OrchardCore icon indicating copy to clipboard operation
OrchardCore copied to clipboard

Secrets module (Lombiq Technologies: OCORE-124)

Open deanmarcussen opened this issue 3 years ago • 28 comments

Fixes #7137 Fixes #13205 Fixes #15087 Fixes #5558 Fixes #3259 Replaces #6421

Once this is merged, https://github.com/OrchardCMS/OrchardCore/pull/14021 can continue.

Ready for a bit of a look, but not entirely ready.

Introduces a Secrets Module which can be used to abstract secrets in a way where they can be used across machines, and as part of deployment plans.

Uses a hybrid of asymmetric and symmetric encryption.

I've used RSA keys to encrypt a one time AES key, and the AES key is then used to encrypt each 'secret'

The idea being that the RSA keys must be shared outside of Orchard Core, and any imports / or setup recipes, will need to manage that RSA key, in order to decrypt the AES key. (mostly done due to not being able to limit the size of the 'secret' to be encrypted, and being unable to force it under the RSA size limits)

@kevinchalet if you have some time, would you mind taking a look at what I've done there? Still wip, and I see from some of the OpenId modules, that the key generation has some problems on Windows, which I'll need to allow for.

Also have stored them as the RSA key, rather than an X509 certificate, as you did there. Could be moved to a certificate if you thought that better?

Also need to have a good look at how setup will work with this, and the extra dependencies it has created

deanmarcussen avatar Dec 07 '20 14:12 deanmarcussen