Specify rsa transform, aes & tag length

[saandrews]

Addressing issues mentioned in #838. Tested using a test program in C++ using openssl and verified encryption/decryption using RSA works both ways.

[merlimat]

👍

[massakam]

LGTM

[merlimat]

@saandrews There are 3 tests failing in Jenkins:

Test Result (3 failures / +3)

    org.apache.pulsar.client.api.SimpleProducerConsumerTest.testECDSAEncryption
    org.apache.pulsar.client.api.SimpleProducerConsumerTest.testEncryptionFailure
    org.apache.pulsar.client.api.SimpleProducerConsumerTest.testRSAEncryption

[saandrews]

This is because our build env does not have the JCE Unlimited Strength Jurisdiction Policy files. http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html. I'll dig further to see if we can install them in our environment.

[merlimat]

This is because our build env does not have the JCE Unlimited Strength Jurisdiction Policy files. http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html. I'll dig further to see if we can install them in our environment.

We should have it working out of the box with standard JDK and allow the better encryption if available.

[saandrews]

I see your point. But, if we do not enforce, a producer produced using 256 bit AES key and if consumer host does not have the unlimited policy files installed, it will fail to decrypt. This is true for RSA/ECDSA keys as well. I'm considering the following change to address this:

int aesKeyLength = javax.crypto.Cipher.getMaxAllowedKeyLength("AES");
if (aesKeyLength <= 128) {
    log.warn(
             "{} JCE Cryptographic strength is limited to {}. Consider installing JCE Unlimited Strength Jurisdiction Policy Files.",
             logCtx, aesKeyLength);
        keyGenerator.init(aesKeyLength, secureRandom);
    } else {
        keyGenerator.init(256, secureRandom);
    }

[saandrews]

retest this please

[saandrews]

retest this please