mirror of https://github.com/minio/minio.git
ca6b4773ed
This change adds server-side-encryption support for HEAD, GET and PUT
operations. This PR only addresses single-part PUTs and GETs without
HTTP ranges.
Further this change adds the concept of reserved object metadata which is required
to make encrypted objects tamper-proof and provide API compatibility to AWS S3.
This PR adds the following reserved metadata entries:
- X-Minio-Internal-Server-Side-Encryption-Iv ('guarantees' tamper-proof property)
- X-Minio-Internal-Server-Side-Encryption-Kdf (makes Key-MAC computation negotiable in future)
- X-Minio-Internal-Server-Side-Encryption-Key-Mac (provides AWS S3 API compatibility)
The prefix `X-Minio_Internal` specifies an internal metadata entry which must not
send to clients. All client requests containing a metadata key starting with `X-Minio-Internal`
must also rejected. This is implemented by a generic-handler.
This PR implements SSE-C separated from client-side-encryption (CSE). This cannot decrypt
server-side-encrypted objects on the client-side. However, clients can encrypted the same object
with CSE and SSE-C.
This PR does not address:
- SSE-C Copy and Copy part
- SSE-C GET with HTTP ranges
- SSE-C multipart PUT
- SSE-C Gateway
Each point must be addressed in a separate PR.
Added to vendor dir:
- x/crypto/chacha20poly1305
- x/crypto/poly1305
- github.com/minio/sio
|
||
|---|---|---|
| .. | ||
| Azure | ||
| Sirupsen/logrus | ||
| cheggaaa/pb | ||
| davecgh/go-spew | ||
| dgrijalva/jwt-go | ||
| dustin/go-humanize | ||
| eapache | ||
| eclipse/paho.mqtt.golang | ||
| elazarl/go-bindata-assetfs | ||
| fatih | ||
| garyburd/redigo | ||
| go-ini/ini | ||
| go-sql-driver/mysql | ||
| gogo/protobuf | ||
| golang | ||
| googleapis/gax-go | ||
| gorilla | ||
| hashicorp/go-version | ||
| klauspost | ||
| lib/pq | ||
| mattn | ||
| minio | ||
| nats-io | ||
| pkg/profile | ||
| rs | ||
| satori/uuid | ||
| skyrings/skyring-common | ||
| streadway/amqp | ||
| tidwall | ||