[
https://issues.apache.org/jira/browse/LUCENE-9379?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17353696#comment-17353696
]
Robert Muir commented on LUCENE-9379:
-------------------------------------
Your argument is even more uneducated, the "i can do better than encryption at
rest" argument. Get out of town!
Lucene depends on the OS page cache for performance. So if you want to encrypt
stuff, you need to use the operating system.
Also, encrypting storage is non-trivial, and this is a search engine project.
Every time someone makes a patch for this issue, its never a standard mode like
AES-XTS, it's always some insecure homemade garbage!
I'm standing by my decision. Creating more JIRA issues or making more arguments
won't help the situation.
> Directory based approach for index encryption
> ---------------------------------------------
>
> Key: LUCENE-9379
> URL: https://issues.apache.org/jira/browse/LUCENE-9379
> Project: Lucene - Core
> Issue Type: New Feature
> Reporter: Bruno Roustant
> Assignee: Bruno Roustant
> Priority: Major
> Time Spent: 2.5h
> Remaining Estimate: 0h
>
> +Important+: This Lucene Directory wrapper approach is to be considered only
> if an OS level encryption is not possible. OS level encryption better fits
> Lucene usage of OS cache, and thus is more performant.
> But there are some use-case where OS level encryption is not possible. This
> Jira issue was created to address those.
> ____________________________________________
>
> The goal is to provide optional encryption of the index, with a scope limited
> to an encryptable Lucene Directory wrapper.
> Encryption is at rest on disk, not in memory.
> This simple approach should fit any Codec as it would be orthogonal, without
> modifying APIs as much as possible.
> Use a standard encryption method. Limit perf/memory impact as much as
> possible.
> Determine how callers provide encryption keys. They must not be stored on
> disk.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
