GH-31603: [C++] Wrap Parquet encryption keys in SecureString

cpp/examples/arrow/parquet_column_encryption.cc

@@ -19,6 +19,7 @@
 #include "arrow/dataset/file_parquet.h"
 #include "arrow/dataset/parquet_encryption_config.h"
 #include "arrow/filesystem/localfs.h"
+#include "arrow/util/secure_string.h"
 #include "parquet/encryption/crypto_factory.h"
 #include "parquet/encryption/test_in_memory_kms.h"
 
@@ -106,9 +107,9 @@ arrow::Result<std::shared_ptr<arrow::Table>> GetTable() {
 
 std::shared_ptr<parquet::encryption::CryptoFactory> GetCryptoFactory() {
   // Configure KMS.
-  std::unordered_map<std::string, std::string> key_map;
-  key_map.emplace("footerKeyId", "0123456789012345");
-  key_map.emplace("columnKeyId", "1234567890123456");
+  std::unordered_map<std::string, arrow::util::SecureString> key_map;
+  key_map.emplace("footerKeyId", arrow::util::SecureString("0123456789012345"));
+  key_map.emplace("columnKeyId", arrow::util::SecureString("1234567890123456"));
 
   auto crypto_factory = std::make_shared<parquet::encryption::CryptoFactory>();
   auto kms_client_factory =

cpp/examples/parquet/low_level_api/encryption_reader_writer.cc

@@ -15,6 +15,7 @@
 // specific language governing permissions and limitations
 // under the License.
 
+#include <arrow/util/secure_string.h>
 #include <reader_writer.h>
 
 #include <cassert>
@@ -39,9 +40,9 @@
 
 constexpr int NUM_ROWS_PER_ROW_GROUP = 500;
 const char* PARQUET_FILENAME = "parquet_cpp_example.parquet.encrypted";
-const char* kFooterEncryptionKey = "0123456789012345";  // 128bit/16
-const char* kColumnEncryptionKey1 = "1234567890123450";
-const char* kColumnEncryptionKey2 = "1234567890123451";
+const arrow::util::SecureString kFooterEncryptionKey("0123456789012345");
+const arrow::util::SecureString kColumnEncryptionKey1("1234567890123450");
+const arrow::util::SecureString kColumnEncryptionKey2("1234567890123451");
 
 int main(int argc, char** argv) {
   /**********************************************************************************

cpp/examples/parquet/low_level_api/encryption_reader_writer_all_crypto_options.cc

@@ -17,6 +17,7 @@
 
 #include <arrow/io/file.h>
 #include <arrow/util/logging.h>
+#include <arrow/util/secure_string.h>
 #include <dirent.h>
 #include <parquet/api/reader.h>
 #include <parquet/api/writer.h>
@@ -92,9 +93,9 @@
 
 constexpr int NUM_ROWS_PER_ROW_GROUP = 500;
 
-const char* kFooterEncryptionKey = "0123456789012345";  // 128bit/16
-const char* kColumnEncryptionKey1 = "1234567890123450";
-const char* kColumnEncryptionKey2 = "1234567890123451";
+const arrow::util::SecureString kFooterEncryptionKey("0123456789012345");
+const arrow::util::SecureString kColumnEncryptionKey1("1234567890123450");
+const arrow::util::SecureString kColumnEncryptionKey2("1234567890123451");
 const char* fileName = "tester";
 
 using FileClass = ::arrow::io::FileOutputStream;

cpp/src/arrow/dataset/file_parquet_encryption_test.cc

@@ -34,19 +34,24 @@
 #include "arrow/testing/random.h"
 #include "arrow/type.h"
 #include "arrow/util/future.h"
+#include "arrow/util/secure_string.h"
 #include "arrow/util/thread_pool.h"
 #include "parquet/arrow/reader.h"
 #include "parquet/encryption/crypto_factory.h"
 #include "parquet/encryption/encryption_internal.h"
 #include "parquet/encryption/kms_client.h"
 #include "parquet/encryption/test_in_memory_kms.h"
 
