elastic/elasticsearch

Consistent errors for KeyStoreWrapper decryption with any security provider

Open

#57,132 opened on May 26, 2020

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Java (25,882 forks)batch import
:Core/Infra/Settings:Security/Security>enhancementTeam:Core/InfraTeam:Securityhelp wanted

Repository metrics

Stars
 (76,700 stars)
PR merge metrics
 (Avg merge 2d) (1,000 merged PRs in 30d)

Description

As identified in https://github.com/elastic/elasticsearch/pull/57050#issuecomment-633257786 , when using the BouncyCastle FIPS security provider, the decryption with a wrong password fails in non predictable ways. Sometimes the CipherInputStream doesn't throw an AEADBadTagException as expected but readFully fails to read the stream fully and thus we fail because of these unconsumed stream contents: https://github.com/elastic/elasticsearch/blob/c117c0cf0a2e1a497c83278cebb7a2da57c2f599/server/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java#L379

We should look at a) why this happens and b) figure out if there is a way to consistently catch Exceptions caused by invalid passwords for any security provider so that we can throw a relevant and useful error message for the users.

Contributor guide