GH-31603: [C++] Wrap Parquet encryption keys in SecureString

cpp/examples/arrow/parquet_column_encryption.cc

@@ -19,6 +19,7 @@
 #include "arrow/dataset/file_parquet.h"
 #include "arrow/dataset/parquet_encryption_config.h"
 #include "arrow/filesystem/localfs.h"
+#include "arrow/util/secure_string.h"
 #include "parquet/encryption/crypto_factory.h"
 #include "parquet/encryption/test_in_memory_kms.h"
 
@@ -106,9 +107,9 @@ arrow::Result<std::shared_ptr<arrow::Table>> GetTable() {
 
 std::shared_ptr<parquet::encryption::CryptoFactory> GetCryptoFactory() {
  // Configure KMS.
- std::unordered_map<std::string, std::string> key_map;
- key_map.emplace("footerKeyId", "0123456789012345");
- key_map.emplace("columnKeyId", "1234567890123456");
+ std::unordered_map<std::string, arrow::util::SecureString> key_map;
+ key_map.emplace("footerKeyId", arrow::util::SecureString("0123456789012345"));
+ key_map.emplace("columnKeyId", arrow::util::SecureString("1234567890123456"));
 
  auto crypto_factory = std::make_shared<parquet::encryption::CryptoFactory>();
  auto kms_client_factory =

cpp/examples/parquet/low_level_api/encryption_reader_writer.cc

@@ -15,6 +15,7 @@
 // specific language governing permissions and limitations
 // under the License.
 
+#include <arrow/util/secure_string.h>
 #include <reader_writer.h>
 
 #include <cassert>
@@ -39,9 +40,9 @@
 
 constexpr int NUM_ROWS_PER_ROW_GROUP = 500;
 const char* PARQUET_FILENAME = "parquet_cpp_example.parquet.encrypted";
-const char* kFooterEncryptionKey = "0123456789012345"; // 128bit/16
-const char* kColumnEncryptionKey1 = "1234567890123450";
-const char* kColumnEncryptionKey2 = "1234567890123451";
+const arrow::util::SecureString kFooterEncryptionKey("0123456789012345");
+const arrow::util::SecureString kColumnEncryptionKey1("1234567890123450");
+const arrow::util::SecureString kColumnEncryptionKey2("1234567890123451");
 
 int main(int argc, char** argv) {
  /**********************************************************************************

cpp/examples/parquet/low_level_api/encryption_reader_writer_all_crypto_options.cc

@@ -17,6 +17,7 @@
 
 #include <arrow/io/file.h>
 #include <arrow/util/logging.h>
+#include <arrow/util/secure_string.h>
 #include <dirent.h>
 #include <parquet/api/reader.h>
 #include <parquet/api/writer.h>
@@ -92,9 +93,9 @@
 
 constexpr int NUM_ROWS_PER_ROW_GROUP = 500;
 
-const char* kFooterEncryptionKey = "0123456789012345"; // 128bit/16
-const char* kColumnEncryptionKey1 = "1234567890123450";
-const char* kColumnEncryptionKey2 = "1234567890123451";
+const arrow::util::SecureString kFooterEncryptionKey("0123456789012345");
+const arrow::util::SecureString kColumnEncryptionKey1("1234567890123450");
+const arrow::util::SecureString kColumnEncryptionKey2("1234567890123451");
 const char* fileName = "tester";
 
 using FileClass = ::arrow::io::FileOutputStream;

cpp/src/arrow/dataset/file_parquet_encryption_test.cc

@@ -34,19 +34,24 @@
 #include "arrow/testing/random.h"
 #include "arrow/type.h"
 #include "arrow/util/future.h"
+#include "arrow/util/secure_string.h"
 #include "arrow/util/thread_pool.h"
 #include "parquet/arrow/reader.h"
 #include "parquet/encryption/crypto_factory.h"
 #include "parquet/encryption/encryption_internal.h"
 #include "parquet/encryption/kms_client.h"
 #include "parquet/encryption/test_in_memory_kms.h"
 
