From 8d8f690b6317fc6198909bfcc8add32bbb134e47 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Sun, 13 Jul 2025 18:52:53 +0400 Subject: [PATCH] requested changes --- backend/package-lock.json | 2 +- backend/package.json | 2 +- backend/src/db/migrations/utils/env-config.ts | 5 +++++ backend/src/lib/crypto/cryptography/asymmetric-fips.ts | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index d3533a3b4..460721966 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -69,7 +69,7 @@ "cassandra-driver": "^4.7.2", "connect-redis": "^7.1.1", "cron": "^3.1.7", - "crypto-js": "^4.2.0", + "crypto-js": "4.2.0", "dd-trace": "^5.40.0", "dotenv": "^16.4.1", "fastify": "^4.28.1", diff --git a/backend/package.json b/backend/package.json index bd7eb6b12..2ba9aca52 100644 --- a/backend/package.json +++ b/backend/package.json @@ -190,7 +190,7 @@ "cassandra-driver": "^4.7.2", "connect-redis": "^7.1.1", "cron": "^3.1.7", - "crypto-js": "^4.2.0", + "crypto-js": "4.2.0", "dd-trace": "^5.40.0", "dotenv": "^16.4.1", "fastify": "^4.28.1", diff --git a/backend/src/db/migrations/utils/env-config.ts b/backend/src/db/migrations/utils/env-config.ts index 7c872cc71..debaea03f 100644 --- a/backend/src/db/migrations/utils/env-config.ts +++ b/backend/src/db/migrations/utils/env-config.ts @@ -55,6 +55,11 @@ export const getMigrationEnvConfig = async (superAdminDAL: TSuperAdminDALFactory const fipsEnabled = await crypto.initialize(superAdminDAL); + // Fix for 128-bit entropy encryption key expansion issue: + // In FIPS it is not ideal to expand a 128-bit key into 256-bit. We solved this issue in the past by creating the ROOT_ENCRYPTION_KEY. + // If FIPS mode is enabled, we set the value of ROOT_ENCRYPTION_KEY to the value of ENCRYPTION_KEY. + // ROOT_ENCRYPTION_KEY is expected to be a 256-bit base64-encoded key, unlike the 32-byte key of ENCRYPTION_KEY. + // When ROOT_ENCRYPTION_KEY is set, our cryptography will always use a 256-bit entropy encryption key. So for the sake of FIPS we should just roll over the value of ENCRYPTION_KEY to ROOT_ENCRYPTION_KEY. if (fipsEnabled) { const newEnvCfg = { ...envCfg, diff --git a/backend/src/lib/crypto/cryptography/asymmetric-fips.ts b/backend/src/lib/crypto/cryptography/asymmetric-fips.ts index da49f99fc..ad076b3c3 100644 --- a/backend/src/lib/crypto/cryptography/asymmetric-fips.ts +++ b/backend/src/lib/crypto/cryptography/asymmetric-fips.ts @@ -1,4 +1,4 @@ -import crypto, { KeyObject } from "crypto"; +import crypto, { KeyObject } from "node:crypto"; import { SecretEncryptionAlgo } from "@app/db/schemas"; import { CryptographyError } from "@app/lib/errors";