shangxinli opened a new pull request, #1071:
URL: https://github.com/apache/iceberg-cpp/pull/1071
Part of the envelope encryption stack for #988.
Adds `EncryptionManager`/`EncryptionManagerRegistry` (the pluggable manager
interface
and factory) and `StandardEncryptionManager`, the envelope encryption
manager compatible
with Java's `StandardEncryptionManager`:
- Table master key in the KMS, key encryption keys (KEKs) wrapped by the KMS
and rotated
every 730 days (NIST SP 800-57), manifest-list key metadata AES-GCM
encrypted by a KEK
with the KEK timestamp as AAD.
- Unwrapped KEKs are cached for one hour.
- Thread-safe: all mutable state is guarded by a single mutex.
Gated behind `ICEBERG_ENCRYPTION`, registered in CMakeLists.txt, with a new
`crypto_test`
target covering manifest-list key decryption against a Java-produced
fixture, key
registration/decryption round trips, KEK rotation, and unwrapped-key cache
expiry.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
