nspcc-dev / nspcc-dev/neofs-node
Make session storage use proper encryption keys
Open
Nobody has claimed this yet.
bug
I4
neofs-storage
S3
security
U4
- Dominant language
- Go
- Stars
- 38
- Forks
- 51
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 38
Description
Expected Behavior
Private key is not used as a symmetric encryption key.
Current Behavior
#1255 did exactly that.
Possible Solution
We're talking sessions here, so there is an ephemeral key pair, public key can be used along with proper salt for ECDH to generate per-token encryption key.
Steps to Reproduce (for bugs)
Look at the code.
Context
#1255, #3425.
Regression
Not exactly.
Your Environment
- Version used: 0.47.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the session-storage implementation and the changes referenced by #1255 and #3425. Determine how the private key is currently used, then verify that session tokens use ephemeral ECDH-derived keys with proper salting and that the private key is not used as a symmetric key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100