Implement encryption at rest #1561
Conversation
| projects: ... | ||
| ``` | ||
|
|
||
| Old keys may be deleted once all existing records were updated to re-encrypt sensitive data. |
There was a problem hiding this comment.
How will the admin know if all existing records are re-encrypted? Is there a way re-encrypt everything at once?
There was a problem hiding this comment.
A good question. This is TBD. Currently, it's up to users to go over all resources and overwrite them (e.g. like Kubernetes that does not offer a way to re-encrypt at once). Not very convenient but failing to decrypt something should not be critical. I think we're going to introduce an API to trigger re-encryption later.
There was a problem hiding this comment.
Added name to aes key config. Now every encrypted value is prefixed with a key name (enc:{key_type}:{key_name}:). DB admins should be able to identify all keys currently used for encryption.
|
|
||
|
|
||
| def get_auth_headers(token: str) -> Dict: | ||
| def get_auth_headers(token: Union[DecryptedString, str]) -> Dict: |
There was a problem hiding this comment.
(nit) Looks like str can be dropped, all callers use DecryptedString
Closes #1532
This PR:
server/config.yml.aesandidentityencryption keys.BackendModel.authandUserModel.tokenusing configured encryption keys.server/config.ymldocs with mini-guide on encryption.Implementation details:
enc:{key_type}:{key_name}:to be able to identify encryption scheme. There is a migration to prefix exiting values withenc:identity:noname:.UserModel.token_hashis introduced to be able to search for user by token after tokens are encrypted.