typical configuration file of a MySQL connector: +``` +connector.name=mysql +connection-url=jdbc:mysql://localhost:3306 +connection-user=root +connection-password=123456 +``` +openLooKeng can be configured to enable password encryption, these passwords will be encrypted. + +Principle +------------------------- +The asymmetric encryption algorithm (RSA) is used for encrypting password. + +![principle](../images/password-encryption-principal.PNG) + +* Public Key: for encryption, client can use public key to encrypt plaintext. +* Private Key: for decryption, server store the private key as a keystore file in [filesystem](../develop/filesystem.md), and server can use private key to decrypt the ciphertext. + +The user saves the public key and gives the private key to openLooKeng to decrypt the encrypted ciphertext. + +The key suggested size of RSA is 3072 bits, the minimum is 2048 bits. + +Configuration +------------------------- + +To enable password encryption, you need add these properties in the `etc/config.properties` +``` +security.password.decryption-type=RSA +security.key.manager-type=keystore +security.key.keystore-password=my-keystore-pwd +security.key.store-file-path=/openlookeng/keystore/keystore.jks +``` + +| Property | Description | +| :-------------------------------- | :----------------------------------------------------------- | +| `security.password.decryption-type` | The type of password decryption. Should be set to `NONE` or `RSA`. | +| `security.key.manager-type=keystore` | The type of password encryption key storage. Should be set to `keystore`. | +| `security.key.keystore-password` | The password of keystore. | +| `security.key.cipher-transformations` | Cipher.getInstance(transformations), the default value is 'RSA/ECB/OAEPWITHSHA256AndMGF1Padding' | +| `security.key.store-file-path` | The [filesystem](../develop/filesystem.md) path of keystore file. | + +Use Case +------------------------- +### Case 1. Create RSA key pair +You can use keytool to create a keystore, and get Public Key from the keystore, and use openssl to encrypt data with Public Key. +And send the private key to openLooKeng server by restful api. + +``` +1. create a keystore, you have to use pkcs12: +keytool -genkeypair -alias alias -dname cn=openlookeng -validity 365 -keyalg RSA -keysize 2048 -keypass openlookeng -storetype jks -keystore keystore.jks -storepass openlookeng -deststoretype pkcs12 + +2. get Public Key from keystore, copy the public key into pub.key file: +keytool -list -rfc -keystore keystore.jks -storepass openlookeng | openssl x509 -inform pem -pubkey + +3. use openssl to encrypt data with RSA/ECB/OAEPWITHSHA256AndMGF1Padding by Public Key: +openssl pkeyutl -encrypt -in data.txt -out result.en -pubin -inkey pub.key -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:SHA256 -pkeyopt rsa_mgf1_md:SHA256 + +4. get readable encrypted data by base64: +cat result.en | base64 +after transfer the encrypted data by base64, you have to delete the '\n' from each line, and then you can get the final encrypted content. + +5. private key +keytool -v -importkeystore -srckeystore keystore.jks -srcstoretype jks -srcstorepass openlookeng -destkeystore server.pfx -deststoretype