cozy-data-system icon indicating copy to clipboard operation
cozy-data-system copied to clipboard

When error "master key and slave key don't exist" is raised encrypted field not visible

Open ZeHiro opened this issue 9 years ago • 6 comments

I have tons of these errors in ths logs :

error - lib/encryption | [decrypt]: master key and slave key don't exist

And no more encrypted data (password) in my DB.

I cannot understand the reason of this error.

Restarting the data-system does not help.

ZeHiro avatar Jul 30 '15 07:07 ZeHiro

After restarting the stack, everything is back

ZeHiro avatar Jul 30 '15 11:07 ZeHiro

Hi ZeHiro, This error is thrown when the stack has been restarted and an application try to access some password in database before the user connects. Password are encrypted with your instance password as key. When you first connect, we keep it in memory to decrypt content from the data system when applications need it. If your server is restarted, the password is lost and application are unable to decrypt data before you log again. So application don't see encrypted data between a restart and your next connection.

clochix avatar Jul 31 '15 08:07 clochix

That'a what I understood. Should'nt the app stopped or restarted in this case?

ZeHiro avatar Jul 31 '15 10:07 ZeHiro

@poupotte will give you a more precise answer, but be patient, she's AFK for some days.

clochix avatar Jul 31 '15 11:07 clochix

It mostly happens with Konnectors. I will try to understand what happens with this app. It will probably help to solve the problem.

frankrousseau avatar Aug 03 '15 10:08 frankrousseau

It is caused by the .save calls and goes like this : Application get the document GET /data/23723823872 {doctype: X, password: 'stillencryptedblob' or undefined }

Then, it does a .save PUT /data/23723823872 {doctype: X, password: 'stillencryptedblob' or undefined, lastSync: now}

And the DS store the password twice encrypted (or encrypted with "undefined" as the key, or something weird like that). We should probably prevent GETing something if we cant decrypt it and avoid usage of the .save method in the applications.

aenario avatar Aug 03 '15 10:08 aenario