Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-12033

Add Processors Supporting age-encryption.org

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 2.0.0-M1, 1.24.0
    • Extensions, Security
    • None

    Description

      The age-encryption.org/v1 specification provides a modern alternative to protocols such as OpenPGP for encrypting and decrypting files. The age specification uses ChaCha20-Poly1305 for authenticated encryption of file payloads, and supports asymmetric key pairs using the Curve25519 algorithm with Diffie-Hellman key exchange, known as X25519. The age X25519 recipient type represents public and private keys using a human-readable encoding named Bech32. The age command is available on all modern operating systems. These security and usability properties make it a better solution for file encryption use cases than current custom processing strategies in Processors such as EncryptContent.

      The Jagged project provides an implementation of the age encryption specification for Java. New EncryptContentAge and DecryptContentAge Processors should be implemented that support the X25519 recipient type, with options for property-based or file-based keys. The age standard supports ASCII armored encoding, which is helpful for some use cases that cannot handle raw binary. The default file encoding setting should be binary for optimal size and performance characteristics.

      Java 11 and 17 support ChaCha20-Poly1305 and X25519, but Java 8 requires another Security Provider, such as Bouncy Castle. Cryptographic algorithm support can be checked at runtime to support transparent fallback to Bouncy Castle. These new Processors should be functional on both the support branch and main branch to provide a migration path from other solutions.

      Attachments

        Issue Links

          Activity

            People

              exceptionfactory David Handermann
              exceptionfactory David Handermann
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 20m
                  20m