docs: deprecate rsadecrypt (#18856)

`rsadecrypt` uses PKCS #1 v1.5 padding which has multiple known
weaknesses. While it is possible to use safely in Nomad, we should not
encourage our users to use bad cryptographic primitives.

If users want to decrypt secrets in jobspecs we should choose a
cryptographic primitive designed for that purpose. `rsadecrypt` was
inherited from Terraform which only implemented it to support decrypting
Window's passwords on AWS EC2 instances:

https://github.com/hashicorp/terraform/pull/16647

This is not something that should ever be done in a jobspec, therefore
there's no reason for Nomad to support this HCL2 function.
This commit is contained in:
Michael Schurter
2023-10-24 15:48:15 -07:00
committed by GitHub
parent 6c2d5a0fbb
commit 9b3c38b3ed
2 changed files with 18 additions and 1 deletions

View File

@@ -6,6 +6,18 @@ description: The rsadecrypt function decrypts an RSA-encrypted message.
# `rsadecrypt` Function
<Note title="Deprecated">
This function is deprecated and may be removed in the future.
</Note>
<Warning>
While it is possible to use safely, it encourages use of cryptographic
primitives with <a href="https://en.wikipedia.org/wiki/PKCS_1#Attacks">known
weaknesses</a>. <a href="/nomad/docs/concepts/variables">Nomad Variables</a>
and <a href="/nomad/docs/integrations/vault-integration">HashiCorp Vault</a> are
the recommended ways to provide secrets to workloads.
</Warning>
`rsadecrypt` decrypts an RSA-encrypted ciphertext, returning the corresponding
cleartext.

View File

@@ -1316,7 +1316,12 @@
},
{
"title": "rsadecrypt",
"path": "job-specification/hcl2/functions/crypto/rsadecrypt"
"path": "job-specification/hcl2/functions/crypto/rsadecrypt",
"badge": {
"text": "Deprecated",
"type": "outlined",
"color": "neutral"
}
},
{
"title": "sha1",