Encryption keys should also be stored in the database
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
The user, master, and recovery encryption keys should be stored in the database as well as in key files. The key files can get overwritten by other processes, and are stored along with the data so they are less likely to be regularly backed up.
The decrypt-all somehow mangled my master key and now I've lost all my data. My backups didn't include the key files as I didn't have enough space to include multiple copies off all my files at once. Having a single point of failure with the decryption keys seems like a bad design, especially with the other persistent encryption bugs.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the decrypt-all flow and the existing user, master, and recovery key files. Determine how those keys are currently persisted and how database storage would coexist with the key files. Done means the keys are stored in the database as well as in key files without breaking decryption or recovery.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100