Add encryption mode support #18
Conversation
| @@ -25,13 +25,15 @@ socket activation is assumed. | |||
|
|
|||
| ### Required | |||
|
|
|||
| * `-command string`: the command to retrieve the key encryption key | |||
| * `--command string`: the command to retrieve the key encryption key | |||
There was a problem hiding this comment.
$ ./kms -help
Usage of ./kms:
-command string
the command to retrieve the key encryption key
-endpoint string
the listen address (ex. unix:///tmp/kms.sock)
-timeout duration
maximum time to cache KEK locally (default 1h0m0s)
Can you clarify the difference between single and double dash in this case?
There was a problem hiding this comment.
There is none (both do the same exact thing). I just really prefer -- (and it matches how kubectl, oc, etc print their flags).
There was a problem hiding this comment.
I can see if there is a simple way to override how the flags print so they have double dash.
|
AFAICS, the project won't compile in between the first and second commit. Commits should always compile (and pass tests). I think the first change should do this:
|
|
@npmccallum pretty sure you are just asking me to squash the first two commits. I purposefully did not do that because I wanted the git diffs to stay small. |
|
Except that the cost of doing that is having a bisect that can't work. That's a very high price for a file rename commit (which is not necessary in git). |
Signed-off-by: Monis Khan <[email protected]>
This change adds the ability to have different encryption modes. Currently only AES-CBC is supported, but this will make it simple to add new modes such as secretbox. The mode is configurable via a new homonymous command line flag. The mode specification is stored as a prefix with the encrypted data. It is validated during decryption. The format is: :ck:<mode_name>:<mode_version>: Thus for AES-CBC the value is: :ck:aescbc:v1: The mode version is reserved in case we need to make any backwards incompatible changes to how the encrypted data is stored. Signed-off-by: Monis Khan <[email protected]>
Signed-off-by: Monis Khan <[email protected]>
enj
force-pushed
the
enj/i/crypto_mode/12
branch
from
b6e4e9e to
3b67796
Compare
Fixes #12
Enables #1