minio

History

Andreas Auernhammer 871b450dbd crypto: add support for decrypting SSE-KMS metadata (#11415 ) This commit refactors the SSE implementation and add S3-compatible SSE-KMS context handling. SSE-KMS differs from SSE-S3 in two main aspects: 1. The client can request a particular key and specify a KMS context as part of the request. 2. The ETag of an SSE-KMS encrypted object is not the MD5 sum of the object content. This commit only focuses on the 1st aspect. A client can send an optional SSE context when using SSE-KMS. This context is remembered by the S3 server such that the client does not have to specify the context again (during multipart PUT / GET / HEAD ...). The crypto. context also includes the bucket/object name to prevent renaming objects at the backend. Now, AWS S3 behaves as following: - If the user does not provide a SSE-KMS context it does not store one - resp. does not include the SSE-KMS context header in the response (e.g. HEAD). - If the user specifies a SSE-KMS context without the bucket/object name then AWS stores the exact context the client provided but adds the bucket/object name internally. The response contains the KMS context without the bucket/object name. - If the user specifies a SSE-KMS context with the bucket/object name then AWS again stores the exact context provided by the client. The response contains the KMS context with the bucket/object name. This commit implements this behavior w.r.t. SSE-KMS. However, as of now, no such object can be created since the server rejects SSE-KMS encryption requests. This commit is one stepping stone for SSE-KMS support. Co-authored-by: Harshavardhana <harsha@minio.io>		4 years ago
..
config.go	discard empty endpoint in crypto kes	4 years ago
doc.go	Replace Minio refs in docs with MinIO and links (#7494 )	6 years ago
error.go	Add crypto context errors (#8740 )	5 years ago
header.go	refactor cmd/crypto code for SSE handling and parsing (#11045 )	4 years ago
header_test.go	refactor cmd/crypto code for SSE handling and parsing (#11045 )	4 years ago
help.go	add minio/keys KMS integration (#8631 )	5 years ago
json.go	crypto: Escape JSON text (#10794 )	4 years ago
kes.go	validate storage class across pools when setting config (#11320 )	4 years ago
key.go	Optimize decryptObjectInfo (#10726 )	4 years ago
key_test.go	Replace Minio refs in docs with MinIO and links (#7494 )	6 years ago
kms.go	crypto: Escape JSON text (#10794 )	4 years ago
kms_test.go	crypto: Escape JSON text (#10794 )	4 years ago
legacy.go	Add crypto context errors (#8740 )	5 years ago
metadata.go	crypto: add support for decrypting SSE-KMS metadata (#11415 )	4 years ago
metadata_test.go	crypto: add support for decrypting SSE-KMS metadata (#11415 )	4 years ago
parse.go	Add crypto context errors (#8740 )	5 years ago
parse_test.go	admin: new API for creating KMS master keys (#9982 )	4 years ago
retry.go	crypto: reduce retry delay when retrying KES requests (#10394 )	4 years ago
sse-c.go	refactor cmd/crypto code for SSE handling and parsing (#11045 )	4 years ago
sse-kms.go	crypto: add support for decrypting SSE-KMS metadata (#11415 )	4 years ago
sse-s3.go	crypto: add support for decrypting SSE-KMS metadata (#11415 )	4 years ago
sse.go	refactor cmd/crypto code for SSE handling and parsing (#11045 )	4 years ago
sse_test.go	Move etcd, logger, crypto into their own packages (#8366 )	5 years ago
vault.go	Optimize decryptObjectInfo (#10726 )	4 years ago
vault_test.go	Bring in safe mode support (#8478 )	5 years ago