-
Type:
Task
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: Not Applicable
-
None
-
Storage Engines - Foundations
-
SE Foundations - 2026-01-30
-
1
The KEK provider calculates the checksum only on the data. We should be performing checksum on the whole crypt block, in case anything gets changed as part of the KEK header.
Reference:
/* * __disagg_set_crypt_header -- * Pack and byte-swap the crypt header information into the struct. Note: This function is not * idempotent. */ static void __disagg_set_crypt_header(WT_SESSION_IMPL *session, WT_CRYPT_KEYS *crypt) { WT_CRYPT_HEADER crypt_header; WT_CLEAR(crypt_header); WT_ASSERT(session, crypt->keys.data != NULL); /* Prepare the crypt header. */ crypt_header.signature = WT_CRYPT_HEADER_SIGNATURE; crypt_header.version = WT_CRYPT_HEADER_VERSION; crypt_header.compatible_version = WT_CRYPT_HEADER_COMPATIBLE_VERSION; crypt_header.header_size = sizeof(WT_CRYPT_HEADER); crypt_header.crypt_size = (uint32_t)crypt->keys.size; crypt_header.checksum = __wt_checksum(crypt->keys.data, crypt->keys.size); __wt_crypt_header_byteswap(&crypt_header); memcpy(crypt->keys.mem, &crypt_header, sizeof(WT_CRYPT_HEADER)); crypt->keys.data = crypt->keys.mem; crypt->keys.size += sizeof(WT_CRYPT_HEADER); }