Master key configurations

The master key gets generated when Ranger KMS service starts for the very first time. Under this parameter framework, administrators can override out-of-the-box defaults within configuration profiles to align with organizational compliance standards.

Master key default configurations

When the Ranger KMS service starts for the first time, a master key is automatically generated and stored using the following default cryptographic parameters:

Key Material Generation Algorithm: AES
Key Size: 256 bit
Key Derivation Function (KDF): PBKDF2WithHmacSHA256. This serves as the default KDF across both FIPS and non-FIPS environments.
Cipher Transformation: AES/CTR/NoPadding
Salt: Input is provided as configuration (or default) value and Ranger KMS further generates a new salt of required size using the provided input and MessageDigest API.
Iteration Count: 1000

Hardware Security Module (HSM) Defaults

Luna HSM: Stored master keys default to a key size of 256 bit (updated from the legacy hard-coded 128-bit setting).
SafenetKeySecure: Stored master keys default to an algorithm of AES with a key size of 256 bit.

Master key configurable properties

The following properties can be customized for the Ranger KMS master key:


Property Name	Allowed Configurable Options / Formats	Description
ranger.kms.service.masterkey.password.cipher	`AES/CTR/NoPadding` (Default) AES/GCM/NoPadding AES/CBC/PKCS5Padding `AES/CBC/PKCS7Padding` (FIPS only)	Defines the complete Cipher value formatted as `<Algorithm>/<MODE>/<PADDING>`. KMS parses the first token for generation and the remaining parts for encryption/decryption.
ranger.kms.service.masterkey.password.size	`256` (Recommended), `192`, `128`	Determines the cryptographic key length bit size.
ranger.kms.service.masterkey.password.encryption.algorithm	`PBKDF2WithHmacSHA256` (Recommended `PBEWithMD5AndTripleDES` (Supported for backward compatibility but not recommended)	Configures the underlying Key Derivation Function (KDF) name used to derive strong SecretKeys.