US92112: Encrypt and Store adapter client-secret in ACS db #97

FrankGasparovic · 2017-03-11T01:08:52Z

No description provided.

sanjeevchopra

can you rebase from the branch which has the ConnectorService, so you can invoke the encryption/decryption ? or we can wait for that branch to merge to develop.

sanjeevchopra · 2017-03-11T01:31:49Z

service/src/main/java/com/ge/predix/acs/encryption/AcsEncryption.java

+            byte[] result = Bytes.concat(ivBytes, encrypted);
+
+            return Base64.encodeBase64String(result);
+        } catch (Exception ex) {


catch Throwable to be safe

pls remove the printStackTrace

log a error (excluding the encryption key)

Created custom exceptions based on the error and added log statements.

sanjeevchopra · 2017-03-11T01:32:19Z

service/src/main/java/com/ge/predix/acs/encryption/AcsEncryption.java

+
+    public String encrypt(final String value) {
+        try {
+            if (this.key.length() != 24) {


are there any other requirements on the key ?

Not that I know of. We are doing 192 bit encryption, the key just needs to have that number of bits and we should be good to go.

sanjeevchopra · 2017-03-11T01:33:07Z

service/src/main/java/com/ge/predix/acs/config/EncryptionConfig.java

+@Configuration
+public class EncryptionConfig {
+
+    @Value("${ENCRYPTION_KEY}")


wondering if we should use a obscure name for obfuscation

Obfuscation from who? If someone is able to see our environment variables in cf, they are already a privileged user.

sanjeevchopra · 2017-03-11T01:34:11Z

service/src/main/java/com/ge/predix/acs/encryption/AcsEncryption.java

+        }
+    }
+
+    public String decrypt(final String encrypted) {


comments from encrypt apply here as well

sanjeevchopra · 2017-03-11T01:39:59Z

service/src/main/java/com/ge/predix/acs/encryption/AcsEncryption.java

+            SecretKeySpec skeySpec = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+
+            Cipher cipher = Cipher.getInstance(ALGO);
+            cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);


can the key and cipher setup be done once in the constructor ?

Good call. Moved.

sanjeevchopra · 2017-03-11T01:41:43Z

service/src/main/java/com/ge/predix/acs/encryption/AcsEncryption.java

+
+import com.google.common.primitives.Bytes;
+
+public class AcsEncryption {


AESEncrypter ?

Went with Encryptor

sanjeevchopra · 2017-03-14T20:49:35Z

service/src/main/java/com/ge/predix/acs/encryption/Encryptor.java

@@ -0,0 +1,9 @@
+package com.ge.predix.acs.encryption;
+
+public interface Encryptor {


To make this generally usable, we could build this as a credential store interface. It has 2 functions storage and encryption/decryption. This service could be used as-is with audit or any other credential which ACS needs to store.

`public interface CredentialStore {

String encryptAndStore(String id, String key, String value); String findAndDecrypt(String id, String key, String encrypted);

}`

id - will be used for lookup and storage

key - for encryption/decryption OR authN token in case of vault)

discussed with Frank. Doesnt quite work because when using a store, you dont really have a 'encrypted value'. Probably best as 2 separate services - Encryptor and SecureStorage. You only need one or the other (Encryptor + regular storage OR SecureStorage)

sanjeevchopra · 2017-03-15T22:24:42Z

...ain/java/com/ge/predix/acs/attribute/connector/management/AttributeConnectorServiceImpl.java

+        Set<AttributeAdapterConnection> attributeAdapterConnections = new HashSet<>();
+        connector.getAdapters().parallelStream().forEach(a -> {
+            a.setUaaClientSecret(this.encryptor.encrypt(a.getUaaClientSecret()));
+            attributeAdapterConnections.add(a);


why do you need a new set of connections ? the secret is already updated by reference

pls make sure HashSet indeed supports parallel streams

code will read better if you rename a to adapterConnection

sanjeevchopra · 2017-03-15T22:26:46Z

...ain/java/com/ge/predix/acs/attribute/connector/management/AttributeConnectorServiceImpl.java

-        return this.connectorConverter.toConnector(zoneEntity.getResourceAttributeConnector());
+        AttributeConnector connector = this.connectorConverter.toConnector(zoneEntity.getResourceAttributeConnector());
+        if (null != connector) {
+            Set<AttributeAdapterConnection> attributeAdapterConnections = new HashSet<>();


same comments as upsert

sanjeevchopra · 2017-03-15T22:29:31Z

...a/com/ge/predix/acs/attribute/connector/management/dao/AttributeAdapterConnectionEntity.java

    private String adapterClientId;

-    @Transient
+    @Column(name = "adapter_client_secret", nullable = false, length = 128)


does the encryption algo produce a value of the same length ? Just making sure if 128 is the appropriate lenght

sanjeevchopra · 2017-03-15T22:51:24Z

service/src/main/java/com/ge/predix/acs/config/EncryptionConfig.java

+import com.ge.predix.acs.encryption.Encryptor;
+
+@Configuration
+public class EncryptionConfig {


Please remove this class and make Encryptor a spring bean.

Also AttributeAdatperConnectionEntity should have a transient getUaaClientSecret() which returns the decrypted secret

The persistent field can be renamed to something like getEncryptedUaaClientSecret() (the whole entity is changing to transient now based on our json change)

sanjeevchopra · 2017-03-15T23:06:04Z

service/src/main/java/com/ge/predix/acs/encryption/Encryptor.java

+            this.cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
+
+            byte[] encrypted = this.cipher.doFinal(value.getBytes());
+            byte[] result = Bytes.concat(ivBytes, encrypted);


there is limited value to concat'ing a salt here, given we our code is open source. If we keep it, pls add some comments to explain the steps here.

