awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 11:29:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-13 18:52:53 +04:00
parent 563ac32bf1
commit 8d8f690b63
4 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/migrations/utils/env-config.ts
+5
View File
@@ -55,6 +55,11 @@ export const getMigrationEnvConfig = async (superAdminDAL: TSuperAdminDALFactory
const fipsEnabled = await crypto.initialize(superAdminDAL);
// Fix for 128-bit entropy encryption key expansion issue:
// In FIPS it is not ideal to expand a 128-bit key into 256-bit. We solved this issue in the past by creating the ROOT_ENCRYPTION_KEY.
// If FIPS mode is enabled, we set the value of ROOT_ENCRYPTION_KEY to the value of ENCRYPTION_KEY.
// ROOT_ENCRYPTION_KEY is expected to be a 256-bit base64-encoded key, unlike the 32-byte key of ENCRYPTION_KEY.
// When ROOT_ENCRYPTION_KEY is set, our cryptography will always use a 256-bit entropy encryption key. So for the sake of FIPS we should just roll over the value of ENCRYPTION_KEY to ROOT_ENCRYPTION_KEY.
if (fipsEnabled) {
const newEnvCfg = {
...envCfg,
backend/src/lib/crypto/cryptography/asymmetric-fips.ts
+1 -1
View File
@@ -1,4 +1,4 @@
import crypto, { KeyObject } from "crypto";
import crypto, { KeyObject } from "node:crypto";
import { SecretEncryptionAlgo } from "@app/db/schemas";
import { CryptographyError } from "@app/lib/errors";