Change to re-create masterkeys #12

sharidas · 2017-08-23T08:05:34Z

This change brings a new command to re-create
masterkey

Signed-off-by: Sujith H sharidasan@owncloud.com

PVince81 · 2017-08-31T09:09:33Z

moving to planned. Let's focus on fixing the core issues first.

PVince81

please refresh my memory: how much code from decrypt-all and encrypt-all has been reused/copied ?

If a lot, is there a way to internally invoke the decrypt-all and encrypt-all command ? before and after regenerating the master key ?

PVince81 · 2017-09-18T15:53:41Z

lib/Command/RecreateMasterKey.php

+		$yes = $input->getOption('yes');
+		if ($this->util->isMasterKeyEnabled()) {
+			$question = new ConfirmationQuestion(
+				'Warning: Inorder to re-create master key, the entire ownCloud filesystem will be decrypted and then encrypted using new master key.'


not the entire filesystem but: "all the user's home storages will be decrypted".

Will external storages be affected ? I'm not sure

Verified with external storages:

SFTP

ownCloud ( without encryption when added and later running the recreate master key script )

ownCloud ( with maseter key encryption added and later ran the recreate master key script )

ownlCloud ( with user key encryption added and later ran the recreate master key script )

PVince81 · 2017-09-18T15:54:39Z

lib/Command/RecreateMasterKey.php

+				$output->writeln("Decryption started\n");
+				$progress = new ProgressBar($output);
+				$progress->start();
+				$progress->setMessage("Decryption progress...");


"Decryption in progress..."

PVince81 · 2017-09-18T15:55:24Z

lib/Command/RecreateMasterKey.php

+					$this->IAppManager->disableApp('encryption');
+
+					//Delete the files_encryption dir
+					$this->rootView->deleteAll('files_encryption');


is this correct ? Remember that encryption keys can be stored in a different location with an occ storage (key storage root)

PVince81 · 2017-09-18T15:55:54Z

lib/Command/RecreateMasterKey.php

+				$this->appConfig->setValue('encryption', 'enabled', 'yes');
+				$this->appConfig->setValue('encryption', 'useMasterKey', '1');
+
+				$this->keyManager->validateShareKey();


what happens if this fails ? will it throw an exception, should we catch it ?

It would try to create keys if it doesn't exist. If key exist nothing will be done. Same is for validateMasterKey

PVince81 · 2017-09-18T15:56:45Z

lib/Command/RecreateMasterKey.php

+		$target = $path . '.decrypted.' . $this->getTimestamp();
+
+		try {
+			\OC\Files\Storage\Wrapper\Encryption::setDisableWriteEncryption(true);


are we also using this in the occ decrypt:all command ?

No we don't this technique of calling setDisableWriteEncryption at \OC\Encryption\DecryptAll::decryptAll()

PVince81 · 2017-10-09T14:07:58Z

tests/KeyManagerTest.php

 			->disableOriginalConstructor()
 			->getMock();
 		$this->configMock = $this->createMock('OCP\IConfig');
+		/*$this->configMock->expects($this->any())


commented out code ?

Removed the commented out code.

PVince81 · 2017-10-09T14:08:27Z

lib/Command/RecreateMasterKey.php

+	protected $encUtil;
+
+	/** @var  IAppManager */
+	protected $IAppManager;


$appManager

Replaced with $appManager

PVince81 · 2017-10-09T14:09:03Z

lib/Command/RecreateMasterKey.php

+					$this->IAppManager->disableApp('encryption');
+
+					//Delete the files_encryption dir
+					$filesEncryptionDir = $this->encUtil->getKeyStorageRoot();


assuming this works with alternative key storages ?

Yes I have tested with alternate key storages

PVince81 · 2017-10-09T14:09:58Z

lib/KeyManager.php

+
+		$this->masterKeyId = $this->config->getAppValue('encryption',
+			'masterKeyId');
+		if (empty($this->masterKeyId)) {


don't use empty() for strings, because in PHP empty("0") is true...

Instead of using empty() , tried to use !== ''

can it be null ? in your other PRs you tested with both is_null and !== ''

Updated the check for is_null and !== ''

sharidas · 2017-10-09T14:43:07Z

This PR should go along with owncloud/core#29072

This change brings a new command to re-create masterkey A small modification to the decryptall, to standard output to console. Signed-off-by: Sujith H <sharidasan@owncloud.com>

PVince81

👍

PVince81 · 2017-10-16T10:04:18Z

@sharidas please backport to stable10

sharidas · 2017-10-16T14:47:58Z

Backport available here: owncloud/core#29260

sharidas self-assigned this Aug 23, 2017

sharidas added the 2 - Developing label Aug 23, 2017

sharidas added this to the development milestone Aug 23, 2017

sharidas force-pushed the withencryptionwrapper-recreate-master branch 2 times, most recently from c7c0efa to 73870af Compare August 24, 2017 09:26

sharidas force-pushed the withencryptionwrapper-recreate-master branch from 73870af to cd1a215 Compare August 30, 2017 14:48

PVince81 modified the milestones: planned, development Aug 31, 2017

This was referenced Aug 31, 2017

Change to re-create masterkeys #11

Closed

Change to re-create masterkeys #6

Closed

sharidas mentioned this pull request Sep 18, 2017

Changing a master key owncloud/core#21434

Closed

PVince81 reviewed Sep 18, 2017

View reviewed changes

sharidas force-pushed the withencryptionwrapper-recreate-master branch 3 times, most recently from 765ab35 to 9ca5039 Compare September 22, 2017 12:40

sharidas added 3 - To Review and removed 2 - Developing labels Sep 27, 2017

sharidas force-pushed the withencryptionwrapper-recreate-master branch 2 times, most recently from 6d61606 to 9dce123 Compare October 9, 2017 06:36

PVince81 reviewed Oct 9, 2017

View reviewed changes

sharidas force-pushed the withencryptionwrapper-recreate-master branch from 9dce123 to a34a983 Compare October 9, 2017 14:41

Change to re-create masterkeys

4c962f7

This change brings a new command to re-create masterkey A small modification to the decryptall, to standard output to console. Signed-off-by: Sujith H <sharidasan@owncloud.com>

sharidas force-pushed the withencryptionwrapper-recreate-master branch from a34a983 to 4c962f7 Compare October 9, 2017 16:49

PVince81 approved these changes Oct 16, 2017

View reviewed changes

PVince81 merged commit fcf697b into master Oct 16, 2017

PVince81 deleted the withencryptionwrapper-recreate-master branch October 16, 2017 10:04

sharidas mentioned this pull request Oct 16, 2017

[Stable10] Change to re-create masterkyes owncloud/core#29260

Merged

9 tasks

J0WI mentioned this pull request Jul 6, 2021

Support for rotating rotating master key used for server-side encryption nextcloud/server#2964

Open

Change to re-create masterkeys #12

Change to re-create masterkeys #12

Uh oh!

Conversation

sharidas commented Aug 23, 2017

Uh oh!

PVince81 commented Aug 31, 2017

Uh oh!

PVince81 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sharidas Sep 19, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sharidas commented Oct 9, 2017

Uh oh!

PVince81 left a comment

Choose a reason for hiding this comment

Uh oh!

PVince81 commented Oct 16, 2017

Uh oh!

sharidas commented Oct 16, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sharidas Sep 19, 2017 •

edited

Loading