Perform checksum on whole crypt block instead of data

XMLWordPrintableJSON

    • Storage Engines - Foundations
    • SE Foundations - 2026-01-30
    • 1

      The KEK provider calculates the checksum only on the data. We should be performing checksum on the whole crypt block, in case anything gets changed as part of the KEK header.

      Reference:

      /*
       * __disagg_set_crypt_header --
       *     Pack and byte-swap the crypt header information into the struct. Note: This function is not
       *     idempotent.
       */
      static void
      __disagg_set_crypt_header(WT_SESSION_IMPL *session, WT_CRYPT_KEYS *crypt)
      {
          WT_CRYPT_HEADER crypt_header;
      
          WT_CLEAR(crypt_header);
          WT_ASSERT(session, crypt->keys.data != NULL);
          /* Prepare the crypt header. */
          crypt_header.signature = WT_CRYPT_HEADER_SIGNATURE;
          crypt_header.version = WT_CRYPT_HEADER_VERSION;
          crypt_header.compatible_version = WT_CRYPT_HEADER_COMPATIBLE_VERSION;
          crypt_header.header_size = sizeof(WT_CRYPT_HEADER);
          crypt_header.crypt_size = (uint32_t)crypt->keys.size;
          crypt_header.checksum = __wt_checksum(crypt->keys.data, crypt->keys.size);
      
          __wt_crypt_header_byteswap(&crypt_header);
          memcpy(crypt->keys.mem, &crypt_header, sizeof(WT_CRYPT_HEADER));
          crypt->keys.data = crypt->keys.mem;
          crypt->keys.size += sizeof(WT_CRYPT_HEADER);
      }
      

            Assignee:
            Jie Chen
            Reporter:
            Jie Chen
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: