From 72f99d632bb55ccfce037cb01e821c52318454d1 Mon Sep 17 00:00:00 2001 From: Gidon Gershinsky Date: Mon, 24 Aug 2026 08:45:14 +0300 Subject: [PATCH 1/4] inital commit --- .../parquet/crypto/keytools/FileKeyUnwrapper.java | 9 ++++++--- .../org/apache/parquet/crypto/keytools/KeyToolkit.java | 10 ++++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java index c3eb97875c..b4cd9e1aba 100644 --- a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java +++ b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java @@ -157,10 +157,13 @@ KeyToolkit.KmsClientAndDetails getKmsClientFromConfigOrKeyMaterial(KeyMaterial k String kmsInstanceURL = hadoopConfiguration.getTrimmed(KeyToolkit.KMS_INSTANCE_URL_PROPERTY_NAME); if (stringIsEmpty(kmsInstanceURL)) { - kmsInstanceURL = keyMaterial.getKmsInstanceURL(); + if (hadoopConfiguration.getBoolean(KeyToolkit.KMS_ENABLE_URL_READ_PROPERTY_NAME, + KeyToolkit.KMS_ENABLE_URL_READ_DEFAULT)) { + kmsInstanceURL = keyMaterial.getKmsInstanceURL(); + } + if (null == kmsInstanceURL) { - throw new ParquetCryptoRuntimeException( - "KMS instance URL is missing both in properties and file key material"); + kmsInstanceURL = KmsClient.KMS_INSTANCE_URL_DEFAULT; } } diff --git a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java index c53b65afbf..82a27b686e 100644 --- a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java +++ b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java @@ -52,6 +52,16 @@ public class KeyToolkit { * URL of the KMS instance. */ public static final String KMS_INSTANCE_URL_PROPERTY_NAME = "parquet.encryption.kms.instance.url"; + /** + * If KMS URL is set in writers, it will be stored in key metadata. However, by default it will not + * be given to readers, because the storage is untrusted. The readers that need the URL, should set + * the KMS URL property. If they can't do that, they can enable retrieving the KMS URL from stored metadata + * by setting this parameter to true. The KMS Client implementations must validate the URL value and + * use authentication in order to prevent metadata tampering attacks that would for example send a KMS + * access token to a malicious URL end point. + */ + public static final String KMS_ENABLE_URL_READ_PROPERTY_NAME = "parquet.encryption.kms.enable.url.read"; + public static final boolean KMS_ENABLE_URL_READ_DEFAULT = false; /** * Authorization token that will be passed to KMS. */ From 52546eaf3a86ae8dc21653933639979c80dcaf82 Mon Sep 17 00:00:00 2001 From: Gidon Gershinsky Date: Mon, 24 Aug 2026 08:56:24 +0300 Subject: [PATCH 2/4] spotless --- .../org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java | 4 ++-- .../java/org/apache/parquet/crypto/keytools/KeyToolkit.java | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java index b4cd9e1aba..b681187def 100644 --- a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java +++ b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java @@ -157,8 +157,8 @@ KeyToolkit.KmsClientAndDetails getKmsClientFromConfigOrKeyMaterial(KeyMaterial k String kmsInstanceURL = hadoopConfiguration.getTrimmed(KeyToolkit.KMS_INSTANCE_URL_PROPERTY_NAME); if (stringIsEmpty(kmsInstanceURL)) { - if (hadoopConfiguration.getBoolean(KeyToolkit.KMS_ENABLE_URL_READ_PROPERTY_NAME, - KeyToolkit.KMS_ENABLE_URL_READ_DEFAULT)) { + if (hadoopConfiguration.getBoolean( + KeyToolkit.KMS_ENABLE_URL_READ_PROPERTY_NAME, KeyToolkit.KMS_ENABLE_URL_READ_DEFAULT)) { kmsInstanceURL = keyMaterial.getKmsInstanceURL(); } diff --git a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java index 82a27b686e..3d7a3f64dc 100644 --- a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java +++ b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java @@ -61,6 +61,7 @@ public class KeyToolkit { * access token to a malicious URL end point. */ public static final String KMS_ENABLE_URL_READ_PROPERTY_NAME = "parquet.encryption.kms.enable.url.read"; + public static final boolean KMS_ENABLE_URL_READ_DEFAULT = false; /** * Authorization token that will be passed to KMS. From fcc6842117a493aa00fa7fb9f38549e1537dd9fb Mon Sep 17 00:00:00 2001 From: Gidon Gershinsky Date: Mon, 24 Aug 2026 09:25:54 +0300 Subject: [PATCH 3/4] update readme --- parquet-hadoop/README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/parquet-hadoop/README.md b/parquet-hadoop/README.md index 4826d49e23..c7e4ca8d67 100644 --- a/parquet-hadoop/README.md +++ b/parquet-hadoop/README.md @@ -469,6 +469,17 @@ If `false`, write files in encrypted footer mode, that fully encrypts the footer --- +**Property:** `parquet.encryption.kms.enable.url.read` +**Description:** If KMS URL is set in writers, it will be stored in key metadata. However, by default it will +not be given to readers, because the storage is untrusted. The readers that need the URL, should set the +KMS URL property. If they can't do that, they can enable retrieving the KMS URL from stored metadata by setting +this parameter to `true`. The KMS Client implementations must validate the URL value and use authentication in +order to prevent metadata tampering attacks that would for example result in sending a KMS access token to a +malicious URL end point. +**Default value:** `false` + +--- + **Property:** `parquet.encryption.key.access.token` **Description:** Authorization token that will be passed to KMS. **Default value:** `DEFAULT` From 33f8b2f45d1c9214d11929253abd1542a9c3ff04 Mon Sep 17 00:00:00 2001 From: Gidon Gershinsky Date: Mon, 24 Aug 2026 09:47:31 +0300 Subject: [PATCH 4/4] cleanup --- parquet-hadoop/README.md | 11 +++++------ .../apache/parquet/crypto/keytools/KeyToolkit.java | 12 ++++++------ 2 files changed, 11 insertions(+), 12 deletions(-) diff --git a/parquet-hadoop/README.md b/parquet-hadoop/README.md index c7e4ca8d67..51fd34b0c9 100644 --- a/parquet-hadoop/README.md +++ b/parquet-hadoop/README.md @@ -470,12 +470,11 @@ If `false`, write files in encrypted footer mode, that fully encrypts the footer --- **Property:** `parquet.encryption.kms.enable.url.read` -**Description:** If KMS URL is set in writers, it will be stored in key metadata. However, by default it will -not be given to readers, because the storage is untrusted. The readers that need the URL, should set the -KMS URL property. If they can't do that, they can enable retrieving the KMS URL from stored metadata by setting -this parameter to `true`. The KMS Client implementations must validate the URL value and use authentication in -order to prevent metadata tampering attacks that would for example result in sending a KMS access token to a -malicious URL end point. +**Description:** If a KMS URL is set by writers, it will be stored in the key material. However, by default, it will not be +given to readers because the storage is untrusted. Readers that need the URL should set the KMS URL property. +If they cannot do so, they can enable retrieving the KMS URL from the stored key material by setting this parameter +to `true`. KMS client implementations must validate the URL value and use authentication to prevent key material +tampering attacks that could, for example, result in a KMS access token being sent to a malicious URL endpoint. **Default value:** `false` --- diff --git a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java index 3d7a3f64dc..854976d37b 100644 --- a/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java +++ b/parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/KeyToolkit.java @@ -53,12 +53,12 @@ public class KeyToolkit { */ public static final String KMS_INSTANCE_URL_PROPERTY_NAME = "parquet.encryption.kms.instance.url"; /** - * If KMS URL is set in writers, it will be stored in key metadata. However, by default it will not - * be given to readers, because the storage is untrusted. The readers that need the URL, should set - * the KMS URL property. If they can't do that, they can enable retrieving the KMS URL from stored metadata - * by setting this parameter to true. The KMS Client implementations must validate the URL value and - * use authentication in order to prevent metadata tampering attacks that would for example send a KMS - * access token to a malicious URL end point. + * If a KMS URL is set by writers, it will be stored in the key material. However, by default, it will not be + * provided to readers because the storage is untrusted. Readers that need the URL should set the + * KMS URL property. If they cannot do so, they can enable retrieving the KMS URL from the stored material + * by setting this parameter to true. KMS client implementations must validate the URL value and + * use authentication to prevent key material tampering attacks, which could, for example, send a KMS + * access token to a malicious URL endpoint. */ public static final String KMS_ENABLE_URL_READ_PROPERTY_NAME = "parquet.encryption.kms.enable.url.read";