elasticsearch/elasticsearch-cloud-aws — pull request #118 by NicolasTr (2014-09-16 09:44:02+00:00)
Title: Client side encryption master

Here's some code to encrypt client-side the snapshots stored in S3 .

It uses AES in [CBC mode](http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher-block_chaining_.28CBC.29) with random [initialisation vectors](http://en.wikipedia.org/wiki/Initialization_vector) (different for each file). I'll work out of the box with 128 bits keys and will work with 256 bits keys if you install the [JCE](http://en.wikipedia.org/wiki/Java_Cryptography_Extension).

The key can be specified when configuring the repository. Example with a 128bits key:
```sh
$ curl -XPUT 'http://localhost:9200/_snapshot/my_s3_repository' -d '{
"type": "s3",
"settings": {
"bucket": "my_bucket_name",
"region": "us-west",
"client_side_encryption_key": "293f49df9d0b5359f24d9f0c4cf5edce"
}
}'
```

I added a test case to make sure that the files are encrypted and I modified `testSimpleWorkflow()` to make sure that by default the files are not encrypted.

I haven't updated the documentation yet, I would like to get some reviews first.

- [x] Encryption
- [x] Decryption
- [x] Test case
- [ ] Documentation