-constexpr std::string_view kFooterKeyMasterKey = "0123456789012345";
+using arrow::util::SecureString;
+
+const SecureString kFooterKeyMasterKey("0123456789012345");
 constexpr std::string_view kFooterKeyMasterKeyId = "footer_key";
 constexpr std::string_view kFooterKeyName = "footer_key";
-constexpr std::string_view kColumnMasterKey = "1234567890123450";
+
+const SecureString kColumnMasterKey("1234567890123450");
 constexpr std::string_view kColumnMasterKeyId = "col_key";
 constexpr std::string_view kColumnKeyMapping = "col_key: a";
+
 constexpr std::string_view kBaseDir = "";
 
 using arrow::internal::checked_pointer_cast;
@@ -105,7 +110,7 @@ class DatasetEncryptionTestBase : public testing::TestWithParam<EncryptionTestPa
     ASSERT_OK_AND_ASSIGN(expected_table_, SortTable(expected_table_));
 
     // Prepare encryption properties.
-    std::unordered_map<std::string, std::string> key_map;
+    std::unordered_map<std::string, SecureString> key_map;
     key_map.emplace(kColumnMasterKeyId, kColumnMasterKey);
     key_map.emplace(kFooterKeyMasterKeyId, kFooterKeyMasterKey);
 
@@ -145,7 +150,7 @@ class DatasetEncryptionTestBase : public testing::TestWithParam<EncryptionTestPa
       ASSERT_TRUE(GetParam().uniform_encryption);
       auto file_encryption_properties =
           std::make_unique<parquet::FileEncryptionProperties::Builder>(
-              std::string(kFooterKeyMasterKey))
+              kFooterKeyMasterKey)
               ->build();
       auto writer_properties = std::make_unique<parquet::WriterProperties::Builder>()
                                    ->encryption(file_encryption_properties)
@@ -230,7 +235,7 @@ class DatasetEncryptionTestBase : public testing::TestWithParam<EncryptionTestPa
       // Configure decryption keys via reader properties / file decryption properties.
       auto file_decryption_properties =
           std::make_unique<parquet::FileDecryptionProperties::Builder>()
-              ->footer_key(std::string(kFooterKeyMasterKey))
+              ->footer_key(kFooterKeyMasterKey)
               ->build();
       parquet_scan_options->reader_properties->file_decryption_properties(
           file_decryption_properties);
@@ -370,7 +375,7 @@ TEST_P(DatasetEncryptionTest, ReadSingleFile) {
     // Configure decryption keys via file decryption properties with static footer key.
     file_decryption_properties =
         std::make_unique<parquet::FileDecryptionProperties::Builder>()
-            ->footer_key(std::string(kFooterKeyMasterKey))
+            ->footer_key(kFooterKeyMasterKey)
             ->build();
   }
   auto reader_properties = parquet::default_reader_properties();

cpp/src/parquet/encryption/crypto_factory.cc

@@ -18,6 +18,7 @@
 #include <string_view>
 
 #include "arrow/util/logging.h"
+#include "arrow/util/secure_string.h"
 #include "arrow/util/string.h"
 
 #include "parquet/encryption/crypto_factory.h"
@@ -26,6 +27,8 @@
 #include "parquet/encryption/file_system_key_material_store.h"
 #include "parquet/encryption/key_toolkit_internal.h"
 
+using arrow::util::SecureString;
+
 namespace parquet::encryption {
 
 void CryptoFactory::RegisterKmsClientFactory(
@@ -71,8 +74,8 @@ std::shared_ptr<FileEncryptionProperties> CryptoFactory::GetFileEncryptionProper
 
   int dek_length = dek_length_bits / 8;
 
-  std::string footer_key(dek_length, '\0');
-  RandBytes(reinterpret_cast<uint8_t*>(footer_key.data()), footer_key.size());
+  SecureString footer_key(dek_length, '\0');
+  RandBytes(footer_key.as_span().data(), footer_key.size());
 
   std::string footer_key_metadata =
       key_wrapper.GetEncryptionKeyMetadata(footer_key, footer_key_id, true);
@@ -146,8 +149,9 @@ ColumnPathToEncryptionPropertiesMap CryptoFactory::GetColumnEncryptionProperties
                                column_name);
       }
 