pkcs12 -deststorepass openlookeng -destkeypass openlookeng +openssl pkcs12 -in server.pfx -nocerts -nodes -out private.key + +the content of private.key is private key. + +6. import static catalog key pairs into keystore.jks (the keystore.jks is the value of security.key.store-file-path ) +Assume the name of the static catalog is mysql001, we get public key from keystoer001.jks (the alias must be the same as the name of static catalog) and encrypt the data. so we should import keystore001.jks into keystore.jks. +you can use these command bellow: +keytool -v -importkeystore -srckeystore keystore001.jks -srcstoretype jks -srcstorepass openlookeng -destkeystore server.p12 -deststoretype pkcs12 -deststorepass openlookeng -destkeypass openlookeng +keytool -importkeystore -deststorepass openlookeng -destkeystore keystore.jks -srckeystore server.p12 -srcstoretype pkcs12 -srcstorepass openlookeng -alias mysql001 + +``` + + +### Case 2. Dynamic Catalog +A http request has the following shape (MySQL connector as an example): +``` +request: POST/PUT +header: 'X-Presto-User: admin' +form: ' + catalogInformation={ + "catalogName":"mysql", + "connectorName":"mysql", + "securityKey":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1Z4yap2cI1u6zg/R8vTcltOy8xxeOt/VG0xEArud+c5rI9h2kWy8Uo7hTFN/JapVDENT17fEzd+SqrlvcmD8ceDH07+OW2RRGcQjR0GKpKGSmubEHdH01xzpuQ1+m83B84Ir5eqcWx6QIwBPQsqqjeNpHhYdJLMpSrX1V+c7UUQIDAQAB", + "properties":{ + "connection-url":"jdbc:mysql://localhost:3306", + "connection-user":"root", + "connection-password":"iRSxl1KNY06d34JGLooey0re4akzr+iJlTz1eCK1hEq8aYaX1SlzANCF7KTq6o2cF71OjINGvNjR0DXRed6gu3QYODw1Src0wiY0OvO9xfcffVt2rFvM/o238MJz1yhIcPn1BrrEgW5qVjzbbvzkS/fX+pTDqKNGAd3qefDLCuc=", + "encrypted-properties":"connection-password", + } + } +' +``` +* `securityKey`: The private key. +* `connection-password`: The ciphertext encrypted with private key. +* `encrypted-properties`: The encrypted property names. + Check [dynamic catalog](../admin/dynamic-catalog.md) for more information. \ No newline at end of file diff --git a/hetu-docs/zh/images/password-encryption-principal.PNG b/hetu-docs/zh/images/password-encryption-principal.PNG deleted file mode 100644 index 13100bce8..000000000 Binary files a/hetu-docs/zh/images/password-encryption-principal.PNG and /dev/null differ diff --git a/hetu-docs/zh/images/password-encryption-principal.png b/hetu-docs/zh/images/password-encryption-principal.png new file mode 100755 index 000000000..f1bf51380 Binary files /dev/null and b/hetu-docs/zh/images/password-encryption-principal.png differ diff --git a/hetu-docs/zh/security/password-encryption.md b/hetu-docs/zh/security/password-encryption.md old mode 100644 new mode 100755 index 0a2cdec12..4fca3bc7e --- a/hetu-docs/zh/security/password-encryption.md +++ b/hetu-docs/zh/security/password-encryption.md @@ -1,73 +1,110 @@ - -密码加密 -=================== - -概要 -------------------------- -openLooKeng 管理一些catalog相关的配置文件，这些配置文件可能包含一些用户名、密码等信息，其中，密码信息一般情况下要求保密，不能以明文的方式存储。 -这是一个典型的MySQL connector的配置文件： -``` -connector.name=mysql -connection-url=jdbc:mysql://localhost:3306 -connection-user=root -connection-password=123456 -``` -openLooKeng 可以开启密码加密功能，这些密码就可以被加密存储。 - -建议RSA Key的长度为3072 bit，最低2048 bit。 - -原理 -------------------------- -我们采用非对称加密算法 (RSA)，原理如下： - -![password-encryption-principle](../images/password-encryption-principal.PNG) - -* 私钥： 用于加密，客户端使用私钥对明文进行加密。 -* 公钥： 用户解密，服务端将公钥存储在[文件系统](../develop/filesystem.md )的keystore中，并使用公钥对密文进行解密。 - -用户自己保存秘钥，将公钥给openLooKeng用于加密后的密文解密。 - -配置 -------------------------- - -为了开启密码加密特性，你需要在 `etc/config.properties`增加以下属性： -``` -security.password.decryption-type=RSA -security.key.manager-type=keystore -security.key.keystore-password=my-keystore-pwd -security.key.store-file-path=/openlookeng/keystore/keystore.jks -``` - -| 属性 | 描述 | -| :-------------------------------- | :----------------------------------------------------------- | -| `security.password.decryption-type` | 密码加解密使用的加密算法. 必须是 `NONE` 或 `RSA`. | -| `security.key.manager-type=keystore` | 加密秘钥的存储方式. 必须是 `keystore`. | -| `security.key.keystore-password` | keystore的密码. | -| `security.key.store-file-path` | [文件系统](../develop/filesystem.md) 中keystore文件的路径. | - -用例 -------------------------- -### 用例 1. 动态目录 -一个http请求的模板如下 (以MySQL connector为例): -``` -request: POST/PUT -header: 'X-Presto-User: admin' -form: ' - catalogInformation={ - "catalogName":"mysql", - "connectorName":"mysql", - "securityKey":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1Z4yap2cI1u6zg/R8vTcltOy8xxeOt/VG0xEArud+c5rI9h2kWy8Uo7hTFN/JapVDENT17fEzd+SqrlvcmD8ceDH07+OW2RRGcQjR0GKpKGSmubEHdH01xzpuQ1+m83B84Ir5eqcWx6QIwBPQsqqjeNpHhYdJLMpSrX1V+c7UUQIDAQAB", - "properties":{ - "connection-url":"jdbc:mysql://localhost:3306", - "connection-user":"root", - "connection-password":"iRSxl1KNY06d34JGLooey0re4akzr+iJlTz1eCK1hEq8aYaX1SlzANCF7KTq6o2cF71OjINGvNjR0DXRed6gu3QYODw1Src0wiY0OvO9xfcffVt2rFvM/o238MJz1yhIcPn1BrrEgW5qVjzbbvzkS/fX+pTDqKNGAd3qefDLCuc=", - "encrypted-properties":"connection-password", - } - } -' -``` -* `securityKey`: 公钥. -* `connection-password`: 使用私钥加密后的密码密文. -* `encrypted-properties`: 加密的属性名称. - + +密码加密 +=================== + +概要 +------------------------- +openLooKeng 管理一些catalog相关的配置文件，这些配置文件可能包含一些用户名、密码等信息，其中，密码信息一般情况下要求保密，不能以明文的方式存储。 +这是一个典型的MySQL connector的配置文件： +``` +connector.name=mysql +connection-url=jdbc:mysql://localhost:3306 +connection-user=root +connection-password=123456 +``` +openLooKeng 可以开启密码加密功能，这些密码就可以被加密存储。 + +建议RSA Key的长度为3072 bit，最低2048 bit。 + +原理 +------------------------- +我们采用非对称加密算法 (RSA)，原理如下： + +![password-encryption-principle](../images/password-encryption-principal.png) + +* 公钥： 用于加密，客户端使用公钥对明文进行加密。 +* 私钥： 用户解密，服务端将私钥存储在[文件系统](../develop/filesystem.md )的keystore中，并使用私钥对密文进行解密。 + +用户自己保存公钥，将私钥给openLooKeng用于加密后的密文解密。 + +配置 +------------------------- + +为了开启密码加密特性，你需要在 `etc/config.properties`增加以下属性： +``` +security.password.decryption-type=RSA +security.key.manager-type=keystore +security.key.keystore-password=my-keystore-pwd +security.key.store-file-path=/openlookeng/keystore/keystore.jks +``` + +| 属性 | 描述 | +| :-------------------------------- | :----------------------------------------------------------- | +| `security.password.decryption-type` | 密码加解密使用的加密算法. 必须是 `NONE` 或 `RSA`. | +| `security.key.manager-type=keystore` | 加密秘钥的存储方式. 