diff --git a/nifi-commons/nifi-security-utils/src/main/java/org/apache/nifi/security/util/crypto/Argon2SecureHasher.java b/nifi-commons/nifi-security-utils/src/main/java/org/apache/nifi/security/util/crypto/Argon2SecureHasher.java
index c152759f9930..0697f3d3f597 100644
--- a/nifi-commons/nifi-security-utils/src/main/java/org/apache/nifi/security/util/crypto/Argon2SecureHasher.java
+++ b/nifi-commons/nifi-security-utils/src/main/java/org/apache/nifi/security/util/crypto/Argon2SecureHasher.java
@@ -42,7 +42,6 @@
public class Argon2SecureHasher implements SecureHasher {
private static final Logger logger = LoggerFactory.getLogger(Argon2SecureHasher.class);
- private static final int DEFAULT_SALT_LENGTH = 16;
private static final int DEFAULT_HASH_LENGTH = 32;
private static final int DEFAULT_PARALLELISM = 1;
private static final int DEFAULT_MEMORY = 1 << 12;
@@ -74,7 +73,7 @@ public Argon2SecureHasher() {
* Instantiates an Argon2 secure hasher using the provided cost parameters. A unique
* {@link #DEFAULT_SALT_LENGTH} byte salt will be generated on every hash request.
*
- * @param hashLength the output length in bytes ({@code 4 to 2^32 -1})
+ * @param hashLength the output length in bytes ({@code 4 to 2^32 - 1})
* @param memory the integer number of KB used ({@code 8p to 2^32 - 1})
* @param parallelism degree of parallelism ({@code 1 to 2^24 - 1})
* @param iterations number of iterations ({@code 1 to 2^32 - 1})
@@ -87,7 +86,7 @@ public Argon2SecureHasher(int hashLength, int memory, int parallelism, int itera
* Instantiates an Argon2 secure hasher using the provided cost parameters. A unique
* salt of the specified length will be generated on every hash request.
*
- * @param hashLength the output length in bytes ({@code 4 to 2^32 -1})
+ * @param hashLength the output length in bytes ({@code 4 to 2^32 - 1})
* @param memory the integer number of KB used ({@code 8p to 2^32 - 1})
* @param parallelism degree of parallelism ({@code 1 to 2^24 - 1})
* @param iterations number of iterations ({@code 1 to 2^32 - 1})
@@ -137,7 +136,7 @@ byte[] getSalt() {
}
/**
- * Returns a String representation of {@code CHF(input)} in hex-encoded format.
+ * Returns a String representation of {@code Argon2(input)} in hex-encoded format.
*
* @param input the input
* @return the hex-encoded hash
@@ -153,7 +152,7 @@ public String hashHex(String input) {
}
/**
- * Returns a String representation of {@code CHF(input)} in Base 64-encoded format.
+ * Returns a String representation of {@code Argon2(input)} in Base 64-encoded format.
*
* @param input the input
* @return the Base 64-encoded hash
@@ -169,7 +168,7 @@ public String hashBase64(String input) {
}
/**
- * Returns a byte[] representation of {@code CHF(input)}.
+ * Returns a byte[] representation of {@code Argon2(input)}.
*
* @param input the input
* @return the hash
diff --git a/nifi-commons/nifi-security-utils/src/test/resources/logback-test.xml b/nifi-commons/nifi-security-utils/src/test/resources/logback-test.xml
index d8e72bd175f9..b5036d49a0ba 100644
--- a/nifi-commons/nifi-security-utils/src/test/resources/logback-test.xml
+++ b/nifi-commons/nifi-security-utils/src/test/resources/logback-test.xml
@@ -32,7 +32,7 @@
-
+
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
index 15e1635b7ce0..dea010ad3d6d 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
@@ -342,7 +342,7 @@ private void addParameter(final StringBuilder builder, final Element parameterEl
// append value
if (isEncrypted(value)) {
- // propValue is non null, no need to use getValue
+ // Get a secure, deterministic, loggable representation of this value
builder.append(getLoggableRepresentationOfSensitiveValue(value));
} else {
builder.append(getValue(value, NO_VALUE));
@@ -557,15 +557,12 @@ private StringBuilder addPropertyFingerprint(final StringBuilder builder, final
* @return a deterministic string value which represents this input but is safe to print in a log
*/
private String getLoggableRepresentationOfSensitiveValue(String encryptedPropertyValue) {
- // TODO: Implement Scrypt or Argon2 secure hash of decrypted value
-
// TODO: Use DI/IoC to inject this implementation in the constructor of the FingerprintFactory
// There is little initialization cost, so it doesn't make sense to cache this as a field
SecureHasher secureHasher = new Argon2SecureHasher();
// TODO: Extend {@link StringEncryptor} with secure hashing capability and inject?
- String hexEncodedHash = secureHasher.hashHex(decrypt(encryptedPropertyValue));
- return hexEncodedHash;
+ return secureHasher.hashHex(decrypt(encryptedPropertyValue));
}
private StringBuilder addPortFingerprint(final StringBuilder builder, final Element portElem) throws FingerprintException {