Function InitializeEncryptionKey

be/src/exprs/string-functions.cc:411–468

Initializes the EncryptionKey for AES Encryption/ Decryption by validating arguments.

// Initializes the EncryptionKey for AES Encryption/ Decryption by validating arguments.
Status InitializeEncryptionKey(FunctionContext* ctx, const StringVal& expr,
    const StringVal& key, const StringVal& mode, const StringVal& iv, bool is_encrypt,
    EncryptionKey* encryption_key) {
  if (key.is_null) {
    return Status(Substitute("Key cannot be NULL."));
  }
  if (key.len != 16 && key.len != 32) {
    return Status(Substitute("AES only supports 128 and 256 bit key lengths."));
  }
  AES_CIPHER_MODE cipher_mode;

  // If user passed a "NULL" field in mode, default AES encryption mode is chosen.
  if (mode.is_null) {
    cipher_mode = EncryptionKey::GetSupportedDefaultMode();
    bool* state = reinterpret_cast<bool*>(
        ctx->GetFunctionState(FunctionContext::THREAD_LOCAL));
    if (state == nullptr || *state == false) {
      VLOG_QUERY <<  "No AES mode was specified by user. Using " <<
          EncryptionKey::ModeToString(cipher_mode) << " mode as default.";
      if (state != nullptr) {
        *state = true;
      }
    }
  } else {
       cipher_mode = EncryptionKey::StringToMode
           (std::string_view(reinterpret_cast<const char*>(mode.ptr), mode.len));
  }

  if (cipher_mode == AES_CIPHER_MODE::INVALID) {
    return Status(Substitute("Invalid AES 'mode': $0", StringPiece
        (reinterpret_cast<const char*>(mode.ptr), mode.len)).c_str());
  }

  bool is_ecb = (cipher_mode == AES_CIPHER_MODE::AES_256_ECB
      || cipher_mode == AES_CIPHER_MODE::AES_128_ECB);

  // Check if iv is null in case of non ECB modes.
  if (!is_ecb && iv.is_null) {
    return Status(Substitute("IV vector required for $0 mode",
        EncryptionKey::ModeToString(cipher_mode)).c_str());
  }

  // Check if IV vector size is valid (<= AES_BLOCK_SIZE) in case of non ECB modes.
  if (!is_ecb && iv.len > AES_BLOCK_SIZE) {
    return Status(Substitute("IV vector size is greater than 16 bytes."));
  }

  // ECB mode is not supported for Encryption.
  if (is_encrypt && is_ecb) {
    return Status(Substitute("ECB mode is not supported for encryption."));
  }

  // Initialize key and IV.
  Status status = encryption_key->InitializeFields(key.ptr, key.len,
      iv.ptr, iv.len, cipher_mode);

  return status;
}