Add support for database encryption
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Is your feature request related to a problem? Please describe.
The NextCloud database contains sensitive/personal data about users. Sensitive data could be leaked due a vulnerability in NextCloud. On most installations, the database is hosted on a third parity infrastructure, that could also leak data.
Describe the solution you'd like
PostgreSQL, MariaDB and MySQL all support symmetric and asymmetric encryption of columns natively.
It would be great to have the ability to optionally encrypt sensitive/personal content of the database.
Similar to the file encryption module, this can be done with a master key and/or user specific keys.
This will make it much harder to steal useful data, because you'd also need all user keys to decrypt the content.
Describe alternatives you've considered
MariaDB does also support database encryption:
https://mariadb.com/resources/blog/table-and-tablespace-encryption-on-mariadb-10-1/
https://mariadb.com/kb/en/library/why-encrypt-mariadb-data/
But this would not protect users if data is leaked due a vulnerability in NextCloud (e.g. SQLI).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by surveying the database layer and the existing file encryption module, then clarify which sensitive data, database engines, and key-management model are in scope. Done would mean an agreed, tested optional encryption design that addresses both database compromise and SQL injection concerns.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mariadb, mysql, php, postgresql
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100