Tool to decrypt & re-encrypt datastore items
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 70
- Forks
- 16
- Avg merge
- 4h 36m
- Merged PRs (30d)
- 30
Description
We encrypt sensitive datastore items with a "datastore key". This key is versioned, and we have support for introducing new key versions & using them to encrypt newly-written data.
However, we currently don't have the ability to remove (stop trusting) an old key. This is because we don't have a tool to update the key used by datastore items (i.e. decrypt the data & re-encrypt with the new primary key). So if we stop trusting an old key, we lose the ability to read data encrypted by that key.
We should implement a tool that can iterate through a datastore, reading all existing encrypted data, and rewriting the same data encrypted with a new key.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by locating the datastore encryption and key-version handling, then determine how a datastore-wide iteration and rewrite should be scoped. Done means existing encrypted items can be read and rewritten with the new primary key before the old key is no longer trusted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100