[S3 SSEC] S3 multitenancy: SSEC basic implementation

[Arsnael]

Allow to use https://help.ovhcloud.com/csm/en-public-cloud-storage-s3-encrypt-objects-sse-c?id=kb_article_view&sysparm_article=KB0047314 (client provided keys)

(Meaning we can either do AES james side OR do SSE-C OR do nothing)

Configuration blob.properties:

encryption.s3.sse.c.enable=true
encryption.s3.sse.c.master.key.algorithm=AES256
encryption.s3.sse.c.master.key.salt=XXXXXXXXXX
encryption.s3.sse.c.master.key.password=XXXXXXXXXX

Within blob-s3 maven project, reuse dependecy blob-aes and use PBKDF2StreamingAeadFactory to derive the new key.

Integration with the S3 driver is straight forward:

{
    "Version": "2012-10-17",
    "Id": "PutObjectPolicy",
    "Statement": [
        {
            "Sid": "RestrictSSECObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*",
            "Condition": {
                "Null": {
                    "s3:x-amz-server-side-encryption-customer-algorithm": "false"
                }
            }
        }
    ]
}   

DoD:

• [ ] Failure for partial configuration eg no salt/algo/password
• [ ] Unit tests for S3BlobStoreDAP in SSE mode
• [ ] A single integration test for SSE mode
• [ ] Documentation

[Arsnael]

Question: I think the salt here is simply the domain right? (for having something multitenancy like) Likely we don't need encryption.s3.sse.c.master.key.salt param then?

[quantranhong1999]

Question: I think the salt here is simply the domain right? (for having something multitenancy like) Likely we don't need encryption.s3.sse.c.master.key.salt param then?

From what I understand, the salt configuration is related to key derivation, and likely can be added in the other derivation tickets. Let's start simple without salt (use the same encryption key) first?

[chibenwa]

Basic implem generate key at startup and uses the same one everywhere.

As today AESBlobStoreDAO

Let's do better in a later ticket...

[hungphan227]

Still not understand what "encryption.s3.sse.c.master.key.password" is for

[chibenwa]

Derivation halgorithme takes a secret and a hash. That secret is currently called password.

[vttranlina]

My code lab for who quickly interesting https://github.com/vttranlina/james-project/tree/sseC_keyDerivation

[chibenwa]

Nice thanks!