Cloudera Docs

Encrypting NiFi sensitive properties with FIPS 140-3 approved algorithm

You can protect NiFi sensitive properties, such as database connection pool passwords, with a secret key generated by the FIPS 140-3 approved PBKDF2 algorithm.

The PBKDF2 algorithm uses 160,000 hashing iterations with the SHA-512 digest function. NiFi then uses the generated secret key to encrypt sensitive properties with AES Galois/Counter Mode (GCM), which provides both encryption and integrity protection.

To use PBKDF2, configure the algorithm in the nifi.sensitive.props.algorithm field and specify a password in the nifi.sensitive.props.key field.

See FIPS compliance and integration guide.

  1. Open the nifi.properties file.
  2. Set the nifi.sensitive.props.algorithm property to one of the following values.
    • NIFI_PBKDF2_AES_GCM_128 to specify a 128-bit key length
    • NIFI_PBKDF2_AES_GCM_256 to specify a 256-bit key length
  3. Set the nifi.sensitive.props.key property to a password that is at least 12 characters long.
    The encryption key is derived from this password.
  4. Save the nifi.properties file.
  5. Complete the applicable action:
    • If you are installing Cloudera Flow Management, start NiFi.
    • If you are upgrading to a newer Cloudera Flow Management version, see the Supported upgrade paths for Cloudera Flow Management documentation for more information.