Skip to content

Commit 132f623

Browse files
committed
Remove unnecessary section
1 parent d9a6f25 commit 132f623

File tree

1 file changed

+0
-27
lines changed

1 file changed

+0
-27
lines changed

processor/redactionprocessor/README.md

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -170,23 +170,6 @@ are `md5`, `sha1`, `sha3` (SHA-256), `hmac-sha256`, and `hmac-sha512`.
170170

171171
For enhanced security, especially when dealing with low-entropy data like IP addresses, HMAC (Hash-based Message Authentication Code) hash functions are recommended over simple hash functions like MD5, SHA1, or SHA3.
172172

173-
**Why HMAC?**
174-
175-
Simple hash functions are vulnerable to rainbow table attacks for low-entropy data:
176-
- IPv4 address space: only 2^32 ≈ 4.3 billion possible values
177-
- Attackers can pre-compute all possible IPv4 hashes to reverse the hashing
178-
179-
HMAC uses a secret key, making it practically impossible to:
180-
- Reverse-engineer the original value without the key
181-
- Use pre-computed rainbow tables
182-
- Brute-force the hash even if the algorithm is known
183-
184-
**Benefits:**
185-
- ✅ Consistency: Same input + same key = same output (required for pattern analysis)
186-
- ✅ Irreversibility: Cannot reverse without the secret key
187-
- ✅ Rainbow table resistant: Pre-computed hash tables are useless
188-
- ✅ GDPR compliant: Meets true pseudonymization requirements per Article 4(5)
189-
190173
**Configuration Example:**
191174

192175
```yaml
@@ -227,16 +210,6 @@ export REDACTION_SECRET_KEY=$(openssl rand -hex 32)
227210
- HMAC-SHA256 provides sufficient security for most use cases
228211
- HMAC-SHA512 offers additional security margin with minimal performance cost (~10-20% CPU overhead vs simple hashes)
229212

230-
**Key Validation:**
231-
232-
The processor automatically validates HMAC keys at startup:
233-
- HMAC-SHA256 requires keys of at least 32 bytes (256 bits)
234-
- HMAC-SHA512 requires keys of at least 64 bytes (512 bits)
235-
- Empty keys are not allowed when HMAC hash functions are configured
236-
- Configuration will fail if the key doesn't meet minimum requirements
237-
238-
This ensures that weak keys cannot be used accidentally, maintaining the security guarantees of HMAC hashing.
239-
240213
**GDPR Compliance:**
241214

242215
HMAC satisfies GDPR Article 4(5) pseudonymization requirements:

0 commit comments

Comments
 (0)