Skip to content

Conversation

@DemetrisChr
Copy link
Contributor

Motivation

In order to support a separate Field Level Encryption library we need to provide a way to specify a pointer to a "crypto manager" which is then passed on to special transcoders which can handle encryption/decryption. The definition of the crypto transcoder class will be provided by the separate FLE library.

Changes

  • Add forward declaration for couchbase::crypto::manager
  • Add crypto manager in cluster options & pass that on to the cluster/bucket/scope/collection classes
  • Add couchbase::codec::is_crypto_transcoder transcoder trait
  • For transcoders that satisfy couchbase::codec::is_crypto_transcoder, call their encode/decode methods with an additional parameter, the crypto manager pointer.
  • Add an internal (not intended for use by any users other than the FLE library) header file with helpers for aead_aes_256_cbc_hmac_sha512 encryption/decryption and generating secure random initialization vectors. These utilize the relevant BoringSSL/OpenSSL functions internally, and allow the FLE library to use them without adding a direct dependency to BoringSSL or OpenSSL

@avsej avsej merged commit e8c2ba8 into couchbase:main Jul 11, 2025
34 of 36 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants