Skip to content

CONN-38 Notes for 3.28.0 on PYTHON-1350 #1167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 6, 2023
Merged

CONN-38 Notes for 3.28.0 on PYTHON-1350 #1167

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
911f088
Initial pass at notes on PYTHON-1350, 3.28.0 version
absurdfarce Jun 4, 2023
1983863
Update docs/column_encryption.rst
absurdfarce Jun 6, 2023
02b71fc
Merge branch 'master' into cle_docs_update_3280
absurdfarce Jun 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 4 additions & 12 deletions docs/column_encryption.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,19 +14,11 @@ also available, although in this case values must be manually encrypted and/or d
Client-side encryption and decryption should work against all versions of Cassandra and DSE. It does not
utilize any server-side functionality to do its work.

WARNING: Consider upgrading to 3.28.0 or later
WARNING: Encryption format changes in 3.28.0
------------------------------------------------
There is a significant issue with the column encryption functionality in Python driver 3.27.0.
To be able to decrypt your data, you must preserve the cipher initialization vector (IV) used by
the :class:`~.AES256ColumnEncryptionPolicy` when your data was written.
To decrypt your data, you must supply this IV when creating a policy to read this data.
If you do not supply this IV in the policy to read this data, you will **NOT BE ABLE TO DECRYPT YOUR DATA**.
See
`PYTHON-1350 <https://datastax-oss.atlassian.net/browse/PYTHON-1350>`_ for more detail.

DataStax recommends upgrading to Python driver 3.28.0 or later to avoid this issue. 3.28.0 or later manages the IV automatically.
Because of this change in functionality, any encrypted data written in 3.27.0 will **NOT** be readable by 3.28.0 or later.
After upgrading to Python driver 3.28.0 or later, it is critical that you re-encrypt your data with the new driver version.
Python driver 3.28.0 introduces a new encryption format for data written by :class:`~.AES256ColumnEncryptionPolicy`.
As a result, any encrypted data written by Python driver 3.27.0 will **NOT** be readable.
If you upgraded from 3.27.0, you should re-encrypt your data with 3.28.0.

Configuration
-------------
Expand Down