awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-08 17:28:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove re-encryption from Infisical, move to migration script

Browse Source
This commit is contained in:
Tuan Dang
2023-05-30 20:30:58 +03:00
parent 37251ed607
commit 9440afa386
3 changed files with 90 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/utils/setup/index.ts
+2 -2
View File
@@ -59,8 +59,8 @@ export const setup = async () => {
// re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY // re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY
// to base64 256-bit ROOT_ENCRYPTION_KEY // to base64 256-bit ROOT_ENCRYPTION_KEY
await reencryptBotPrivateKeys(); // await reencryptBotPrivateKeys();
await reencryptSecretBlindIndexDataSalts(); // await reencryptSecretBlindIndexDataSalts();
// initializing Sentry // initializing Sentry
Sentry.init({ Sentry.init({
migration/.eslintrc.js
+8
View File
@@ -0,0 +1,8 @@
module.exports = {
"parserOptions": {
"ecmaVersion": 2017
},
"env": {
"es6": true
}
}
migration/scripts/reencrypt_under_256_key.js
+80 -122
View File
@@ -10,13 +10,6 @@ const decryptSymmetric = ({
tag, tag,
key key
}) => { }) => {
// console.log('decryptSymmetric arguments', {
// ciphertext,
// iv,
// tag,
// key
// });
const decipher = crypto.createDecipheriv( const decipher = crypto.createDecipheriv(
'aes-256-gcm', 'aes-256-gcm',
key, key,
@@ -31,35 +24,10 @@ const decryptSymmetric = ({
return cleartext; return cleartext;
} }
const decryptSymmetric2 = ({
ciphertext,
iv,
tag,
key
}) => {
const secretKey = crypto.createSecretKey(key, 'base64');
const decipher = crypto.createDecipheriv(
'aes-256-gcm',
secretKey,
Buffer.from(iv, 'base64')
);
decipher.setAuthTag(Buffer.from(tag, 'base64'));
let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
cleartext += decipher.final('utf8');
return cleartext;
};
const encryptSymmetric = ( const encryptSymmetric = (
plaintext, plaintext,
key key
) => { ) => {
console.log('encryptSymmetric arguments: ', plaintext, key);
const iv = crypto.randomBytes(12); const iv = crypto.randomBytes(12);
const secretKey = crypto.createSecretKey(key, 'base64'); const secretKey = crypto.createSecretKey(key, 'base64');
@@ -75,116 +43,106 @@ const encryptSymmetric = (
}; };
}; };
/**
* This script re-encrypts relevant database structures from the previous
* server ENCRYPTION_KEY to ROOT_ENCRYPTION_KEY
*/
const main = async () => { const main = async () => {
console.log('main'); console.log('main');
const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY; // 128-bit hex encryption key const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY; // 128-bit hex encryption key
const ROOT_ENCRYPTION_KEY = process.env.ROOT_ENCRYPTION_KEY; // 256-bit base64 encryption key const ROOT_ENCRYPTION_KEY = process.env.ROOT_ENCRYPTION_KEY; // 256-bit base64 encryption key
console.log('1: ', ENCRYPTION_KEY);
console.log('2: ', ROOT_ENCRYPTION_KEY);
let errors = 0;
let success = 0;
mongoose.connect(process.env.MONGO_URI) mongoose.connect(process.env.MONGO_URI)
.then(async () => { .then(async () => {
console.log('Connected!'); console.log('Connected!');
if (ENCRYPTION_KEY && ROOT_ENCRYPTION_KEY) { if (ENCRYPTION_KEY && ROOT_ENCRYPTION_KEY) {
console.log('both ENCRYPTION_KEY and ROOT_ENCRYPTION_KEY are present');
// re-encrypt bot private keys
const bots = await Bot.find({ const bots = await Bot.find({
algorithm: 'aes-256-gcm', algorithm: 'aes-256-gcm',
keyEncoding: 'utf8' keyEncoding: 'utf8'