-      std::string column_key(dek_length, '\0');
-      RandBytes(reinterpret_cast<uint8_t*>(column_key.data()), column_key.size());
+      SecureString column_key(dek_length, '\0');
+      RandBytes(column_key.as_span().data(), column_key.size());
+
       std::string column_key_key_metadata =
           key_wrapper->GetEncryptionKeyMetadata(column_key, column_key_id, false);
 

cpp/src/parquet/encryption/encryption.cc

@@ -26,31 +26,35 @@
 #include "arrow/util/utf8.h"
 #include "parquet/encryption/encryption_internal.h"
 
-namespace parquet {
+using ::arrow::util::SecureString;
 
-// integer key retriever
-void IntegerKeyIdRetriever::PutKey(uint32_t key_id, const std::string& key) {
-  key_map_.insert({key_id, key});
-}
+namespace parquet {
 
-std::string IntegerKeyIdRetriever::GetKey(const std::string& key_metadata) {
-  uint32_t key_id;
-  memcpy(reinterpret_cast<uint8_t*>(&key_id), key_metadata.c_str(), 4);
+// any empty SecureString key is interpreted as if no key is given
+// this instance is used when a SecureString reference is returned
+static SecureString kNoKey = SecureString();
 
-  return key_map_.at(key_id);
+// integer key retriever
+void IntegerKeyIdRetriever::PutKey(uint32_t key_id, SecureString key) {
+  key_map_.insert({key_id, std::move(key)});
 }
 
 // string key retriever
-void StringKeyIdRetriever::PutKey(const std::string& key_id, const std::string& key) {
-  key_map_.insert({key_id, key});
+void StringKeyIdRetriever::PutKey(std::string key_id, SecureString key) {
+  key_map_.insert({std::move(key_id), std::move(key)});
 }
 
-std::string StringKeyIdRetriever::GetKey(const std::string& key_id) {
+SecureString StringKeyIdRetriever::GetKeyById(const std::string& key_id) {
   return key_map_.at(key_id);
 }
 
 ColumnEncryptionProperties::Builder* ColumnEncryptionProperties::Builder::key(
     std::string column_key) {
+  return key(SecureString(std::move(column_key)));
+}
+
+ColumnEncryptionProperties::Builder* ColumnEncryptionProperties::Builder::key(
+    SecureString column_key) {
   if (column_key.empty()) return this;
 
   DCHECK(key_.empty());
@@ -92,6 +96,11 @@ FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::column_key
 
 FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::footer_key(
     std::string footer_key) {
+  return this->footer_key(SecureString(std::move(footer_key)));
+}
+
+FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::footer_key(
+    SecureString footer_key) {
   if (footer_key.empty()) {
     return this;
   }
@@ -129,10 +138,10 @@ FileDecryptionProperties::Builder* FileDecryptionProperties::Builder::aad_prefix
 }
 
 ColumnDecryptionProperties::Builder* ColumnDecryptionProperties::Builder::key(
-    std::string key) {
+    SecureString key) {
   if (key.empty()) return this;
 
-  DCHECK(!key.empty());
+  DCHECK(key_.empty());
   key_ = std::move(key);
   return this;
 }
@@ -182,74 +191,69 @@ FileEncryptionProperties::Builder::disable_aad_prefix_storage() {
 
 ColumnEncryptionProperties::ColumnEncryptionProperties(bool encrypted,
                                                        std::string column_path,
-                                                       std::string key,
-                                                       std::string key_metadata) {
-  DCHECK(!column_path.empty());
-  column_path_ = std::move(column_path);
+                                                       SecureString key,
+                                                       std::string key_metadata)
+    : column_path_(std::move(column_path)),
+      encrypted_(encrypted),
+      encrypted_with_footer_key_(encrypted && key.empty()),
+      key_(std::move(key)),
+      key_metadata_(std::move(key_metadata)) {
+  DCHECK(!column_path_.empty());
   if (!encrypted) {
-    DCHECK(key.empty() && key_metadata.empty());
+    DCHECK(key_.empty() && key_metadata_.empty());
   }
-
-  if (!key.empty()) {
-    DCHECK(key.length() == 16 || key.length() == 24 || key.length() == 32);
+  if (!key_.empty()) {
+    DCHECK(key_.length() == 16 || key_.length() == 24 || key_.length() == 32);
   }
-
-  encrypted_with_footer_key_ = (encrypted && key.empty());
   if (encrypted_with_footer_key_) {
-    DCHECK(key_metadata.empty());
+    DCHECK(key_metadata_.empty());
   }
-
-  encrypted_ = encrypted;
-  key_metadata_ = std::move(key_metadata);
-  key_ = std::move(key);
 }
 