必须是 `keystore`. | +| `security.key.keystore-password` | keystore的密码. | +| `security.key.cipher-transformations` | Cipher.getInstance(transformations), the default value is 'RSA/ECB/OAEPWITHSHA256AndMGF1Padding' | +| `security.key.store-file-path` | [文件系统](../develop/filesystem.md) 中keystore文件的路径. | + +用例 +------------------------- +### 用例 1. 公私钥 + +采用keytool工具生产一个keystore文件，从keystore文件中提取公钥，通过openssl工具使用提取的公钥加密需要加密的明文。 +同时，从keystore中提取私钥，并通过restful api发送给openLooKeng服务。 + +以下是使用样例: +``` +1. 采用pkcs12格式创建keystore: +keytool -genkeypair -alias alias -dname cn=openlookeng -validity 365 -keyalg RSA -keysize 2048 -keypass openlookeng -storetype jks -keystore keystore.jks -storepass openlookeng -deststoretype pkcs12 + +2. 从keystore中提取公钥，并将公钥复制到pub.key文件中: +keytool -list -rfc -keystore keystore.jks -storepass openlookeng | openssl x509 -inform pem -pubkey + +3. openssl工具加密，data.txt为需要加密的内容，result.en为加密结果，pub.key为公钥: +openssl pkeyutl -encrypt -in data.txt -out result.en -pubin -inkey pub.key -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:SHA256 -pkeyopt rsa_mgf1_md:SHA256 + +4. result.en需要采用base64转换为可读字符串: +cat result.en | base64 + +注意： 获取到可读密文字符串后，需要手动删除每行的换行符'\n' 。 + +5. 提取私钥 +keytool -v -importkeystore -srckeystore keystore.jks -srcstoretype jks -srcstorepass openlookeng -destkeystore server.pfx -deststoretype pkcs12 -deststorepass openlookeng -destkeypass openlookeng +openssl pkcs12 -in server.pfx -nocerts -nodes -out private.key + +private.key的文件内容就是提取的私钥. + +6. 添加静态数据源的私钥到keystore.jks (keystore.jks为security.key.store-file-path指定路径的文件) +假设静态数据源的名字是mysql001，静态数据源加密用的公钥是从keystore001.jks文件中提取的，需要主要的keystore.jks文件的alias必须跟静态数据源的名称一致，即为mysql001。因此，需要将keystore001.jks文件中alias为mysql001的私钥存储到keystore.jks文件中。 +可以参照以下命令实现： +keytool -v -importkeystore -srckeystore keystore001.jks -srcstoretype jks -srcstorepass openlookeng -destkeystore server.p12 -deststoretype pkcs12 -deststorepass openlookeng -destkeypass openlookeng +keytool -importkeystore -deststorepass openlookeng -destkeystore keystore.jks -srckeystore server.p12 -srcstoretype pkcs12 -srcstorepass openlookeng -alias mysql001 + +``` + + +### 用例 2. 动态目录 +一个http请求的模板如下 (以MySQL connector为例): +``` +request: POST/PUT +header: 'X-Presto-User: admin' +form: ' + catalogInformation={ + "catalogName":"mysql", + "connectorName":"mysql", + "securityKey":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1Z4yap2cI1u6zg/R8vTcltOy8xxeOt/VG0xEArud+c5rI9h2kWy8Uo7hTFN/JapVDENT17fEzd+SqrlvcmD8ceDH07+OW2RRGcQjR0GKpKGSmubEHdH01xzpuQ1+m83B84Ir5eqcWx6QIwBPQsqqjeNpHhYdJLMpSrX1V+c7UUQIDAQAB", + "properties":{ + "connection-url":"jdbc:mysql://localhost:3306", + "connection-user":"root", + "connection-password":"iRSxl1KNY06d34JGLooey0re4akzr+iJlTz1eCK1hEq8aYaX1SlzANCF7KTq6o2cF71OjINGvNjR0DXRed6gu3QYODw1Src0wiY0OvO9xfcffVt2rFvM/o238MJz1yhIcPn1BrrEgW5qVjzbbvzkS/fX+pTDqKNGAd3qefDLCuc=", + "encrypted-properties":"connection-password", + } + } +' +``` +* `securityKey`: 私钥. +* `connection-password`: 使用私钥加密后的密码密文. +* `encrypted-properties`: 加密的属性名称. + 可以从 [动态目录](../admin/dynamic-catalog.md) 查看更多信息. \ No newline at end of file diff --git a/presto-main/src/main/java/io/prestosql/catalog/CatalogStoreUtil.java b/presto-main/src/main/java/io/prestosql/catalog/CatalogStoreUtil.java index 924780e9a..352c6220d 100644 --- a/presto-main/src/main/java/io/prestosql/catalog/CatalogStoreUtil.java +++ b/presto-main/src/main/java/io/prestosql/catalog/CatalogStoreUtil.java @@ -63,7 +63,7 @@ public class CatalogStoreUtil String cipherText = properties.get(propertyName); if (cipherText != null) { String plainText = cipherTextDecryptUtil.decrypt(decryptKeyName, cipherText); - properties.put(propertyName, plainText); + properties.put(propertyName, plainText.replaceAll("\n", "")); } }); } diff --git a/presto-main/src/main/java/io/prestosql/security/KeystoreSecurityKeyManager.java b/presto-main/src/main/java/io/prestosql/security/KeystoreSecurityKeyManager.java index 38b3ae007..99f2afbe1 100644 --- a/presto-main/src/main/java/io/prestosql/security/KeystoreSecurityKeyManager.java +++ b/presto-main/src/main/java/io/prestosql/security/KeystoreSecurityKeyManager.java @@ -37,11 +37,9 @@ import java.security.Key; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; -import java.security.PrivateKey; -import java.security.PublicKey; import java.security.UnrecoverableKeyException; -import java.security.cert.Certificate; import java.security.cert.CertificateException; +import java.security.interfaces.RSAPrivateKey; import java.util.Base64; import static java.lang.String.format; @@ -151,21 +149,14 @@ public class KeystoreSecurityKeyManager keyStore.load(inputStream, config.getKeystorePassword().toCharArray()); Key key = keyStore.getKey(catalogName, config.getKeystorePassword().toCharArray()); - if (key instanceof SecretKey) { - keyStr = new String(Base64.getDecoder().decode(key.getEncoded()), Charset.forName(UTF_8)).toCharArray(); - LOG.info("success to load key for catalog[%s]...", catalogName); - } - else if (key instanceof PrivateKey) { - Certificate certificate = keyStore.getCertificate(catalogName); - PublicKey publicKey = certificate.getPublicKey(); - keyStr = new String(Base64.getEncoder().encode(publicKey.getEncoded()), Charset.forName(UTF_8)).toCharArray(); - } - - if (key == null) { - Certificate certificate = keyStore.getCertificate(catalogName); - if (certificate != null) { - PublicKey publicKey = certificate.getPublicKey(); - keyStr = new String(Base64.getEncoder().encode(publicKey.getEncoded()), Charset.forName(UTF_8)).toCharArray(); + if (key != null) { + if (key instanceof SecretKey) { + keyStr = new String(Base64.getDecoder().decode(key.getEncoded()), Charset.forName(UTF_8)).toCharArray(); + LOG.info("success to load dynamic catalog key for catalog[%s]...", catalogName); + } + else if (key instanceof RSAPrivateKey) { + keyStr = new String(Base64.getEncoder().encode(key.getEncoded()), Charset.forName(UTF_8)).toCharArray(); + LOG.info("success to load static catalog key for catalog[%s]...", catalogName); } } } diff --git a/presto-main/src/main/java/io/prestosql/security/PasswordSecurityConfig.java b/presto-main/src/main/java/io/prestosql/security/PasswordSecurityConfig.java index 1d0561d73..c4b7c6dc2 100644 --- a/presto-main/src/main/java/io/prestosql/security/PasswordSecurityConfig.java +++ b/presto-main/src/main/java/io/prestosql/security/PasswordSecurityConfig.java @@ -93,7 +93,7 @@ public class PasswordSecurityConfig return rsaPadding; } - @Config("security.key.rsa-padding") + @Config("security.key.cipher-transformations") public void setRsaPadding(String rsaPadding) { this.rsaPadding = rsaPadding; diff --git a/presto-main/src/main/java/io/prestosql/security/RsaCipherTextDecrypt.java b/presto-main/src/main/java/io/prestosql/security/RsaCipherTextDecrypt.java index e89887d7a..8b8cde95c 100644 --- a/presto-main/src/main/java/io/prestosql/security/RsaCipherTextDecrypt.java +++ b/presto-main/src/main/java/io/prestosql/security/RsaCipherTextDecrypt.java @@ -29,8 +29,8 @@ import java.io.IOException; import java.nio.charset.Charset; import java.security.KeyFactory; import java.security.Security; -import java.security.interfaces.RSAPublicKey; -import java.security.spec.X509EncodedKeySpec; +import java.security.interfaces.RSAPrivateKey; +import java.security.spec.PKCS8EncodedKeySpec; import java.util.Base64; import static java.lang.String.format; @@ -58,20 +58,20 @@ public final class RsaCipherTextDecrypt { try { KeyFactory factory = KeyFactory.getInstance(RSA); - // decode base64 of public key + // decode base64 of private key char[] secretKey = keyManager.getKey(keyName); if (secretKey == null) { throw new RuntimeException(format("%s not exist.", keyName)); } byte[] key = Base64.getDecoder().decode(new String(secretKey)); - // generate the public key - X509EncodedKeySpec spec = new X509EncodedKeySpec(key); - RSAPublicKey publicKey = (RSAPublicKey) factory.generatePublic(spec); + // generate the private key + PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(key); + RSAPrivateKey privateKey = (RSAPrivateKey) factory.generatePrivate(pkcs8EncodedKeySpec); Cipher cipher = Cipher.getInstance(config.getRsaPadding(), BC_PROVIDER); - cipher.init(Cipher.DECRYPT_MODE, publicKey); + cipher.init(Cipher.DECRYPT_MODE, privateKey); // decode base64 of cipher text byte[] content = Base64.getDecoder().decode(cipherText); - int keySize = publicKey.getModulus().bitLength(); + int keySize = privateKey.getModulus().bitLength(); // decrypt cipher text return new String(rsaSplitCodec(cipher, content, keySize), CHARSET); } diff --git a/presto-main/src/test/java/io/prestosql/catalog/TestPasswordDecryption.java b/presto-main/src/test/java/io/prestosql/catalog/TestPasswordDecryption.java index f7177aff6..8b9b7ec8b 100644 --- a/presto-main/src/test/java/io/prestosql/catalog/TestPasswordDecryption.java +++ b/presto-main/src/test/java/io/prestosql/catalog/TestPasswordDecryption.java @@ -36,13 +36,13 @@ public class TestPasswordDecryption throws Exception { // save the key - String publicKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArEhOFoAk46GQzet7C/tmod5Sju91+dDl28TtuFXqOvSz5vvjuEkIK6NI411Lb11vF2P1a9J4ctcA3V3VvXk+H9IsW2jzuXZ774RaACNfMyslmHB+JOoPbTzUSVLyNfb3eSmEhkfYYUrKqlz4tvXUm5FJRX2Xh83yYX1FAnOpuMwzbwaMVLqb8k7LP2uI9+2dTTocE51K3SDH0KoFMyW/uSF9Jj9HLQ1rI9DxCH8UIf7SEwSZ0Pq42fxNW1qjjanYF5tHIp/5l2/O4LUNnZaMTISmT9m9lYt8FTudMtWCMNWarTk8JNkui4x7cSbmE5QaP+s994LK2umBXl95esUSsQIDAQAB"; + String privateKey = "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDE9YRkOjcXKPKxCTUfojpl3prOPgprGkibQc62V8CnvoL7wI3I8v+JAPn+3sLOl2rNN8ziQxW6eCThbvnIo0ID6i+FeNcv5DngPMLHnUkTPs8uTXsc055WaNhx/6YwQa6dlnmaiOhIPoLmHqmZYGrlwLB9O5qpW2wOeFnQ/JbdeeUPIMy0srFia+j/MklXwm+9hGG+Cn0h7EnzIR6rrCrkai4Axqma4pDWPCAOI1G34H2BntSjqMGifhyHS2U6QuO7MC8fsYSVMvkkk7F6dR3jhQpjd3dmPZeK2o8CRTrymLG86wgaqDbz/DCnZaSJuGmcWPTAfl5GNicwJ/MSMJO7AgMBAAECggEAJgkDuBdF7EMMGwQcLi+191Y1rv5sJKK+wrzCnpPzsHEp+lQFDXlfv6VgoceC90JmbZsJBejOmWP6O06jDgv5A6iF5NChPa5lPth9BO9q3TyT5e0wiTCUszssEVe9UDRe9C/K6/zkXo8z2Byzw9rKyfOcIZMRGwN8qo6zSZh9yecZVLesiE+d9nNJguypLQOnJlDH5U73qpWJHW0s2bZfNfgq3WPZGR5/pVXPd8MbQkNNdo71FMumCV6Xdu2kLkZVObDGg90bJmB4dzvH0grDB8HVeoQ3mkrQjRK3d5XW99SGaANNSqT1jeUXMBLBQONKhElqYNBOVXT9Hw7H2QGDgQKBgQDwynd1R13zvGFQgEZ6thwonXDkxTgmoyi9GIxMVsxQtbMJIo0211ndZ4ZCoeXm5DsTw7C+lzE/Bb+pkCuSUFbYpKnEOLOVgSKsaxKiV7NVr+i2rZgVZdTxPTwwDTekPUZo8ZMUX4ryNzjG02k9E/pNyq84iZJnlzlLoF3+cWzy7QKBgQDRZkzBQgqACLoChj1xjQAqcXklyhQZIkJXt4A5bwYvX8J0Xw8+ZTNn8lJo9g8TVcdmoTLJRRbYmWn2QHzOyf4YrjD44wj1KDfOrCYimShGDAcvNnxOSiZoVAZ90YHOGRgQjQIUdc9EWyHQUVuHGmJJn2tMrNWmTdQG2QO/ZLOERwKBgDV+xctob5cW4wffd8kLbHYZhFtO9Yqf9Q0Nxx2uqvXDaGM/KeBlN7HYrhtfnJQPYJCjiUDOlkJKJKqnPQbkkmbPLmhJsJwmdG2Z3Cn1EgKXcjwjlQYr+YMe96A1T4dNlbb69JIyJ8xoOFTz4w2Owq1Fumf1KHGbRz9mAXvl9y6BAoGBAM/JO5Dp/5FdF3c5ze7Hg8qaHyUoiRkHrd1s8YgMa47G7yaazX2U3pXfF3ef8wW0sNFeVA70x97XHRaGl1J7jfDfqSjP4SukZPxoRs8+O4CGnvpyjpcBbWtJNcfUBYKF1CNYSSAUZz/lToBwuuotfCqiTs8fEkKcKDFDVzysqJYxAoGBAMZny9cs/AZH33iZVedtHQZclcs1PJBMm8ZyTR9uSmDQYSeujO/5BFOQ5jNdpKEKxirm5ZNuPqDubbJW78aHpjRl/uUvmDZDY9fYbo9NVZXNn805RWT59zn1cAlRr629lHn7bbyXBVKDN9/z2fqaUkI7qj5Xbi/C+prVhJS15V2p"; String catalogName = "mysql001"; - securityKeyManager.saveKey(publicKey.toCharArray(), catalogName); + securityKeyManager.saveKey(privateKey.toCharArray(), catalogName); // set parameters - String connectionPasswordCipherText = "huOJCr35k6K2Dgn4InAMJHTyzGvcg+bgOvG+eUxcefML5jPBc3nWc4Wm0nedt1c6g/CKbQksUps/6KP1bcirdkBVwlfpmABwdfGMWuqAQLSUKyi4N1i0zexwDGRgTz0/FuTudlPFDF0XM3iJODB5XfStjxptBPGNAwnRxlmVYnxP2hXHxmY0wmFzk9ZbOj8fLM88dft5T03zBSnErftZ71MNyyskmksI+l9CVB7QDGEaMvhVDb9gSz1t8wTDrxlb0MTmJVl7n7Kw0B1MGmMqWKJA49YhfJJG8ZUPSMkrgTeIGwMqCDs1y2KOZORx5IXYdMJtL01td25OjcKenTuNwQ=="; - String sslPasswordCipherText = "cjLGNZadxWTIZTQRHkDeu4dBD79M4sKZ1fgWf39NvgBCiYflr/rvcUyCVlNQYV7WXFpl853bInMnzc+FaGk8039T+k7haK3uTk0o3itCAom2HtYcJzh3dhy8ZzsPLXsEldarYlTpFUbCNl3gepiZY98253Nn8J4n+eZidyfSGzecJC00Snfj6Ry7QiwqP90w5/CszMkAg97Ri0z28e5RN+xeM+wlXut2ap7hptpj5sbvJzaU9tjUJJZVxmkPdUk1jy48EpnG7YAtJftxLo6AcEaV7iK/7QaXOLGWUWeOAvGM4e8YIgJdxk8ptqvTAGw+9agRkKLP6Ujic+pPoHnnNA=="; + String connectionPasswordCipherText = "ov4otIMT9ZF9OU7NCTm+kie9GDAdxYiD+CGfROhzQfVXg7+clwyZ36wCONgFYOa/lDw6POLQGKbdsJzFn3SGfJPgEl/nvoseAjefXNBFGEppf+9bqMSRvw98SQJnhsogv5likU7MLeM8FzknNZBr0J6dtm7Y6pJMeWxJp7nJWFndJ2ba7NiRw7v8zsCt/VFMa3juCbpqyLhUBfUOMQI06k4O1HlYrdJL4g4EEmWuWg0HrIIb00SWrpBJb31jOSAy2FdKqW47t28z234uePBWz94hrTuWq/zdebbXVQBnFCaxCwLfdaJ//K8FCnrWoAOzzv9B5CRBcCbx2IF/4oyckQ=="; + String sslPasswordCipherText = "VDZK8r+u5BNw9Ihzomk0aHlSLuumDmSRq6asZjGiwsygnUbHBWQn4SsZd/oQ+9y4LefPCXx53Txz8H04tMzzd23+J4TYa+zc7PxHLkUwxTqR03dQTLlJVlDlc/dM7aEKapHZYSL3kzUWL1Qt0laocbx0hYpw0eF24J1QPpcEVv92MGy0WeqMwpdIu7FQbfhjixaY/Zsaz3V9mMM+RHjhgOnyMyx4MwrdEWCrJzTUz1wBaqt9LzO4rba5UD8VQM2K4fXpMrdBgHLSdZr5FQNisqiw1eEs/94pnAWWjlsRdlpwVDsN+niXvrJfyqKo3FC8DAhder+Ighxdluu3WSZORA=="; Map properties = new HashMap(); properties.put("connection-url", "jdbc:mysql://localhost:3306"); properties.put("connection-user", "root");