mirror of
https://github.com/kemko/nomad.git
synced 2026-01-06 18:35:44 +03:00
docs: deprecate rsadecrypt (#18856)
`rsadecrypt` uses PKCS #1 v1.5 padding which has multiple known weaknesses. While it is possible to use safely in Nomad, we should not encourage our users to use bad cryptographic primitives. If users want to decrypt secrets in jobspecs we should choose a cryptographic primitive designed for that purpose. `rsadecrypt` was inherited from Terraform which only implemented it to support decrypting Window's passwords on AWS EC2 instances: https://github.com/hashicorp/terraform/pull/16647 This is not something that should ever be done in a jobspec, therefore there's no reason for Nomad to support this HCL2 function.
This commit is contained in:
@@ -6,6 +6,18 @@ description: The rsadecrypt function decrypts an RSA-encrypted message.
|
||||
|
||||
# `rsadecrypt` Function
|
||||
|
||||
<Note title="Deprecated">
|
||||
This function is deprecated and may be removed in the future.
|
||||
</Note>
|
||||
|
||||
<Warning>
|
||||
While it is possible to use safely, it encourages use of cryptographic
|
||||
primitives with <a href="https://en.wikipedia.org/wiki/PKCS_1#Attacks">known
|
||||
weaknesses</a>. <a href="/nomad/docs/concepts/variables">Nomad Variables</a>
|
||||
and <a href="/nomad/docs/integrations/vault-integration">HashiCorp Vault</a> are
|
||||
the recommended ways to provide secrets to workloads.
|
||||
</Warning>
|
||||
|
||||
`rsadecrypt` decrypts an RSA-encrypted ciphertext, returning the corresponding
|
||||
cleartext.
|
||||
|
||||
|
||||
@@ -1316,7 +1316,12 @@
|
||||
},
|
||||
{
|
||||
"title": "rsadecrypt",
|
||||
"path": "job-specification/hcl2/functions/crypto/rsadecrypt"
|
||||
"path": "job-specification/hcl2/functions/crypto/rsadecrypt",
|
||||
"badge": {
|
||||
"text": "Deprecated",
|
||||
"type": "outlined",
|
||||
"color": "neutral"
|
||||
}
|
||||
},
|
||||
{
|
||||
"title": "sha1",
|
||||
|
||||
Reference in New Issue
Block a user