Method AesDecryptImpl

be/src/exprs/string-functions.cc:505–543

An entrypoint to perform AES decryption on a given expression string. GCM mode expects expression, key, AES mode and iv vector. CTR and CFB modes expect expression, key, AES mode and iv vector. ECB mode expects expression, key, AES mode. If 'mode' is NULL, a default mode will be chosen at runtime. If the mode passed by the user is not supported by Impala or by the OpenSSL library used internally

// block-by-block basis, where the previous ciphertext block is encrypted and then XORed
// with the plaintext to produce the next ciphertext block.
StringVal StringFunctions::AesDecryptImpl(FunctionContext* ctx, const StringVal& expr,
    const StringVal& key, const StringVal& mode, const StringVal& iv) {
  if (expr.is_null) {
    return StringVal::null();
  }
  EncryptionKey encryption_key;
  Status status = InitializeEncryptionKey(ctx, expr, key, mode, iv, false,
      &encryption_key);
  if (!status.ok()) {
    ctx->SetError(status.msg().msg().data());
    return StringVal::null();
  }
  int64_t len = expr.len;

  // Remove spaces and set value of gcm_tag in case of GCM mode
  if (encryption_key.IsGcmMode()) {
    if (len < AES_BLOCK_SIZE) {
      ctx->SetError("AES GCM input too short to contain a tag");
      return StringVal::null();
    }
    len -= AES_BLOCK_SIZE;
    encryption_key.SetGcmTag(expr.ptr + len);
  }

  StringVal result = StringVal(ctx, len);

  // Decrypt the input
  int64_t out_len = 0;
  status = encryption_key.Decrypt(expr.ptr, len, result.ptr, &out_len);
  if (!status.ok()) {
    ctx->SetError("AES decryption failed");
    return StringVal::null();
  }
  const int64_t len_diff = result.len - out_len;
  DCHECK(len_diff == 0 || (encryption_key.IsEcbMode() && 0 < len_diff &&
      len_diff <= AES_BLOCK_SIZE));
  result.len = out_len;
  return result;
}

// An entrypoint to perform AES encryption on a given expression string. In contrast
// to AesDecryptImpl(), it does not support ECB modes. For other details, see the