-constexpr std::string_view kFooterKeyMasterKey = "0123456789012345";
+using arrow::util::SecureString;
+
+const SecureString kFooterKeyMasterKey("0123456789012345");
 constexpr std::string_view kFooterKeyMasterKeyId = "footer_key";
 constexpr std::string_view kFooterKeyName = "footer_key";
-constexpr std::string_view kColumnMasterKey = "1234567890123450";
+
+const SecureString kColumnMasterKey("1234567890123450");
 constexpr std::string_view kColumnMasterKeyId = "col_key";
 constexpr std::string_view kColumnKeyMapping = "col_key: a";
+
 constexpr std::string_view kBaseDir = "";
 
 using arrow::internal::checked_pointer_cast;
@@ -105,7 +110,7 @@ class DatasetEncryptionTestBase : public testing::TestWithParam<EncryptionTestPa
  ASSERT_OK_AND_ASSIGN(expected_table_, SortTable(expected_table_));
 
  // Prepare encryption properties.
- std::unordered_map<std::string, std::string> key_map;
+ std::unordered_map<std::string, SecureString> key_map;
  key_map.emplace(kColumnMasterKeyId, kColumnMasterKey);
  key_map.emplace(kFooterKeyMasterKeyId, kFooterKeyMasterKey);
 
@@ -145,7 +150,7 @@ class DatasetEncryptionTestBase : public testing::TestWithParam<EncryptionTestPa
  ASSERT_TRUE(GetParam().uniform_encryption);
  auto file_encryption_properties =
  std::make_unique<parquet::FileEncryptionProperties::Builder>(
-std::string(kFooterKeyMasterKey))
+ kFooterKeyMasterKey)
  ->build();
  auto writer_properties = std::make_unique<parquet::WriterProperties::Builder>()
  ->encryption(file_encryption_properties)
@@ -230,7 +235,7 @@ class DatasetEncryptionTestBase : public testing::TestWithParam<EncryptionTestPa
  // Configure decryption keys via reader properties / file decryption properties.
  auto file_decryption_properties =
  std::make_unique<parquet::FileDecryptionProperties::Builder>()
- ->footer_key(std::string(kFooterKeyMasterKey))
+ ->footer_key(kFooterKeyMasterKey)
  ->build();
  parquet_scan_options->reader_properties->file_decryption_properties(
  file_decryption_properties);
@@ -370,7 +375,7 @@ TEST_P(DatasetEncryptionTest, ReadSingleFile) {
  // Configure decryption keys via file decryption properties with static footer key.
  file_decryption_properties =
  std::make_unique<parquet::FileDecryptionProperties::Builder>()
- ->footer_key(std::string(kFooterKeyMasterKey))
+ ->footer_key(kFooterKeyMasterKey)
  ->build();
  }
  auto reader_properties = parquet::default_reader_properties();

cpp/src/parquet/encryption/crypto_factory.cc

@@ -18,6 +18,7 @@
 #include <string_view>
 
 #include "arrow/util/logging.h"
+#include "arrow/util/secure_string.h"
 #include "arrow/util/string.h"
 
 #include "parquet/encryption/crypto_factory.h"
@@ -26,6 +27,8 @@
 #include "parquet/encryption/file_system_key_material_store.h"
 #include "parquet/encryption/key_toolkit_internal.h"
 
+using arrow::util::SecureString;
+
 namespace parquet::encryption {
 
 void CryptoFactory::RegisterKmsClientFactory(
@@ -71,8 +74,8 @@ std::shared_ptr<FileEncryptionProperties> CryptoFactory::GetFileEncryptionProper
 
  int dek_length = dek_length_bits / 8;
 
-std::string footer_key(dek_length, '\0');
- RandBytes(reinterpret_cast<uint8_t*>(footer_key.data()), footer_key.size());
+SecureString footer_key(dek_length, '\0');
+ RandBytes(footer_key.as_span().data(), footer_key.size());
 
  std::string footer_key_metadata =
  key_wrapper.GetEncryptionKeyMetadata(footer_key, footer_key_id, true);
@@ -146,8 +149,9 @@ ColumnPathToEncryptionPropertiesMap CryptoFactory::GetColumnEncryptionProperties
  column_name);
  }
 
