Cloudera Docs

Zone key configurations

Previously, cryptographic parameters for zone key handling were heavily hard-coded. This parameter model introduces a hierarchical inheritance structure where zone keys automatically adapt and mirror the master key's underlying cryptographic configuration. However, to provide precise control over high-volume data encryption keys, the framework allows selective configuration overrides for zone keys.

Zone key default configurations

Zone keys are wrapped using a password-based encryption approach (via the SealedObject API). By default, the zone key implementation inherits the master key's cryptographic parameters with a few legacy configuration overrides:

  • Key Generation Algorithm: AES

  • Key Size: 256 bit

  • Key Derivation Function (KDF): Inherits the master key's KDF (PBKDF2WithHmacSHA256).

  • Cipher Transformation: Inherits the master key's cipher (AES/CTR/NoPadding).

  • Iteration Count: Default value is 20 (retained for backward compatibility).

  • Salt Size: Inherits the master key’s salt size.

Zone key configurable properties

While zone keys dynamically utilize the master key's parameter configurations by default, administrators can specifically override properties for zone keys using the dbks-site.xml file in Cloudera Manager > Ranger KMS > Configuration:
Parameter Configuration Property Name Configurable Options
Key Derivation Algorithm ranger.kms.service.zonekey.encryption.algorithm Accepts any KDF supported by the master key, which are as follows:

  • PBKDF2WithHmacSHA256 (Recommended)

  • PBEWithMD5AndTripleDES (Supported for backward compatibility but not recommended)
Cipher ranger.kms.service.zonekey.encryption.cipher Accepts any cipher transformation available to the master key, which are as follows:

  • AES/CTR/NoPadding (Default)

  • AES/GCM/NoPadding

  • AES/CBC/PKCS5Padding

  • AES/CBC/PKCS7Padding (FIPS only)
Iteration Count ranger.kms.service.zonekey.iteration.count Custom integer count value to optimize wrapping complexity.
Salt Size ranger.kms.service.zonekey.salt.size Custom byte size setting for generating unique zone key salts.