IV is required by CBC cipher mode. We could switch to using ECB instead and then IV will not be required. ECB is considered weaker than CBC since the same blocks of plain text encrypted with ECB result in the same encrypted blocks.

Frank, explained that this is useful to prevent against dictionary attacks. Lets keep it and add some comments here 👍

sanjeevchopra · 2017-03-15T23:07:50Z

service/src/test/java/com/ge/predix/acs/encryption/EncryptorTest.java

+    @Test
+    public void testEncryptCompleteFlow() {
+        Encryptor encryption = Encryptor.getInstance();
+        ReflectionTestUtils.setField(encryption, ENCRYPTION_KEY_VAR_NAME, "FooBarFooBarFooB");


Assert.asertNotEquals(encryption.encrypt(VALUE_TO_ENCRYPT), VALUE_TO_ENCRYPT)

sanjeevchopra · 2017-03-18T01:00:44Z

service/src/main/java/com/ge/predix/acs/encryption/Encryptor.java

+            this.cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
+
+            byte[] encrypted = this.cipher.doFinal(value.getBytes());
+            byte[] result = Bytes.concat(ivBytes, encrypted);


Frank, explained that this is useful to prevent against dictionary attacks. Lets keep it and add some comments here 👍

sanjeevchopra · 2017-03-18T01:18:06Z

service/src/main/java/com/ge/predix/acs/encryption/Encryptor.java

+
+    private String encryptionKey;
+
+    private static final Encryptor INSTANCE = new Encryptor();


I don't think this will work, because the object instance being created here will not be spring managed, and hence not receive the ENCRYPTION_KEY value from the env var. Is there a integration test for this yet ?

On 2nd thought the cleanest way to solve this would be to have AttributeConnectorService decrypt the client secret. Since it is spring managed, it can autowire the Encryptor to it. You could do the json serialization/des-ser there too.

I pushed a commit to make this change.

sanjeevchopra · 2017-03-18T02:25:05Z

I also pushed a commit with some refactoring on how to handle json serialization/de-ser' . If it looks better - please keep it. Tests are clean with this change.

Also - if you move the ser/de-ser to the service, the refactoring still applies - should be easily portable.

sanjeevchopra · 2017-03-18T06:16:28Z

This branch is ready to merge, imo.

sanjeevchopra · 2017-03-18T23:59:54Z

PR build passed for predix-cloud - https://predix1.jenkins.build.ge.com/job/Predix-Security/job/ACS/job/ACS-PullRequest/job/acs-integration-pullrequest/291/

(issue seems to be postgres resources - it cannot create 4 db instances at a time. I had to remove some db instances to allow the above build to go through and remove 'cf login' command from the jenkins job)

Filed https://gesoftware.service-now.com/nav_to.do?uri=incident.do?sys_id=3bc1cd164f25f600b3d87acd0210c7d5 for this

Signed-off-by: Sanjeev Chopra <[email protected]> Signed-off-by: Irina Epshteyn

sanjeevchopra suggested changes Mar 11, 2017

View reviewed changes

sanjeevchopra reviewed Mar 14, 2017

View reviewed changes

FrankGasparovic force-pushed the US92112 branch 4 times, most recently from a506d69 to 13189f0 Compare March 15, 2017 19:53

sanjeevchopra reviewed Mar 15, 2017

View reviewed changes

FrankGasparovic force-pushed the US92112 branch from 13189f0 to 3c6e36d Compare March 17, 2017 17:11

sanjeevchopra suggested changes Mar 18, 2017

View reviewed changes

sanjeevchopra self-assigned this Mar 18, 2017

Added Encryption of adapter credentials.

b781bec

Signed-off-by: Sanjeev Chopra <[email protected]> Signed-off-by: Irina Epshteyn

sanjeevchopra force-pushed the US92112 branch from 06ffee8 to b781bec Compare March 19, 2017 15:32

sanjeevchopra merged commit 8ae555d into develop Mar 19, 2017

anubhavi25 deleted the US92112 branch March 21, 2017 06:02


		import com.google.common.primitives.Bytes;

		public class AcsEncryption {

		@@ -0,0 +1,9 @@
		package com.ge.predix.acs.encryption;

		public interface Encryptor {


		private String encryptionKey;

		private static final Encryptor INSTANCE = new Encryptor();

US92112: Encrypt and Store adapter client-secret in ACS db #97

US92112: Encrypt and Store adapter client-secret in ACS db #97

Uh oh!

Conversation

FrankGasparovic commented Mar 11, 2017

Uh oh!

sanjeevchopra left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

irinaepshteyn Mar 17, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanjeevchopra Mar 18, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanjeevchopra Mar 18, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanjeevchopra Mar 18, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanjeevchopra commented Mar 18, 2017

Uh oh!

sanjeevchopra commented Mar 18, 2017

Uh oh!

sanjeevchopra commented Mar 18, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

irinaepshteyn Mar 17, 2017 •

edited

Loading

sanjeevchopra Mar 18, 2017 •

edited

Loading

sanjeevchopra Mar 18, 2017 •

edited

Loading

sanjeevchopra Mar 18, 2017 •

edited

Loading

sanjeevchopra commented Mar 18, 2017 •

edited

Loading