- std::string column_key(dek_length, '\0');
- RandBytes(reinterpret_cast<uint8_t*>(column_key.data()), column_key.size());
+ SecureString column_key(dek_length, '\0');
+ RandBytes(column_key.as_span().data(), column_key.size());
+
  std::string column_key_key_metadata =
  key_wrapper->GetEncryptionKeyMetadata(column_key, column_key_id, false);
 

cpp/src/parquet/encryption/encryption.cc

@@ -26,31 +26,35 @@
 #include "arrow/util/utf8.h"
 #include "parquet/encryption/encryption_internal.h"
 
-namespace parquet {
+using ::arrow::util::SecureString;
 
-// integer key retriever
-void IntegerKeyIdRetriever::PutKey(uint32_t key_id, const std::string& key) {
- key_map_.insert({key_id, key});
-}
+namespace parquet {
 
-std::string IntegerKeyIdRetriever::GetKey(const std::string& key_metadata) {
- uint32_t key_id;
- memcpy(reinterpret_cast<uint8_t*>(&key_id), key_metadata.c_str(), 4);
+// any empty SecureString key is interpreted as if no key is given
+// this instance is used when a SecureString reference is returned
+static SecureString kNoKey = SecureString();
 
- return key_map_.at(key_id);
+// integer key retriever
+void IntegerKeyIdRetriever::PutKey(uint32_t key_id, SecureString key) {
+ key_map_.insert({key_id, std::move(key)});
 }
 
 // string key retriever
-void StringKeyIdRetriever::PutKey(const std::string& key_id, const std::string& key) {
- key_map_.insert({key_id, key});
+void StringKeyIdRetriever::PutKey(std::string key_id, SecureString key) {
+ key_map_.insert({std::move(key_id), std::move(key)});
 }
 
-std::string StringKeyIdRetriever::GetKey(const std::string& key_id) {
+SecureString StringKeyIdRetriever::GetKeyById(const std::string& key_id) {
  return key_map_.at(key_id);
 }
 
 ColumnEncryptionProperties::Builder* ColumnEncryptionProperties::Builder::key(
  std::string column_key) {
+ return key(SecureString(std::move(column_key)));
+}
+
+ColumnEncryptionProperties::Builder* ColumnEncryptionProperties::Builder::key(
+ SecureString column_key) {
  if (column_key.empty()) return this;
 
  DCHECK(key_.empty());
@@ -92,6 +96,11 @@ FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::column_key
 
 FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::footer_key(
  std::string footer_key) {
+ return this->footer_key(SecureString(std::move(footer_key)));
+}
+
+FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::footer_key(
+ SecureString footer_key) {
  if (footer_key.empty()) {
  return this;
  }
@@ -129,10 +138,10 @@ FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::aad_prefix
 }
 
 ColumnDecryptionProperties::Builder* ColumnDecryptionProperties::Builder::key(
-std::string key) {
+SecureString key) {
  if (key.empty()) return this;
 
- DCHECK(!key.empty());
+ DCHECK(key_.empty());
  key_ = std::move(key);
  return this;
 }
@@ -182,74 +191,69 @@ FileEncryptionProperties::Builder::disable_aad_prefix_storage() {
 
 ColumnEncryptionProperties::ColumnEncryptionProperties(bool encrypted,
  std::string column_path,
- std::string key,
- std::string key_metadata) {
- DCHECK(!column_path.empty());
- column_path_ = std::move(column_path);
+ SecureString key,
+ std::string key_metadata)
+ : column_path_(std::move(column_path)),
+ encrypted_(encrypted),
+ encrypted_with_footer_key_(encrypted && key.empty()),
+ key_(std::move(key)),
+ key_metadata_(std::move(key_metadata)) {
+ DCHECK(!column_path_.empty());
  if (!encrypted) {
- DCHECK(key.empty() && key_metadata.empty());
+ DCHECK(key_.empty() && key_metadata_.empty());
  }
-
- if (!key.empty()) {
- DCHECK(key.length() == 16 || key.length() == 24 || key.length() == 32);
+ if (!key_.empty()) {
+ DCHECK(key_.length() == 16 || key_.length() == 24 || key_.length() == 32);
  }
-
- encrypted_with_footer_key_ = (encrypted && key.empty());
  if (encrypted_with_footer_key_) {
- DCHECK(key_metadata.empty());
+ DCHECK(key_metadata_.empty());
  }
-
- encrypted_ = encrypted;
- key_metadata_ = std::move(key_metadata);
- key_ = std::move(key);
 }
 
