Summary: | Encryption keys should not be shared between modules | ||
---|---|---|---|
Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook, jonathan.druart, martin.renvoize, tomascohen, wizzyrea |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Marcel de Rooy
2023-10-03 14:50:50 UTC
Why that? Security? Having a single master key isn't uncommon, but it could be nice to be able to have multiple encryption keys and to specify which one is needed for what feature. I think that this mechanism could be especially useful for key rotation. (I notice Marcel has already commented on bug 32078 where we had talked a bit about key rotation.) I've used other systems where I've rotated encryption keys in this way. Another future use could be data interchange. Perhaps you'd want to share encrypted data with another system without giving that other system your master key. You could just encrypt that particular information with a shared key while keeping most other data encrypted using a master key. This scenario is pretty hypothetical though. Using one encryption key for whole Koha is obviously more convenient than carrying a large keychain but is unsafer too. If you get that key, you can decrypt everything. Interesting question though would be: How would you get one key and not the others? And underlying, is koha-conf the best place to save them? Easy to ask, harder to answer. If you would get secrets from some vault, you still need a token for that, etc. As David referred to the rotation bug, the management of data encrypted with which key and what version becomes a bit harder.. Security always has a price. At the point you have access to root to get the koha-conf, you have everything including the database and all of the keys anyway (because you can become koha-mysql or koha-dump the whole thing) and all of the keys are right there in the koha-conf. While I agree that one key does allow access to more things, the added complexity of multiple keys... the idea of it makes me very tired, for a really negligible gain in security. (In reply to Liz Rea from comment #4) > complexity of multiple keys... the idea of it makes me very tired, for a > really negligible gain in security. Thx for your contribution. Still not having enough energy to respond on its content :) |