Enable encryption at rest for Secrets

[lbroudoux]

Reason/Context

As of today, Secrets content is not encrypted when written into the MongoDB database. Of course, MongoDB communication can be secured using TLS and so on but encryption at rest is way better. We absolutely need to address this to provide better security guarantees to our adopters and users.

Description

We should study how Client-Side Field Level Encryption or some other techniques can be enabled and used within Microcks. MongoDB encryption seems to be supported via Spring Data MongoDB, the library we're using the communicate with Mongo.

Implementation ideas

Any ideas from people having experience and/or interest on this field is more than welcome!

[sahil270803]

I Have implemented AES-256-GCM encryption to secure secrets in MongoDB. First, create an encryption utility using Node's crypto module for handling encryption/decryption: const cipher = createCipheriv('aes-256-gcm', encryptionKey, iv). Then, modify your Secrets schema to store encrypted data with its IV and auth tag: { encryptedData: string, iv: string, authTag: string }. Here's a quick example of encrypting a secret: const encryptSecret = (plaintext) => { const iv = randomBytes(16); const cipher = createCipheriv('aes-256-gcm', encryptionKey, iv); const encrypted = cipher.update(plaintext, 'utf8', 'hex') + cipher.final('hex'); return { encryptedData: encrypted, iv: iv.toString('hex'), authTag: cipher.getAuthTag().toString('hex')   }; }

To implement this, first add a MASTER_KEY to your environment variables, then update your MongoDB operations to encrypt secrets before storage and

[lbroudoux]

Reading more about this, I realize that Client-Side Field Level Encryption is different from Encryption at Rest.

So I wonder if enabling CSFL is actually necessary, given that TLS + Encryption at Rest can already be enabled and cover a lot of security concerns.

What do you think? Any advice or recommendations on this topic? I'm eager to learn.