 ColumnDecryptionProperties::ColumnDecryptionProperties(std::string column_path,
-std::string key) {
-DCHECK(!column_path.empty());
- column_path_ = std::move(column_path);
+SecureString key)
+ : column_path_(std::move(column_path)), key_(std::move(key)) {
+DCHECK(!column_path_.empty());
 
- if (!key.empty()) {
- DCHECK(key.length() == 16 || key.length() == 24 || key.length() == 32);
+ if (!key_.empty()) {
+ DCHECK(key_.length() == 16 || key_.length() == 24 || key_.length() == 32);
  }
-
- key_ = std::move(key);
 }
 
-std::string FileDecryptionProperties::column_key(const std::string& column_path) const {
+const SecureString& FileDecryptionProperties::column_key(
+ const std::string& column_path) const {
  if (column_decryption_properties_.find(column_path) !=
  column_decryption_properties_.end()) {
  auto column_prop = column_decryption_properties_.at(column_path);
  if (column_prop != nullptr) {
  return column_prop->key();
  }
  }
- return {};
+ return kNoKey;
 }
 
 FileDecryptionProperties::FileDecryptionProperties(
-std::string footer_key, std::shared_ptr<DecryptionKeyRetriever> key_retriever,
+SecureString footer_key, std::shared_ptr<DecryptionKeyRetriever> key_retriever,
  bool check_plaintext_footer_integrity, std::string aad_prefix,
  std::shared_ptr<AADPrefixVerifier> aad_prefix_verifier,
  ColumnPathToDecryptionPropertiesMap column_decryption_properties,
- bool plaintext_files_allowed) {
- DCHECK(!footer_key.empty() || nullptr != key_retriever ||
- 0 != column_decryption_properties.size());
-
- if (!footer_key.empty()) {
- DCHECK(footer_key.length() == 16 || footer_key.length() == 24 ||
- footer_key.length() == 32);
+ bool plaintext_files_allowed)
+ : footer_key_(std::move(footer_key)),
+ aad_prefix_(std::move(aad_prefix)),
+ aad_prefix_verifier_(std::move(aad_prefix_verifier)),
+ column_decryption_properties_(std::move(column_decryption_properties)),
+ key_retriever_(std::move(key_retriever)),
+ check_plaintext_footer_integrity_(check_plaintext_footer_integrity),
+ plaintext_files_allowed_(plaintext_files_allowed) {
+ DCHECK(!footer_key_.empty() || nullptr != key_retriever_ ||
+ 0 != column_decryption_properties_.size());
+ if (!footer_key_.empty()) {
+ DCHECK(footer_key_.length() == 16 || footer_key_.length() == 24 ||
+ footer_key_.length() == 32);
  }
- if (footer_key.empty() && check_plaintext_footer_integrity) {
- DCHECK(nullptr != key_retriever);
+ if (footer_key_.empty() && check_plaintext_footer_integrity) {
+ DCHECK(nullptr != key_retriever_);
  }
- aad_prefix_verifier_ = std::move(aad_prefix_verifier);
- footer_key_ = std::move(footer_key);
- check_plaintext_footer_integrity_ = check_plaintext_footer_integrity;
- key_retriever_ = std::move(key_retriever);
- aad_prefix_ = std::move(aad_prefix);
- column_decryption_properties_ = std::move(column_decryption_properties);
- plaintext_files_allowed_ = plaintext_files_allowed;
 }
 
 FileEncryptionProperties::Builder* FileEncryptionProperties::Builder::footer_key_id(
@@ -282,7 +286,7 @@ FileEncryptionProperties::column_encryption_properties(const std::string& column
 }
 
 FileEncryptionProperties::FileEncryptionProperties(
- ParquetCipher::type cipher, std::string footer_key, std::string footer_key_metadata,
+ ParquetCipher::type cipher, SecureString footer_key, std::string footer_key_metadata,
  bool encrypted_footer, std::string aad_prefix, bool store_aad_prefix_in_file,
  ColumnPathToEncryptionPropertiesMap encrypted_columns)
  : footer_key_(std::move(footer_key)),