 ColumnDecryptionProperties::ColumnDecryptionProperties(std::string column_path,
-                                                       std::string key) {
-  DCHECK(!column_path.empty());
-  column_path_ = std::move(column_path);
+                                                       SecureString key)
+    : column_path_(std::move(column_path)), key_(std::move(key)) {
+  DCHECK(!column_path_.empty());
 
-  if (!key.empty()) {
-    DCHECK(key.length() == 16 || key.length() == 24 || key.length() == 32);
+  if (!key_.empty()) {
+    DCHECK(key_.length() == 16 || key_.length() == 24 || key_.length() == 32);
   }
-
-  key_ = std::move(key);
 }
 
-std::string FileDecryptionProperties::column_key(const std::string& column_path) const {
+const SecureString& FileDecryptionProperties::column_key(
+    const std::string& column_path) const {
   if (column_decryption_properties_.find(column_path) !=
       column_decryption_properties_.end()) {
     auto column_prop = column_decryption_properties_.at(column_path);
     if (column_prop != nullptr) {
       return column_prop->key();
     }
   }
-  return {};
+  return kNoKey;
 }
 
 FileDecryptionProperties::FileDecryptionProperties(
-    std::string footer_key, std::shared_ptr<DecryptionKeyRetriever> key_retriever,
+    SecureString footer_key, std::shared_ptr<DecryptionKeyRetriever> key_retriever,
     bool check_plaintext_footer_integrity, std::string aad_prefix,
     std::shared_ptr<AADPrefixVerifier> aad_prefix_verifier,
     ColumnPathToDecryptionPropertiesMap column_decryption_properties,
-    bool plaintext_files_allowed) {
-  DCHECK(!footer_key.empty() || nullptr != key_retriever ||
-         0 != column_decryption_properties.size());
-
-  if (!footer_key.empty()) {
-    DCHECK(footer_key.length() == 16 || footer_key.length() == 24 ||
-           footer_key.length() == 32);
+    bool plaintext_files_allowed)
+    : footer_key_(std::move(footer_key)),
+      aad_prefix_(std::move(aad_prefix)),
+      aad_prefix_verifier_(std::move(aad_prefix_verifier)),
+      column_decryption_properties_(std::move(column_decryption_properties)),
+      key_retriever_(std::move(key_retriever)),
+      check_plaintext_footer_integrity_(check_plaintext_footer_integrity),
+      plaintext_files_allowed_(plaintext_files_allowed) {
+  DCHECK(!footer_key_.empty() || nullptr != key_retriever_ ||
+         0 != column_decryption_properties_.size());
+  if (!footer_key_.empty()) {
+    DCHECK(footer_key_.length() == 16 || footer_key_.length() == 24 ||
+           footer_key_.length() == 32);
   }
-  if (footer_key.empty() && check_plaintext_footer_integrity) {
-    DCHECK(nullptr != key_retriever);
+  if (footer_key_.empty() && check_plaintext_footer_integrity) {
+    DCHECK(nullptr != key_retriever_);
   }
-  aad_prefix_verifier_ = std::move(aad_prefix_verifier);
-  footer_key_ = std::move(footer_key);
-  check_plaintext_footer_integrity_ = check_plaintext_footer_integrity;
-  key_retriever_ = std::move(key_retriever);
-  aad_prefix_ = std::move(aad_prefix);
-  column_decryption_properties_ = std::move(column_decryption_properties);
-  plaintext_files_allowed_ = plaintext_files_allowed;
 }
 
 FileEncryptionProperties::Builder* FileEncryptionProperties::Builder::footer_key_id(
@@ -282,7 +286,7 @@ FileEncryptionProperties::column_encryption_properties(const std::string& column
 }
 
 FileEncryptionProperties::FileEncryptionProperties(
-    ParquetCipher::type cipher, std::string footer_key, std::string footer_key_metadata,
+    ParquetCipher::type cipher, SecureString footer_key, std::string footer_key_metadata,
     bool encrypted_footer, std::string aad_prefix, bool store_aad_prefix_in_file,
     ColumnPathToEncryptionPropertiesMap encrypted_columns)
     : footer_key_(std::move(footer_key)),