}).select('+encryptedPrivateKey iv tag algorithm keyEncoding workspace'); }).select('+encryptedPrivateKey iv tag algorithm keyEncoding workspace');
if (bots.length === 0) return; if (bots.length > 0) {
const operationsBot = await Promise.all(
for await (const bot of bots) { bots.map(async (bot) => {
// console.log('bot: ', bot);
try { const privateKey = decryptSymmetric({
const privateKey = decryptSymmetric({ ciphertext: bot.encryptedPrivateKey,
ciphertext: bot.encryptedPrivateKey, iv: bot.iv,
iv: bot.iv, tag: bot.tag,
tag: bot.tag, key: ENCRYPTION_KEY
key: ENCRYPTION_KEY });
});
// console.log('privateKey: ', privateKey); const {
success += 1; ciphertext: encryptedPrivateKey,
} catch (err) { iv,
errors +=1; tag
console.error('failed to decrypt bot A: ', bot._id.toString()); } = encryptSymmetric(privateKey, ROOT_ENCRYPTION_KEY);
// console.log('try'); return ({
// const privateKey2 = decryptSymmetric({ updateOne: {
// ciphertext: bot.encryptedPrivateKey, filter: {
// iv: bot.iv, _id: bot._id
// tag: bot.tag, },
// key: ENCRYPTION_KEY update: {
// }); encryptedPrivateKey,
iv,
// console.log('privatekey2', privateKey2); tag,
} algorithm: 'aes-256-gcm',
keyEncoding: 'base64'
}
}
})
})
);
const botBulkWriteResult = await Bot.bulkWrite(operationsBot);
console.log('botBulkWriteResult: ', botBulkWriteResult);
} }
console.log('number of bots: ', bots.length);
console.log('num succ: ', success);
console.log('num errors: ', errors);
// console.log('bots: ', bots);
// console.log('bots.length: ', bots.length);
// const operationsBot = await Promise.all(
// bots.map(async (bot) => {
// const privateKey = decryptSymmetric({
// ciphertext: bot.encryptedPrivateKey,
// iv: bot.iv,
// tag: bot.tag,
// key: ENCRYPTION_KEY
// });
// console.log('privateKey: ', privateKey);
// const {
// ciphertext: encryptedPrivateKey,
// iv,
// tag
// } = encryptSymmetric(privateKey, ROOT_ENCRYPTION_KEY);
// console.log('re-encrypted PrivateKey: ', encryptedPrivateKey);
// return ({
// updateOne: {
// filter: {
// _id: bot._id
// },
// update: {
// encryptedPrivateKey,
// iv,
// tag,
// algorithm: 'aes-256-gcm',
// keyEncoding: 'base64'
// }
// }
// })
// })
// );
// console.log('operationsBot: ', operationsBot);
}
// const user = await Bot.findOne();
// const secretBlindIndexData = await SecretBlindIndexData.findOne();
// console.log('user: ', user); // re-encrypt secret blind index data salts
// console.log('secretBlindIndexData: ', secretBlindIndexData); const secretBlindIndexData = await SecretBlindIndexData.find({
algorithm: 'aes-256-gcm',
keyEncoding: 'utf8'
}).select('+encryptedSaltCiphertext +saltIV +saltTag +algorithm +keyEncoding');
if (secretBlindIndexData.length > 0) {
const operationsSecretBlindIndexData = await Promise.all(
secretBlindIndexData.map(async (secretBlindIndexDatum) => {
const salt = decryptSymmetric({
ciphertext: secretBlindIndexDatum.encryptedSaltCiphertext,
iv: secretBlindIndexDatum.saltIV,
tag: secretBlindIndexDatum.saltTag,
key: ENCRYPTION_KEY
});
const {
ciphertext: encryptedSaltCiphertext,
iv: saltIV,
tag: saltTag
} = encryptSymmetric(salt, ROOT_ENCRYPTION_KEY);
return ({
updateOne: {
filter: {
_id: secretBlindIndexDatum._id
},
update: {
encryptedSaltCiphertext,
saltIV,
saltTag,
algorithm: 'aes-256-gcm',
keyEncoding: 'base64'
}
}
})
})
);
const secretBlindIndexDataBulkWriteResult = await SecretBlindIndexData.bulkWrite(operationsSecretBlindIndexData);
console.log('secretBlindIndexDataBulkWriteResult: ', secretBlindIndexDataBulkWriteResult);
}
}
}); });
} }