Securing indexed data

Elastic Stack Elasticsearch
1

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

I don't believe Lucene or elasticsearch provide this. This article has some
details:
https://support.lucidworks.com/entries/22014021-Encrypting-Solr-Lucene-indexes

Likely the best you can do is encrypt at the filesystem level and have all
communication pass over a secure connection.

I believe Lucene 4.0+ has some codec stuff exposed that you might be able
to hook into via a plugin in ES, but am really not sure if that is
feasible.

Best Regards,
Paul

On Monday, April 1, 2013 12:48:22 PM UTC-6, cocowalla wrote:

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Hi,

ES doesn't encrypt, but some file systems can do that. I think when I
first set up my MacBook, I think I was asked if I want to encrypt my FS,
for example. Encrypting File System - Wikipedia

Otis

ELASTICSEARCH Performance Monitoring - Sematext Monitoring | Infrastructure Monitoring Service

On Monday, April 1, 2013 2:48:22 PM UTC-4, cocowalla wrote:

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

4

Several linux distros give an option for encrypted filesystems. Fedora for
example, can be set up on an encrypted partition while installing.

On Tue, Apr 2, 2013 at 9:07 AM, Otis Gospodnetic <otis.gospodnetic@gmail.com

wrote:

Hi,

ES doesn't encrypt, but some file systems can do that. I think when I
first set up my MacBook, I think I was asked if I want to encrypt my FS,
for example. Encrypting File System - Wikipedia

Otis

ELASTICSEARCH Performance Monitoring - Sematext Monitoring | Infrastructure Monitoring Service

On Monday, April 1, 2013 2:48:22 PM UTC-4, cocowalla wrote:

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
Anurag <0xB20A82C1>
http://web.gnuer.org/blog/

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

5

Actually, I was more thinking of cryptographic signatures or keyed hashing
(HMAC), rather than encryption?

I will look into doing encryption at the filesystem level though, thanks.

On Monday, April 1, 2013 10:54:39 PM UTC+1, ppearcy wrote:

I don't believe Lucene or elasticsearch provide this. This article has
some details:

https://support.lucidworks.com/entries/22014021-Encrypting-Solr-Lucene-indexes

Likely the best you can do is encrypt at the filesystem level and have all
communication pass over a secure connection.

I believe Lucene 4.0+ has some codec stuff exposed that you might be able
to hook into via a plugin in ES, but am really not sure if that is
feasible.

Best Regards,
Paul

On Monday, April 1, 2013 12:48:22 PM UTC-6, cocowalla wrote:

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

6

Why not store a hash of your data alongside the data? If the data is
tampered with, you'll know cause the hash doesn't match. Of course, that
would require that your hash secret isn't stolen along with your data -
which would mean the key should originate from a different identity (say if
it is a particular user's data, the key should live with the user, and
never be transmitted to the server).

On Tuesday, April 2, 2013 6:14:11 AM UTC-7, cocowalla wrote:

Actually, I was more thinking of cryptographic signatures or keyed hashing
(HMAC), rather than encryption?

I will look into doing encryption at the filesystem level though, thanks.

On Monday, April 1, 2013 10:54:39 PM UTC+1, ppearcy wrote:

I don't believe Lucene or elasticsearch provide this. This article has
some details:

https://support.lucidworks.com/entries/22014021-Encrypting-Solr-Lucene-indexes

Likely the best you can do is encrypt at the filesystem level and have
all communication pass over a secure connection.

I believe Lucene 4.0+ has some codec stuff exposed that you might be able
to hook into via a plugin in ES, but am really not sure if that is
feasible.

Best Regards,
Paul

On Monday, April 1, 2013 12:48:22 PM UTC-6, cocowalla wrote:

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

7

And by "hash secret isn't stolen along with your data" I meant "hash secret
isn't accessible to the tamperer".

On Saturday, October 12, 2013 1:45:21 PM UTC-7, Billy Te wrote:

Why not store a hash of your data alongside the data? If the data is
tampered with, you'll know cause the hash doesn't match. Of course, that
would require that your hash secret isn't stolen along with your data -
which would mean the key should originate from a different identity (say if
it is a particular user's data, the key should live with the user, and
never be transmitted to the server).

On Tuesday, April 2, 2013 6:14:11 AM UTC-7, cocowalla wrote:

Actually, I was more thinking of cryptographic signatures or keyed
hashing (HMAC), rather than encryption?

I will look into doing encryption at the filesystem level though, thanks.

On Monday, April 1, 2013 10:54:39 PM UTC+1, ppearcy wrote:

I don't believe Lucene or elasticsearch provide this. This article has
some details:

https://support.lucidworks.com/entries/22014021-Encrypting-Solr-Lucene-indexes

Likely the best you can do is encrypt at the filesystem level and have
all communication pass over a secure connection.

I believe Lucene 4.0+ has some codec stuff exposed that you might be
able to hook into via a plugin in ES, but am really not sure if that is
feasible.

Best Regards,
Paul

On Monday, April 1, 2013 12:48:22 PM UTC-6, cocowalla wrote:

Is it possible to make data in Elasticsearch indices tamper-proof? For
example, does it have the capability to cryptographically sign blocks of
data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.