https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/MDSAL-680 mdsal <p>Dear colleague,</p> <p>I would like to understand the encryption mechanism to store node data (login password) stated in netconf-node-topology.yang file.</p> <p>In below section from netconf-node-topology.yang, I see that if login-pw is selected, login credentials are encrypted.</p> <p>case login-pw {</p> <p>          description "login-password credentials, encrypted.";</p> <p>          container login-password </p> {                       uses username-password;            } <p>}</p> <p>If a node creation request with below content returns "200 OK" does this guarantee that credentials are encrypted in persistent configuration datastore? Is there a way to verify that they are stored encrypted? If so, which encryption mechanism is used?</p> <p>request body:</p> <p>{</p> <p>  "node": {</p> <p>             "node-id": "test",</p> <p>              "host": "192.168.111.111",</p> <p>              "port": 2022,</p> <p>              "tcp-only": false,</p> <p>              "login-pw:login-password" :</p> {                            "username": "admin",                            "password": "admin"                 } <p>      }</p> <p>}</p> <p> </p> <p>Thanks.</p> MDSAL-680

Node credential storage encryption

Bug Medium Resolved Done Oleksandr Panasiuk ercan-101@hotmail.com Tue, 27 Jul 2021 13:10:52 +0000 Thu, 13 Oct 2022 08:55:46 +0000 Thu, 13 Oct 2022 08:55:46 +0000 0 4 <p>Hi,</p> <p> </p> <p>I have the same concern, GET /restconf/config/network-topology:network-topology/topology/topology-netconf/node/&lt;nodename&gt; returns the password in clear text unencrypted.</p> <p>I tried a PUT request with netconf-node-topology:password and netconf-node-topology:login-password.</p> <p> </p> <p>Regards</p> <p> </p> <p> </p> <p>From what i found, password encryption uses <b>AAAEncryptionService</b> which firstly generates key from <b>aaa-encrypt-service-config.xml</b> using <b>PBKDF2WithHmacSHA1</b> encryption method and <b>AES</b> encryption type. After that <b>AAAEncryptionService</b> generates <b>javax.crypto.Cipher</b> instance with specs from <b>aaa-encrypt-service-config.xml</b> and previously generated key. Cipher is used to transform password byte array into String/byte[] encrypted by chosen method and type from key and after that, it is also encoded using <b>rfc4648/Base64</b> algorithm. Also Cipher might not work if it is initialized in the wrong state which shouldn't be happening if <b>aaa-encrypt-service-config.xml</b> is OK, but if that happens the <b>rfc4648/Base64</b> is used anyway so the password is protected in some way. <b>AAAEncryptionService</b> also generates decryption Cipher , it is used to return password in its unencrypted state after GET /restconf/config/network-topology:network-topology/topology/topology-netconf/node/&lt;nodename&gt; request. <br/> Also there is a possibility that key might be initialized as null if <b>aaa-encrypt-service-config.xml</b> is corrupted, in that case password will be stored with no encryption, no exceptions will be thrown and user will still get 200 OK response.<br/> So under normal valid circumstances (when <b>aaa-encrypt-service-config.xml</b>  is ok) password will be stored encrypted.<br/>  <br/>  <br/>  </p> <p>I believe Oleksandr's findings answered the question. Closing this issue.</p> Development Rank 0|i03z0f: