Any Upgrade Risks with BLAKE2B for Masked Fields (2.x to 3.x)

Security
1

Versions: OpenSearch 3.x

Describe the issue: Planning a rolling upgrade from Opensearch 2.x to 3.x. Seeking clarification on below points:

  1. If plugins.security.masked_fields.algorithm.default: BLAKE2B is set, Will the upgrade from 2.x to 3.x fail or succeed ?
    a. Does rolling upgrade succeed without node-join failures, or startup exceptions?
    b. If It Fails, What Errors or Issues Will Be Seen?
    c. Will there be any impact on queries ?
    d. Is re-indexing required here ?? and When ?
  2. What’s the safest migration path to the corrected salted BLAKE2b ?
  3. Is BLAKE2B_LEGACY_DEFAULT going to be removed in future versions?

Configuration: Security Enabled

2

Hi @Chandana_EP , the upgrade would succeed. During the period of rolling upgrade, any aggregations on fields that are masked would return incorrect results due to nodes of different versions hashing with different behavior.

  1. Is BLAKE2B_LEGACY_DEFAULT going to be removed in future versions?

Yes, while it hasn’t been removed yet its reasonable to assume this will be removed in the future.