KeyProvider (ORC Shims 1.6.6 API)
Date: 2021-01-13

org.apache.orc.impl

## Interface KeyProvider

-     public interface KeyProvider

  A source of crypto keys. This is usually backed by a Ranger KMS.

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Interface and Description
    --- | ---
    `static interface` | `KeyProvider.Factory` A service loader factory interface.

  - ### Method Summary

    All Methods Instance Methods Abstract Methods
    Modifier and Type | Method and Description
    --- | ---
    `LocalKey` | `createLocalKey(HadoopShims.KeyMetadata key)` Create a local key for the given key version.
    `Key` | `decryptLocalKey(HadoopShims.KeyMetadata key, byte[] encryptedKey)` Decrypt a local key for reading a file.
    `HadoopShims.KeyMetadata` | `getCurrentKeyVersion(String keyName)` Get the current metadata for a given key.
    `List<String>` | `getKeyNames()` Get the list of key names from the key provider.
    `HadoopShims.KeyProviderKind` | `getKind()` Get the kind of this provider.

- - ### Method Detail

    - #### getKeyNames

          List<String> getKeyNames()
                            throws IOException

      Get the list of key names from the key provider.
      Returns:
        a list of key names
      Throws:
        `IOException`

    - #### getCurrentKeyVersion

          HadoopShims.KeyMetadata getCurrentKeyVersion(String keyName)
                                                throws IOException

      Get the current metadata for a given key. This is used when encrypting new data.
      Parameters:
        `keyName` - the name of a key
      Returns:
        metadata for the current version of the key
      Throws:
        `IllegalArgumentException` - if the key is unknown
        `IOException`

    - #### createLocalKey

          LocalKey createLocalKey(HadoopShims.KeyMetadata key)
                           throws IOException

      Create a local key for the given key version. This local key will be randomly generated and encrypted with the given version of the master key. The encryption and decryption is done with the local key and the user process never has access to the master key, because it stays on the Ranger KMS.
      Parameters:
        `key` - the master key version
      Returns:
        the local key's material both encrypted and unencrypted
      Throws:
        `IOException`

    - #### decryptLocalKey

          Key decryptLocalKey(HadoopShims.KeyMetadata key,
                              byte[] encryptedKey)
                       throws IOException

      Decrypt a local key for reading a file.
      Parameters:
        `key` - the master key version
        `encryptedKey` - the encrypted key
      Returns:
        the decrypted local key's material or null if the key is not available
      Throws:
        `IOException`

    - #### getKind

          HadoopShims.KeyProviderKind getKind()

      Get the kind of this provider.

Copyright © 2013–2021 The Apache Software Foundation. All rights reserved.