-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for a dedicated HMAC type in Transit. #16668
Conversation
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cool new functionality!
@@ -600,7 +601,7 @@ func generateKey(keyType string) (interface{}, error) { | |||
switch keyType { | |||
case "aes128-gcm96": | |||
return uuid.GenerateRandomBytes(16) | |||
case "aes256-gcm96": | |||
case "aes256-gcm96", "hmac": |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we want to actually generate 64 bytes for hmac?
My 2c., but since SHA-256 uses a 512-bit block (which I think is what HMAC is using under the covers, but it isn't clear from my quick glance) -- a 32-byte key would be padded with 32 bytes of zeros, I'd rather we use all the bits since we can.
I'm also generally interested in extensibility. Do you see us adding SHA-512? SHA-3? If so, where/how?
Definitely like this though!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could add hash function as a sub param. I think I like that rather than a plethora of distinct types.
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
This allows it to be used with BYOK. We also add a key_size parameter for
this type, since HMAC supports any sized key, though we limit it to 256-4096
bits.