At this time we are using the encryption key in koha-conf to encrypt stuff for 2FA, EDI and Acquisition already. The key was introduced for 2FA. I think that it would be better to differentiate and use separate keys for various processes in Koha. For instance, the key for 2FA should be used exclusively for that purpose. We could consider if that is needed also for EDI and Acq since these are related modules. They could use one or two new keys. When adding a new call to Encryption, we should think about it. Perhaps this would be forced a bit more by passing a parameter to K::E indicating which key to use? Opening the discussion :) What do you think?
Why that? Security?
Having a single master key isn't uncommon, but it could be nice to be able to have multiple encryption keys and to specify which one is needed for what feature. I think that this mechanism could be especially useful for key rotation. (I notice Marcel has already commented on bug 32078 where we had talked a bit about key rotation.) I've used other systems where I've rotated encryption keys in this way. Another future use could be data interchange. Perhaps you'd want to share encrypted data with another system without giving that other system your master key. You could just encrypt that particular information with a shared key while keeping most other data encrypted using a master key. This scenario is pretty hypothetical though.
Using one encryption key for whole Koha is obviously more convenient than carrying a large keychain but is unsafer too. If you get that key, you can decrypt everything. Interesting question though would be: How would you get one key and not the others? And underlying, is koha-conf the best place to save them? Easy to ask, harder to answer. If you would get secrets from some vault, you still need a token for that, etc. As David referred to the rotation bug, the management of data encrypted with which key and what version becomes a bit harder.. Security always has a price.
At the point you have access to root to get the koha-conf, you have everything including the database and all of the keys anyway (because you can become koha-mysql or koha-dump the whole thing) and all of the keys are right there in the koha-conf. While I agree that one key does allow access to more things, the added complexity of multiple keys... the idea of it makes me very tired, for a really negligible gain in security.
(In reply to Liz Rea from comment #4) > complexity of multiple keys... the idea of it makes me very tired, for a > really negligible gain in security. Thx for your contribution. Still not having enough energy to respond on its content :)