talos icon indicating copy to clipboard operation
talos copied to clipboard

Consider using secretbox instead of aescbc for etcd encryption

Open Preisschild opened this issue 3 years ago • 0 comments

Feature Request

Description

Talos currently uses the aescbc provider for etcd encryption.

The official documentation does not recommend using this anymore due to it being vulnerable to padding oracle attacks and thus rates it as "Weak". A newer option would be secretbox, which is currently rated "Strong" in the Kubernetes documentation

More Information

  • https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers

Preisschild avatar Oct 04 '22 12:10 Preisschild